Hacker News Reader

Comment by dannyw | Hacker News Reader

A SIM card generally holds somewhere along 32 to 128 kb, most of which empty and used to store user contacts.

That's a bit like saying "most of the space of a smartphone's persistent storage is empty and otherwise used to store photos and videos" when talking about smartphone operating systems and their security.

There is nothing technically stop the carrier putting more memory on the SIM card.

It’s even a microcontroller that emulates the original SIM, so it can have whatever specs they want.

What do you mean by "original SIM"? As far as I know, SIM cards have always been specified in functional terms, so vendors were always free to implement them whatever hardware and software they choose, as long as the result complies to ISO-7816 and the relevant ETSI/3GPP specifications.

Today, it's mostly Java Card implementations, meaning that the ISA and smartphone OS/runtime is abstracted away in any case.

They are ordered from the manufacturer (idemia,thales/gemalto,oberture) with speficied memory size depending on what capabilities are needed.

The big iffy is that manufacturers were compromised (by the US afaik) in 2015 and all cards from then or earlier should be considered compromised.

Few carriers encrypted their OTA-keys before then. I know that some carriers did not send encrypted keys to manufacturers still in 2018.

This is true. AFAIK SIMs are based on an ISO 7816 smartcard with some additional features, and the former are definitely in that size range.

Reply on news.ycombinator.com