Zero Trust SIM | Hacker News Reader

Zero Trust SIM

blog.cloudflare.com

379 pointsaofeisheng276 comments

Great implementation of the wrong solution. The problem isn't that SIM security is weak but it's that we're using SIM/eSIM for identification and authorization in the first place. When we stop using SIM for authentication the need to guard against SIM Swap attacks goes away as well.

That's one line in the announcement and is not the core of what we announced. This eSIM provide a data connection that goes directly to Cloudflare.

How does this data connection work in practice? Sounds like you have to become an MVNO, no?

They will essentially be an MVNO, yes. It doesn't address security much though - the carrier's infrastructure still needs to be trusted and there is no end-to-end encryption between the mobile device and Cloudflare (you'd still need an on-device VPN for that - this is a limitation of the mobile protocols; the network is considered trusted and is given access to the traffic). The eSIMs that Cloudflare uses also need to be properly segregated away so that the carrier's customer support people can't reissue those SIMs, which they can technically do as they are still considered the issuer and their system is in control of the issuing process.

This blog post doesn't read like rest of Cloudflare posts. It is very beating around the bush and doesn't get to the point at all. Please consider updating the blog for clarity and brevity.

But the data connection is not end-to-end encrypted to CF.

The SIM authenticates you to the mobile network which is free to tamper with your traffic. Considering the "security" of the equipment in there, as well as the incentives of the people working there and the general level of skill and development practices in there, I wouldn't trust it at all.

The only way this would be secure is if the SIM/eSIM is able to embed an actual client certificate which the mobile device can then use to initiate a VPN connection to Cloudflare, but this would also require the eSIM to not be able to be tampered with by the issuing carrier, otherwise they could potentially push an update to extract the keys or have it sign malicious requests in the background.

This ^.

Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer).

Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http

This. SIM is not secure and will never be. just use yubikeys and/or other compatible webauthen and you will finish this non-ending cat and mouse race of phishing/anti phishing solutions.

A physical SIM card is a smartcard, and in many ways is exactly like a yubikey. A yubikey even presents as a USB smartcard.

The attacks on SIM cards are not on the SIM itself, but by the carrier binding your identity to a different card. A function they must perform at least sometimes! If you lost your yubikey, I'm sure you want your replacement to be able to activate your cell phone.

> SIM is not secure and will never be.

That's just nonsense. You need to explain what you mean by that, because otherwise you sound like someone who doesn't know what they are talking about. If you mean SIM swap attack, then that's basically 'social engineering' with a help of identity theft targeting providers and has nothing to do with SIM cards themselves.

I think two things can be true:

1. Phones are an important attack vector to consider

2. We should be using strong 2FA ala FIDO2

Given that phones can act as FIDO2, I think that only strengthens (1).

Even if a phone isn't used for 2FA, it still is likely to have access to company resources - Slack, Email, non 2fa text messages, etc.

I never understood the thinking behind banning VoIP. I understand the ease that attackers can make and use new numbers but if I'm using a VoIP number to receive 2FA SMS wouldn't it be more secure to have that tied to a VoIP number that can't be SIM swapped and potentially is secured with 2FA itself?

It's because most companies that use SMS "2FA" don't use it for your security, they use it for their security—phone numbers are a costly resource, and every phone number an attacker spends to launch a spam attack is a phone number they'll never be able to use again. VoIP numbers flip that logic on its head by making it much cheaper to provision and allocate phone numbers. This also slightly protects user accounts because it makes it harder for attackers to "overwrite" a hijacked user account with their own bogus phone number during takeover, but that's a secondary goal—the main goal is spam reduction

I get it, but it's still sad.

Lots of places reject my Google Voice number, just because it's VoIP. I've had that number for ten years and the account it is under is protected by a popular security key.

But that Prepaid SIM I have for a month and might ditch any time, no problem, everyone takes that.

You can port other numbers to Google voice, which helps I think.

not really, they will be identified as voip then

I keep hearing back and forth on this, you would hope that this gets updated every once in a while but seems like mixed results. I don't even know what the process is called to research this.

VoIP is banned?

Many social media sites don't allow you to register using e.g. Google Voice or Twilio phone numbers, since you can get those for free and/or in bulk, so they assume they're used for spam or ban evasion.

I've seen this on Twitter, which doesn't require a phone number to set up, but it's possible for your account to be flagged as suspicious, and get locked down until you add a phone number.

Ebay and Uber are more.

Lots of banks reject VoIP too.

Twitter does lock you out and force you to give them your phone number, even if you technically can register without one. I’ve seen them do so almost instantly after registration.

That's very concerning. Many phone companies require you to back your hard number to a national id.

Say something bad about insert monarchy... They'll trace you down with that.(Turkcell does that just for wifi at IST)

In many countries they are required to do so by law for acquiring any phone number. Including per-paid. It's not uncommon that it's true for _any_ phone number including VoIP. But a single person as a "company" can get a huge number of VoIP numbers and then "accidentally" get hacked by a illegal phishing call center then using that numbers. Or maybe that persons passport got stolen and used by a similar locking person. Or the passport verifying personal got bribed. Etc.

Slight correction: They don’t block VoIP. They block numbers that were issued to VoIP providers.

I have an AT&T number ProRes to Google Voice which works perfectly. But another native Google Voice number does not.

Lol, again I'm hearing numbers carry the VoIP tag permanently vs not. It doesn't seem to be consistent to say the least. I bought my number from GV (changed) and it carries the stigma. Read peoples experiences in porting from services like number barn and total mixed bag.

For your experience did you sign up for those services before or after transferring to VoIP?

Best is this system is broken. There is always a VoIP provider that works with the selected service.

And there are always also many services where you can rent non VoIP numbers for a single SMS for pennies.

If paying $0.05 is a form of security we could just charge for registrations as well.

It is. I'm guessing the thinking is that ANY 2FA is better than none.

I would love to use a proper authenticator app or security key for everything important, but the reality we live in is that many financial institutions still only support phone-based 2FA. If CloudFlare ould force them all to add support for proper 2FA, that would be fantastic, but I don't think that's an option.

If they can make SIMs more secure in the meantime, that's a win, and a very important one.

Improve the things you have control over rather than just bemoaning the things you don't.

> the reality we live in is that many financial institutions still only support phone-based 2FA

I believe that's exactly the point the grandparent comment was addressing when they said "we stop using SIM for authentication". The "we" wasn't necessarily referring users, but to services and providers currently using SIM 2FA in their products.

Sure, but Cloudflare can't make that happen, so instead Cloudflare is doing what they can.

I totally agree with you. I am not blaming Cloudflare here, they are trying to create workarounds and patch holes around the lack of proper 2FA from those services and providers. But the real goal is imo those services and providers implementing proper 2FA.

> but the reality we live in is that many financial institutions still only support phone-based 2FA.

True and even highly sensitive Govt. services authentication for citizens in some large countries depends upon SMS based 2FA, Although the CF article is focused on corporate infrastructure security and I doubt if any of the 'Fortune 1000' companies mentioned actually still use SMS 2FA; CF is trying to block the phishing URL from being resolved and SIM-swap.

Meanwhile as a concerned individual, Since SMS 2FA is not dying soon I would wish at least some mechanism is brought forth to prevent the underpaid, overworked personnel at the carrier from being able to access that 2FA SMS and aiding in SIM-swapping.

This is not mainly about SIM security as far as I understood.

It's more about employees visiting phishing sites on their phone. Or their phone getting hacked exposing mail correspondence, or 2FA getting hacked etc.

In the way it's presented it's still the wrong solution IMHO.

If security matters and the work requires a phone do not allow BYOD. Provide a phone. For such a phone this might be an okay solution, not for a private phone. If a phone isn't strictly required remove phones completely and strictly out of the loop. This is beneficial both for security in more ways then this sim service provides and for the mental health of your employee. Make it clear that even if they are called because of an work emergency they are contractual bound not to process it on the phone but instead switch to a employer provided device no mater who calls and which situation it is. PS: Also fire any manager or even the CTO who tries to pressure employees into not keeping the rule, make it an automatic firing through a contract clause.

The "when" there is the tricky bit. When are we going to stop using SIMs for authentication? That relies on a whole lot of unrelated parties individually deciding to do something better. Absent government regulation (which will take a decade to implement anyway)... good luck with that.

Why is there no opposition to this shit? SIMs were physical for a reason. As a consumer what do you get out of it? You have to go through the carriers to switch between phones now! You can't just pick up a random unlocked phone and put a sim in it. No more burner phones. I have been in situations where I changed SIM between phones multiple times a day.

But it sounds like it is too late for this. It's like people who oppose cash payments out of the convenience of card/app payments. This small chipping away of a small libery adds up.

I hope eveyone knows that you can't as a layman register an email address or any meaningful service you depend on without a phone number (i.e.: a sim), that is what is being regulated here even more.

Nothing you say here has any relation to eSIMs.

1. This problem can exist with real SIMs too. Back many years ago Verizon used to lock your SIM to a specific IMEI and you had to call them to change it (they might have even charged a fee for changing it, I don't remember for sure?)

2. Nothing prevents a phone company from offering an anonymized eSIM.

Anonymous phone numbers are drying up, but not because of eSIMs.

Verizon is a bad example as they were CDMA and always more locked down

Verizon happens to be the provider I had at the time, I wouldn't be surprised if other providers did it too.

When I was on Verizon, I remember having to go into their store to get a new SIM each time I got a phone that wasn't through them. Using eSIMs after I switched to Fi was a small but noticeable quality of life improvement for me at least.

As another comment said, you’re referring to Verizon’s CDMA network. Which did not use GSM and this did not use SIM cards. Literally, no SIM cards. It wasn’t until their LTE network they supported SIM cards in any meaningful way. Their handsets were locked to their network and only worked on their network. Occasionally, an “international” phone would be sold that had CDMA + GSM so their customers could use it overseas but the SIM card slot did literally nothing here in the states since those phones wouldn’t have supported T-Mobile or AT&T’s network frequencies.

And just because nothing prevents a phone company from offering them, doesn’t mean they will. Having the ability to just move a SIM card is very pro-consumer in a way I don’t think esims will ever be (unless the EU regulates it).

More recent versions of CMDA devices did support SIM cards.

> It's like people who oppose cash payments out of the convenience of card/app payments

Well, yeah, cards are radically more convenient. And this eSIM also looks like it solves real problems. People want to solve real problems. Until "my eSIM provider won't let me register for email" (or something? I'm guessing that that's what you're saying is a problem) or "I have no physical SIM to swap into another device, and for some reason I care about that" are bigger problems no one is going to optimize for that.

SIMs were/are also issued by carriers? You have to go through carriers either way. You're using their network.

You got a sim and you put it in any phone you wanted. Now every time you switch a phone, you have to contact your carrier and possibly even get charged for the change.

If you travel a lot, you just buy a prepaid sim card in whatever country you're in, and put it in a phone, then leave the country, take the sim out and use another sim in that country. Some new phones (notably the new iphone, us version) don't even have a sim card slot anymore.

> Now every time you switch a phone, you have to contact your carrier and possibly even get charged for the change.

This depends on the carrier.

I use US Mobile. In their app, there's a very simple button on each line's screen to transfer the eSim to another phone. I converted my physical sim to eSim on my iPhone XS before the iPhone 14 came out a couple weeks back. When I got my iPhone 14 I was able to transfer the sim to my new phone in about 30 seconds.

The ONLY gotcha here is you do need internet access to make this work, so that is one thing to keep in mind. But it's super easy to do and I really don't see a majority of the complaints around how easy it is being legitimate. I suspect many of you haven't actually used eSims before.

Can you transfer the eSIM if the source device is broken?

Presumably that would require calling your provider to do. But depending on how your source device was broken, even with a physical sim that might be required.

I mean a big benefit of a physical sim card is you can quickly swap it out of a broken device...

Or you just use a carrier that allows re-scanning eSIM activation codes. Then the only problem is your device physically breaking, which actually "traps" the eSIM profile.

So you depend on the company's goodwill. Has this ever worked when it comes to monopolized industries?

As others have mentioned, companies can (and some but not all do!) tie physical SIMs to a given IMEI just as well, so it‘s less a question of goodwill and more one of competition, consumer education and choice etc.

I think this (tieing phones to sims and vice versa) is forbidden in EU.

It's less about what's technically forbidden and more about what's actually enforced.

If the carrier forces you to spend an hour on hold to talk to a customer support agent to reissue an eSIM provisioning code, would that be considered tying? Probably not, yet it's still very effective at discouraging people from switching phones.

It's definitely a trade-off between privacy/liberty and other benefits.

The spread of standardised time and clocks had a significant negative impact on individual liberty, and people would even sabotage clocks. They failed of course, as will the opposition against the cashless society, because cash is so much worse in most aspects.

If it's something you care a lot about, rather than going the way of the Luddites and opposing eSIM and electronic payments I would suggest focusing on using technology to find new solutions to the privacy/liberty problems.

Yeah. They want a magnificent dystopia, where everything will be digitalized and you will be tracked, micro-chiped, no privacy, own nothing, only rented and be a happy 'user'.

Physical SIMs are microchips.

I think OP meant microchips that cannot be detached from the device.

Physical SIMs can be easily disconnected and destroyed without destroying the device.

Which doesn't help from a tracking point of view because the device still retains a persistent, unchangeable identifier (the IMEI) which will be broadcasted as soon as you insert a new SIM (and maybe without one even, since in certain locations SIM-less emergency calls are possible).

All of these things you mention are real trends, but they are not tied to eSIM.

1. eSIM standard supports transferring of eSIM profile from one phone to another. physical SIMs can be tied to specific IMEIs (and it use to be VERY common) 2. You can use eSIMS on unlocked phones. 3. Burner phones can still exist! Nothing prevents a phone company or MVNO from offering eSIMs the same way they did SIMs before (obviously local law might force you to provide ID, but this has been the case with SIMs as well in various countries)

>1. eSIM standard supports transferring of eSIM profile from one phone to another

Source? The only implementation I know of is on iOS, which allows you to transfer esims between phones that are on the same icloud account. For every other phone the solution was to get a new QR code from the provider.

You simply unregister the eSim on the first phone and then scan the QR code on the new phone, it works "offline" too.

Unfortunately, that's not true for all eSIMs I've used – some activation codes are single-use, and you have to contact the provider to issue a new one every time. Some of them even charge for that...

But I agree that this is exclusively a policy problem, not a technical problem with eSIM, which clearly supports reusable profiles as well.

I would still call that a technical problem, fundamentally. If the technical failing didn't exist, then businesses would be unable to create the user-hostile policy to decommodify the market.

But they are able to do exactly the same thing with physical SIMs! So what‘s the difference?

There is still a difference in that doing this to a physical SIM requires the carrier going out of their way to integrate a check with the automated SIM setup process, whereas with eSIM such activation request would seem to be an inherent step of the process.

I do agree that cell protocols in general need to be reformed to get rid of static device identifiers like IMEI. I'd go even further and say that the tamper proof aspect of SIMs should be eliminated - the application processor can store the key to auth to the network, putting the user in control rather than suffering arbitrary top-down restrictions enforced by hardware they purportedly own. Though obviously that's a pipe dream while regulators continue to work for Ma Bell.

It depends on the carrier implementation. Here in Italy both TIM and Vodafone allow for infinite rescan of the same qrcode, Wind3 does not.

There's no "opposition" because your entire argument is predicated on a straw man that you have invented in your own mind.

The need for anonymity for legal reasons is absolutely not a straw man argument.

I just finished telling a woman how she should be careful on dating apps and always use an anonymous sim card, never give out her real number, or real contacts, to strangers.

But my country is making this impossible now too, and the reason is drug dealers using them for burner phones of course.

What problems do you suppose using an anonymous sim card solves in the real world of dating?

With many mobile providers, the name on the account is directly associated with the number. Try to enter your own mobile number into Twilio’s lookup feature and see what name pops up.

Not just for dating, women who flee their home with a child in their arm and are put up in a secret apartment by the local ROKS org here usually still have to contact the babys father at some point. I know first hand it's one of the biggest issues in those orgs to keep their apartments hidden from anyone but the police.

> The need for anonymity for legal reasons is absolutely not a straw man argument.

That's not really an argument against eSIMs. As you point out getting an anonymous real SIM is also impossible in many countries. What prevents anonymous SIMs (or eSIMs) are legal issues and is not related to the technical implementation. Potentially eSIMS could make the whole process of getting burners much easier, if it wasn't for the legal issues.

Remember also that about 1/3 of Australia just had their PII leaked because one of the nation's biggest telcos couldn't do basic isolation between dev and prod.

If your phone can scan qr codes you can use esim its pretty easy at least in my experience. I unlocked my phone when i was traveling to Kenya grabbed an esim for a couple cents when i landed and was set up in seconds.

ESims are quite nice, out here in the real world.

You can travel to a different country, find your data is crap because reasons -- either they're not roaming well (hello edge on a cheap out of country provider), or you've travelled to Switzerland and data now costs 7.13eur/mb. (yeah, a car/Gb)

So you pay for an ESIM from an MNVO, get a qr code, install, and you're good to go in 5 minutes from any network connection. Nothing physical required. And your normal number is still there for incoming calls/texts, because all the ESIM phones I've seen have at least two slots (or one + physical sim)

Of course, you've got to have an unlocked phone. But you wanted that anyway.

It's so nice to not have to spend the first day of a trip wandering around looking for a SIM shop that's open and will sell to you with a foreign passport.

Last time I was abroad, I set up an eSIM while I was waiting at baggage claim, so I had service on my multihour train connection.

> It's so nice to not have to spend the first day of a trip wandering around looking for a SIM shop

I went to three different countries this summer and all of them had sim cards available on your way out of the airport. In Armenia, it was in the baggage claim.

This is sometimes true. Like in Tunisia where they give a free SIM in baggage claim. But I crossed a lot of land borders through west africa where it would be a day or two of traveling before I could find an official store that had a physical SIM.

Experiences differ.

I did not notice this in Ireland, but I may have missed it. It was this easy in London though.

Also all EU sim cards roam in the whole of the EU automatically.

A lot of asian countries have similar convenience for physical SIMs, order online and just pickup at a stall at the airport.

Can you actually get a European sim without showing ID? That would kind of surprise me, there has been a big push to get rid of anonymous phone numbers.

Depends, I think you can get them in Tesco pretty easily, and the MVNO I was talking about was giving numbers for their data plan from the UK, but with roaming all over Europe.

I think it's more difficult in Germany than a lot of other countries.

In France, providers will require you to provide KYC information within 14-30 days of obtaining the SIM, or it will be deactivated. Suitable for a short-term travel use case.

Here in Latvia you can buy sims from all major providers without any ID for as low as 0.99€. The caveat is that you have to top up them regularly because they have expiry times depending on the amount you top them up.

Swype by Yallo is the eSIM I've used.

My Telecom Italia SIM ran out of roaming data while I was in Switzerland, and there was no way to top up. Swype had a first month free promo, so I signed up from my Airbnb. I did have to send a photo of my documents, but the total time from download to data was less than 30m.

I took a quick (1 week) work trip to Germany this summer. I was trying to figure out how to get a SIM before getting on the train, when I remembered I still had the eSIM in my phone. I downloaded the app and bought data - $15 per month + $3 per day (since I was roaming). Not only was it super convenient, but I had unlimited data with roaming. I don't think even local cards get you that.

For short trips to Europe, I definitely recommend Swype for its convenience.

> I did have to send a photo of my documents

Didn't the parent ask about not having to show ID to get a SIM card?

I’m fine with showing ID but if I’m traveling I of course do not have a local ID and if it’s online it’s basically impossible to properly check ids.

In Sweden there are usually stands where you can pick up sims for free, in airport outside shops etc.

Depends on the country. UK has no national identity cards, you can buy a (prepay) SIM in the supermarket and pay cash if you like.

https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...

I'm Canadian. I recently travelled to Spain & Portugal for more than a month, used a Hong Kong esim for data for a few days until I found a local physical SIM. Then swapped between both depending on the coverage.

I bought the esim at the airport, while waiting for my bags.

I perceive the problem differently. Google Fi has demonstrated that it's possible to arrange service agreements across providers that offer consistent, predictable, relatively low costs for people that travel frequently between countries. If there was another couple global-scale competitors to Fi I'd wager we'd see competition squash the prices down even more. But at the moment, when I step off a plane or drive across a national border it's an experience basically equivalent to driving across states here in the U.S. I've used it in 4 continents and about 20 countries now and it's pretty much instant.

The problem of course is that Fi is U.S. based which brings a few extra headaches with it for people who want the service but are based overseas, or for expats living abroad for a long period of time.

Note: I also have some Voip apps on my phone giving me a few different phone numbers to the same phone without the SIM/eSIM mess. But these days I'm finding I'm more or less just making voice calls over apps anyways meaning I'm using voice service less and less.

+1 for Google Fi

I use Google Fi and I've been to the Netherlands, France, Spain, Italy, and Switzerland. When I landed, I'd get a text message saying something like "Welcome to $COUNTRY! Your data is $DATA_RATE per gigabyte and voice calls are $VOICE_RATE per minute. It may take a couple minutes to get connected"

DATA_RATE has always been the standard Google Fi rate of $10/GB (with data free after a certain point, and free but throttled at another threshold), and the voice rate is typically 10 cents/minute.

For people that do a lot of travel and use a lot of data, you can even get an unlimited international data plan.

But yeah, I can go to nearly any first world country, and even some 3rd world countries, and not pay extra for my data. The fact that Verizon/TMobile/Sprint/etc. can't get their shit together and make this happen for their customers feels like a scam.

-1 For Google Fi. I traveled to 2 countries on their list of "compatible" places where data should work, it didn't. Called support, no explanation. Bought a cheap local sim card instead, which always makes more sense to do. Now that Whatsapp and iMessage both let you "roam" on a different sim while keeping your phone number, there's no reason to try and roam with your original plan.

If you have a dual-SIM phone and your primary plan supports Wi-Fi calling, you don't even need to "roam" on a different SIM. You can use a local SIM card as your data plan and route your calls and texts over that network. There are a few iPhone apps I've used that allow you to download an eSIM in a couple minutes for five bucks.

Parent comment mentioned iMessage, that means iPhone. Are there any dual-SIM iPhones?

I think all of them since the XR/XS era, 2018 ish? My iPhone 13 mini does dual eSIM (I used both AT&T and T-Mobile when I was in a remote area and it worked great).

> The fact that Verizon/TMobile/Sprint/etc. can't get their shit together and make this happen for their customers feels like a scam.

Or maybe it is not worth it because the cost of doing so is not worth the possibly small number of people who would use it? A good number of people never even leave the country. I wouldn't be surprised if the vast majority of people in the US leave the country five or fewer times in their lifetime.

> The fact that Verizon/TMobile/Sprint/etc. can't get their shit together and make this happen for their customers feels like a scam.

TMobile provides this same service for free for international travel (I actually wonder if this is where Google Fi gets the service for it from).

ATT is $10 per day, up to $100 per month after which the rest of the month is no extra charge. It starts and stops automatically when you start and stop using international data/voice/SMS/MMS.

https://www.att.com/international/day-pass/

Which is beyond ridiculous.

Basically esims are more convenient, great. Why are they not optional? Why can't phones support both types of SIM?

A lot of phones do, eg most Samsungs since the S20 have physical and eSIM.

There's also an interesting product from https://esim.me/ that emulates the functionality of an esim on a physical sim card, and lets you switch between eSIMS via their app even on older phones like the galaxy S8.

Thank you, I didn't expect my original comment to get attention, I just wanted a healthy discussion and education on things I don't know.

Was a big fan of Google Fi, it really does work amazingly well when you travel a lot - I've been a digital nomad using it for about 5 years (back when it was Project Fi).

But I recently got a taste of that "US based" policy. I am technically based in the US (have a company here) but I have been out of the US since Covid started. Google Fi worked well for about 2.5 years but suddenly when I was in Greece recently, the data stopped working.

When I spoke to customer service, they first told me it's a known issue in the region and I just gotta wait. When I called back 2-3 days later, they informed me that it's my specific account which has been blocked because I've been outside the US for too long.

They billed me for my unlimited international data but essentially blocked me from using ANY data. They said the data will resume as soon as I'm back in the states (which I was in a few weeks anyway). Ridiculous.

This situation really sucks. I'm in the US right now but my Fi data won't work outside the US. Makes it useless pretty much.

Anybody who thinks esims don't have issues hasn't seen much of the "real" world. In a lot of countries esim still isn't even an option, especially if you're a visitor. At least in developing countries getting a physical SIM is as easy as paying a small fee on your way out the airport and popping it in your phone or picking one up in a convenience store.

I just arrived here in Panama and got a local sim for $5/week from a grocery store. The esim options were 2x this price and required installing special apps.

can't a regular sim be typed in manually and used as an esim? at least that's how it worked on my iphone a year ago.

Airalo just works in most of the world. I travel quite a lot and eSIM made my life a whole lot simpler.

Before you had to find an operator kiosk at the airport and negotiate with someone there who might or might not speak a language you speak to try to get a pre-paid vaguely firing your need if one exists. Now you can just pre-buy in app before your flight and everything pretty much just works.

I keep seeing this sentiment and it's incredibly obvious that people are traveling to European or developed Asian countries. The sim situation in most other countries is exactly as you describe if not worse, and that's also accounting for language barriers between the traveler and the vendors.

My bet is that this is going to change a lot, very soon.

Apple apparently felt comfortable enough with the eSIM situation in the US to drop legacy-SIM already. The fact that they couldn't do this worldwide yet is because, as you say, eSIM availability is still spotty around the world.

However, the fact that they're moving to eSIM-only is a huge flashing warning to telcos around the world that the time to sort out their eSIM support is now. Otherwise, they'll soon be chasing away their affluent iPhone users.

I think the transition will now proceed pretty quickly. Physical SIMs have only continued on due to market inertia.

In a few years we'll look back and think "remember when SIM cards were physical objects... that was weird wasn't it?"

I agree, I also remember when sim cards were credit card sized!

Appel was a major driver of esim because they are obsessed with controlling every part of their phone so having a SIM card they don't control in their phone didn't fit well with them at all.

So dropping the SIM in the US is more a consumer hostile move to save a few cents and force them to use the tech Apple wants you to use then anything else.

They can't do that in many other countries as neither carrier nor population where okay with accepting not having a SIM slot.

eSIM is easily usable in the EU many people still insist on using physical sim cards for various reasons, similar "unlocked" phones are the standard in many EU countries. I'm not even sure it's legal to sell carrier locked phones in all EU countries, I think it isn't at least in some.

I think you underestimate how easy Apple has made it to switch carriers with eSIMs. I can have several stored on my phone and activate them with a few touches. Very consumer friendly, no need to go to the store or even shuffle SIM cards while taxiing to the gate.

eSIM can be sold in physical stores as well, just as a QR code rather than a physical chip. Sibling comment addresses the cost issue as well.

In some countries no domestic carrier supports eSIM.

Here's a map, thanks to a Redditor: https://www.reddit.com/r/ios/comments/x8r6a3/countries_that_...

> So you pay for an ESIM from an MNVO, get a qr code, install, and you're good to go in 5 minutes from any network connection.

Physical SIMs require no network access at all: as a matter of fact, acquiring a SIM may be a prerequisite of getting a network connection in a foreign country.

That has never been my problem. Dealing with people, stores, passport verification, scams, etc has been.

The increased competition from international MVNOs likely also helps drive prices down.

When you're traveling and don't want to plan weeks ahead, your options with physical SIMs typically were either

1) special roaming-oriented SIM cards from your local country (which were still a massive hassle and had to be ordered days in advance to allow for delivery),

2) getting a SIM in the destination country (hassle and might not always be possible)

3) very expensive offerings from your own provider, if they even had something better than the aforementioned car-per-GB rates.

Now, you can get an eSIM from an MVNO that's from a third country, before travel or from the airport/hotel WiFi, usually also bypassing any bureaucratic bullshit that the destination country imposes on getting a local SIM.

And these "travel eSIMs" are often cheaper than local offerings even for use in your home country.

For now. And the move to "eSIMs" will be a one-way door. There's a reason embrace, extend, extinguish works as a strategy.

You mentioned all the conveniences which I never disputed. As an optional feature I have no problem against them.

This is not a problem anymore. I visit about 4+ countries every year (hello IMF / World Bank contracts) and have done 43 countries in last 6 years (on Google Fi, T-mobile and Indian Jio).

T-mobile includes 5GB / month of full speed international roaming in virtually any country in the world. (15 GB for $50 after it).

Getting a new local e-sim does not scale when you visit multiple countries or area in a jurisdiction which requires ton of documentation (including a local address or contact they can verify). Even then, it’s complicated.

For example, just this year I learnt that a local Indian e-sim (pre-paid) will not work in state of Kashmir in India or parts of Xinjiang in China.

> It's like people who oppose cash payments out of the convenience of card/app payments.

Well it wasn't that long ago, 95% of HN comments were all for Digital Payment, Apple Pay, and Cashless Society. Things only changed around ~2019.

Well, a lot has changed on HN. I used to agree with half of the people here. Now, it is less than 5%, usually gray comments.

I think it is not just HN, the society itself has devolved and going into the toilet. Or it could just be that I have changed, but that's easily litmus tested by just reading old threads which I still agree with (pre-2019).

Regarding physical stuff, just the other day people love the idea of QR codes in restaurants with no opposition to the totalitarian digital state we're slowly building. Same goes with security cameras, cashless payments, parking apps, esim, covid QR codes, etc.

QR codes are extensively used in China for tracking people everywhere.

How does a QR code in a restaurant translate to a "totalitarian digital state"? It's just a machine-readable link, nothing more.

This comment thread = hn insanity. Putting aside your misplaced outrage here, I recommend actually reading the article. Granted it’s incredibly winding and full of the buzzword “zero trust”, but they explicitly mention adding support for physical sim cards.

My comment was about how phone makers like apple are getting rid of physical SIMs.

Just use a script to swap "zero trust" with "big brother", and the article becomes legible!

I am not sure how common this is in the US or other countries, but in the Czech Republic (maybe in the whole EU?), the carrier is obliged by law to provide you with a special numerical code which you can then use to transfer your phone number to a new carrier without the old carrier being able to do anything about it or indeed being involved in any way at all. This completely erases the need to have a physical SIM in order to keep your phone number.

I am not sure whether carriers here offer prepaid eSIMs though.

Same in Poland. The usdye is that not all providers support esim (2 out of 4)

This is commonly called Number Portability. I don't think it's mandated by the EU, but every EU country I looked up supported it.

In the Netherlands, for example, you can obtain a new SIM card or port number to another NL carrier. KPN uses the PUK code to verify ownership, which I think is great and has the least amount of hassle if you have written down the PUK code that was printed on the SIM package when you first bought it. The downside is that you cannot change the PUK codes.

Phone number does not equate to SIM. I use VOIP for SMS and only when really needed. I suppose this solution could work with dual esim where one could primarily use https://invisv.com/articles/pretty-good-phone-privacy.html.

And this is exactly why I’m not going to buy new SIM-less iPhones.

In typical Apple asshole fashion, in China you can buy an iPhone which takes two sims, in US - zero. Talk about carrier lock-in and Apple helping it.

What carrier lock-in? My iPhone can support 8 eSims. I can have two active at a time and switch between them whenever I want.

When you drop your iPhone on the floor and it shutters, how exactly are you going to get to your SMS 2FAs?

The point of SIM is that you can transfer service to another handset without talking to anyone. Which is invaluable, for example, when you travel in the foreign country and your iPhone dies from water damage, albeit being advertised as “waterproof”.

The same example also goes into the opposite direction: Let's assume your phone gets stolen in a foreign country: With a regular SIM card I lost my phone service for the remainder of the trip. With an eSIM I can buy another phone (that supports eSIMs) and login to the website of my provider to download a new eSIM. Problem solved.

but it could _trivially_ support 8 eSims _and_ at least one physical SIMs for like a few cents of additional production cost and basically no cost for maintenance because that is already supported in some places anyway.

> I hope eveyone knows that you can't as a layman register an email address or any meaningful service you depend on without a phone number

You can open a gmail account from a residential IP adress and get the phone number field as optional.

That isn't quite true. It's really up to a(n AI) coinflip whether or not the phone number field will be mandatory.

I’ve got 20,000 devices in the field. All SIM. Can’t change providers as it would be cost prohibitive as I’d need to visit all locations.

With eSIM I can just push a new configuration.

20,000 devices on an air-gapped procedure, is a security feature.

If it's easy for you, it's easier for whomever has backdoor access.

I feel you, but consider this - we live in alternative reality where eSIM comes first and then somebody comes and says you need to put a black box into your phone (which is btw spinning up whole java environment) if you want to make calls. You could probably get outraged at that too.

An eSIM is the same black box, just reconfigurable and soldered on.

I mean so is CPU, but in general it's a bit harder to hide stuff in some untrusted binary than it is in hardware. In general. In this case I think we're doomed regardless.

Btw, if somebody knows good technical writeup on eSIM, I'd love to read it.

eSIMs are called eUICCs in the specs iirc, that might help you find information about them.

For many of us in the US, that was indeed the case. I had a CDMA phone on Verizon's network until 2007 when I switched to T-Mobile and got a GSM phone.

I've honestly never thought about this issue until reading it. I wonder why they couldn't make registration-free eSIMs like they have with physical SIMs. That would be a major inconvenience when traveling otherwise.

I do remember this thing called SIM-locking

Why does this effect the existence of physical sims?

I just opened a google account without a phone number.

Was it easy? Hell no, but its still possible. (Its just for search console and technical stuff, never using it for my personal data)

And the Phone number trend is so annoying, and its made to force you to hand something rare and difficult to change.

Want to order something from any carrier or an online shop without a phone number? Good luck

> SIMs were physical for a reason.

Because eSIMs had not been invented yet? You say it like it was a conscious decision…

> You can't just pick up a random unlocked phone and put a sim in it

True, but you will be able pick a random unlocked eSIM-capable phone and transfer your eSIM to it via bluetooth. I believe Apple already announced this feature coming to iPhone, all other vendors will follow. No need to contact SP anymore.

> I have been in situations where I changed SIM between phones multiple times a day.

Can I ask what the use case is? I believe this will continue to be possible with the “transfer eSIM over bluetooth” method I mentioned above.

>It's like people who oppose cash payments out of the convenience of card/app payments.

totally agree on this, laziness or the continued pursuit of convenience is the end of privacy, maybe even democracy.

>you can't as a layman register an email address or any meaningful service you depend on without a phone number

mailbox.org, posteo.de… there’s lot of email service not requiring a SIM. They even allow you to pay cash via postal service =)

How is this even Zero Trust. Admittedly, there is no precise definition for ZT, but Cloudflare's solution seems to run counter to the idea of perimeter-less ZT philosophy. Instead of assuming that phones can be insecure and developing appropriate crypto based mechanisms, Cloudflare is proposing to bring the phone inside a 'trusted' network. Remember, ZT does not rely on trusted network.

Solutions like this will increase confusion and fragment the already 'interpretation led' as opposed to definition led ZT landscape.

I don't see anything about a trusted network, it looks like this is about authorizing devices. It seems a little bare on the details of how it works, but apparently it ties into a Cloudflare product called Magic WAN. Authorizing specific devices is still a good strategy even with zero-trust networking.

Yeah I thought the same. Sounds like the marketing team got a bit excited here

Device attestation is an important piece of the zero trust design, which this esim approach helps facilitate.

ZT / BeyondCorp benefits from multiple layers of security, not the hard exterior and crunchy interior approach of VPNs, and this solution from cloudflare is aligned with that.

Maybe I got it wrong, but the eSIM seems to be enabling a corporate VPN of sorts here.

That’s not the case — note that we don’t say “trusted network” in the blog. That’s definitely not the right solution.

There’s two key parts:

1) we can filter and secure traffic _leaving_ the device, whether bound for the Internet or internal apps. This isn’t VPN like: this is part of our software gateway. When you click (tap!) on a phishing link, we can filter it and render it inert.

2) using the eSIM, which is associated with a specific employee, as an identity signal and device posture signal. This fits squarely into the Zero Trust model. ZT is about explicit identity, not the old days of implicit “I’m on the VPN and can move laterally!”.

(I work at CF)

> What if employers could offer their employees a deal: we'll cover your monthly data costs if you agree to let us direct your work-related traffic through a network that has Zero Trust protections built right in?

No thanks..What is "work-related" and what isn't? I see huge privacy implications here. If my company wants to install this potential-spyware on my phone then they should just offer a separate phone. Personally, I don't mind carrying it if I'm "on-call" one week out of the month or whatever.

I wonder if it is easy enough to "swap" e-SIMs that one could load your work profile on your phone (can iOS do that? I am not sure, but Android can anyways), swap sims before work starts, do work, "go home", swap back to your personal phone profile and personal sim.

Otherwise, I agree: give me a work phone if you want to snoop on it, otherwise please just text or call me on my personal.

My current company pays partly for my phone (like half?) and don't expect anything in return, they just wanted to make sure if I used it to make calls for work I was paid for that (I never do anyways).

iOS can swap, it's just a flag in your phone app/control center.

My personal preference is expensing a phone bill. That way I maintain billing control and just save some money. Or a company phone, but I've yet to have that offered to me.

> And all this is before you add in the further complication of Bring Your Own Device (BYOD) that more employees are using — you’re trying to deploy Zero Trust on a device that doesn’t belong to the company.

Yeah, this is a pretty impressive technical solution to a problem created by the company. “We’re too cheap to buy equipment for our employees to use, so instead we need to spy on all of your personal data.”

Carrying around two devices for many is annoying, so for those BYOD is helpful.

If it’s truly a choice, I have no objection. Outside of the tech industry it doesn’t seem to be.

I'm seeing a lot of people advocating for either eSIM or standard SIM slot. I feel like the real question should be "why not both?"

I know there are economics, control, tracking, or whatever at play. Regardless, I think the phone should have a SIM slot and it should ALSO have eSIM functionality.

I can almost guarantee the reason they're pushing for eSIM is because it's cheaper to manufacture a phone without a milled out slot with water sealant lining, little switch to pop out the SIM deck, etc.

Can we all not agree that the real "enemy" here is the corporations taking away your options? If we were really thinking about the consumer here, we'd be ensuring you had access to both technologies to ensure your phone is robust and capable of working on any network regardless of their SIM requirements.

Maybe this is crazy talk though. Maybe eSIM is so amazing, old SIM doesn't even matter anymore, but I can't help but feel like I'm right here, because having both quite literally appeases everyone except rich corpo's trying to save a buck.

> I can almost guarantee the reason they're pushing for eSIM is because it's cheaper to manufacture a phone without a milled out slot with water sealant lining, little switch to pop out the SIM deck, etc.

That's precisely it, it's just that Apple et al. don't need to explain their reasoning to sell phones. They never have an official reason for removing the headphone jack, but their COGS is definitely lower.

I can't help but think of Room 641A every time they announce a new project where they're like "we'll take care of it by directing your traffic through our network"

https://en.wikipedia.org/wiki/Room_641A

edit: whoops. let me be clear that i'm a big fan of cloudflare! that's just where my brain wanders sometimes

Yep. I'm convinced CF is government-backed mass-surveillance through a "private company." I'd love to be convinced otherwise, but it's the NSA's dream to man-in-the-middle the Internet.

Except it’d be the end of a $20B company that I have a huge stake in ensuring doesn’t end. So, so long as I’m CEO, there’s no way in hell that’ll happen. If all you believe in is my economic interest, it’s far more lucrative to be the trusted, private network over time than any alternative. And so we’ll invest like crazy to ensure, even if compelled, we wouldn’t have the ability to compromise the integrity of the data flowing through our network.

If I was the US Government / NSA, I'd pay $20 billion to secretly own cloudflare.

Plus premium. It would be free in practice.

>"If all you believe in is my economic interest, it’s far more lucrative to be the trusted, private network over time than any alternative."

And yet AT&T has proven otherwise. [1][2]

[1] https://www.macrotrends.net/stocks/charts/T/at-t/stock-price...

[2] https://en.wikipedia.org/wiki/Room_641A

The person you are responding to wasn’t suggesting you are altering the data (“compromising its integrity”), but snooping on it, which you obviously have the ability to do and can be compelled to do it.

Even if we take what you say at face value, you've already done too many things that err much more on the side of money than on the side of doing the right thing.

But honestly, any casual consideration of Occam's razor with relation to your company's actions would be much more simply understood if we consider that Cloudflare wants to be a monopoly.

Is Cloudflare ever going to stop trying to centralize more and more of the Internet? Please - go ahead and tell me about how, at some point, because you care so much about being trusted, you'll say, "You know what? We're getting too big. Let's pump the brakes on that and help out some other companies so the Internet's resilience won't be harmed."

Could that ever happen? Would that ever happen? Or will you just keep finding excuses and telling lies about how what you're doing for the world is for "everyone's own good"?

Right, but 641 wasn't about the integrity of the data, it was about the confidentiality. They had a big-ass fibre splitter intercepting the firehose of the internet, and presumably running protocol analysis on "their" copy of it. They weren't injecting malware into it a la Sony, just grabbing a carbon copy. And largely, people were okay with it in the name of "national security" following the September 11th attacks.

I have every confidence that CF doesn't do that today, but since it's the termination point for TLS for a HUGE portion of the internet (including my own sites ;p), that seems like a huge target for feds to try to tap into. I think a lot of peoples' concern is that someday it could happen under a more authoritarian cabinet and court. As long as it can be done, it eventually will.

Absolutely nobody wants that, save for a couple very under-educated and highly powerful individuals. But the rest of us might not have a choice.

Would be nice if you acted as a neutral infrastructure party.

hi. love CF and all the free services.

care to elaborate on the interview you mention the DHS hinted to the value of CF (nee honepot)?

was it a formal feedback? from a person related to dhs but in a personal setting? how that happened? and what relationship continued/started from it?

Why do you continue to provide services to 0chan.life who openly post massive amounts of monkey torture videos?

You don't have a choice in the matter. Your refusal would simply mean your imprisonment. Economics has absolutely nothing to do with it. Welcome to the modern surveillance state.

It is not even his choice necessarily. They can go to a different person in the company with the notorious letter.

Agreed. And let's be honest...they already have.

Imprisonment or the company being bled dry[0].

[0] - https://www.theguardian.com/world/2014/sep/11/yahoo-nsa-laws...

> we’ll invest like crazy to ensure, even if compelled, we wouldn’t have the ability to compromise the integrity of the data flowing through our network

By aggregating the whole internet onto Cloudflare you are creating choke points where fiber taps are far more effective to deploy than the previous situation where they needed to tap hundreds of different regional providers.

Sure you can do encryption for data in flight, but your keys and CA infrastructure now become one of the most valuable intelligence targets. Unless you can attest that not a single CF employee has family in China, or gambling problems here in the US, was born in Russia, etc. there is a weakness somewhere waiting to be exploited.

We don't care what makes financial sense for you now. One day you will be dead, and what you created will be taken private by a well resourced entity with less morals.

You already have? You've proven that you'll just do whatever media tells you to do. Media is not exactly very dangerous. Why wouldn't you also fold to far more dangerous government pressure, especially if you're also being pressured by media at the same time?

Counterarguments to that:

- Room 641A wasn't the end of AT&T, and I'm sure the three-letter agencies have a way to make your economic interest align with theirs (e.g. through legal or extralegal threats).

- Even if you personally are trying to prevent it, they can compel employees and plant a backdoor, possibly a non-obvious kleptographic one in the encryption you use in the backbone. You might genuinely not know if it was happening (and if you knew, you'd be forced to deny it, both to preserve the stake you mentioned and presumably due to dire consequences from the three-letter agencies if you talked).

- Snowden revealed the existence PRISM, but the details and level of collaboration are still not really known today. The companies have certainly survived it. All the negatives sides of collaboration only manifest if it is discovered, which is far from guaranteed.

Just to be clear, this is not accusing you of being corrupt, malicious, or a willing participant, just pointing out the harsh reality that your wish to not participate in this may not matter much.

For most companies, the NSA is not part of their threat space.

But the company is part of the USA's threat space -- everyone is an adversary and potential enemy, and all information that can be useful will be collected.

The NSA is in everyone's threat space, because who knows how the information will be used later. "Well, they aren't using it to hurt me at the moment" isn't a great reason to be non-critical of mass surveillance.

For targeted surveillance yeah guarding against intelligence agencies is extremely difficult. But there are choices like self-hosting file storage versus putting it in the cloud. One option makes your data easily collectible.

> whoops. let me be clear that i'm a big fan of cloudflare! that's just where my brain wanders sometimes

I'm not. They're one of the biggest vectors for the centralization of the entire internet. You're right to be critical of every single thing they do.

agreed, i'm just a fan of their innovation. would be cool if we could decentralize their tech. somehow use their data and code to standup my own ddos detection system without having to proxy through them

"We have sophisticated logging set up as part of Cloudflare One, and this will extend to Cloudflare SIM. Today, Cloudflare One can be explicitly configured to log only the resources it blocks — the threats it’s protecting employees from — without logging every domain visited beyond that."

So my employer can log all of my network traffic metadata, but I can take their word for it that they have some setting set that it only logs hits on their deny list that they are filtering my private internet usage with? CloudFlare needs to give more power to employees here to make sure that employers are completely unable to monitor any traffic that doesn't go to their networks. The abuse potential for this in its current form is gigantic.

If your phone service is provided by your employer, they have control.

Phone service is cheap. Get your own.

See also: Email.

Yes they can also tell you they don't log anything but blocked content but then log everything anyway, you have no way to know.

To top it of even just logging blocked content can be a major invasion of privacy as things like union sites and similar are sneaked onto block lists all the time.

What's the advantage of using this vs. installing a mandatory VPN via an MDM profile? For mobile data, the outcome seems to be identical, but it would also work for Wi-Fi.

There's no advantage from a security point of view, but much disadvantage because the VPN is end-to-end encrypted between your phone and the VPN server. This is not; the mobile network has access to the plaintext traffic.

The advantages of this that I see is better/easier management, you deal with a nice web interface/API and (if needed) competent customer support people rather than monkeys.

What even is the advantage for the person who actually owns the phone?

Likely this is using the private network option that mobile carriers have been offering. Hologram has something similar where every SIM is in a private IP space behind a NAT. Now it seems CF can run your phones in their own private LTE/5G network, anything going to work addresses gets split directly to those endpoints and "auth'd", while personal goes out to the internet. Similar to a VPN but without an endpoint and less spam traffic since it's a private network only your authorized SIMs can get onto. You could still run a VPN but all your Zero Trust should be over HTTPS/TLS and MitM becomes a bigger lift to make happen since you now have to attack cell sites.

> [..] logs only what it blogs

putting aside that it's not clear weather it can be configured to do so or always does so and if the employee has any way to know if it is configured to log only blocked content or log everything its still a no-go

the things is that content which is fully legal no-risk is feed all the time into block list and fishing protection to make it less accessible

for example the CCC ticket selling side was frequently "somehow" in the minor protection DNS filter enabled by default by all UK ISPs...

you can be pretty sure that union and employer right protection related sites will "somehow" end up in the filter and not only will that bar the employee from realizing their information need/rights, it will also show up in the log accessible to the employer

then you probably can configure the "protection". How long will it take to be possible to enable blocking of adult-content or similar? This would lead to a potential indirectly exposing of employee sex related preferences to the employer, or religion, or ...

Trying to pretend this system is not incredible invasive to employees privacy is hypocrisy and puts a pretty bad light on cloudflair. I mean they could say it's less invasive then many other existing methods, I guess that might be right, but that doesn't mean it's okay at all.

In the end trying to marry BYOD with security is just nonsense. If the work tasks need a phone then provide a phone to the employee (which could use this system). If you only worry about 2FA use HSKs. Remove phones out of any security related procedure, that is anyway recommended for other reasons like SIM-hijacking. Then don't require or allow employees to install anything which could be used as a attack vector on their private phone, no slack, no teams no nothing. If there is an emergency you can call them and tell them to use their employer provided device, it's that simple.

> Mitigating common SIM attacks: an eSIM-first approach allows us to prevent SIM-swapping or cloning attacks, and by locking SIMs to individual employee devices, bring the same protections to physical SIMs.

I thought a sim swap attack is carried out by asking the operator to reissue a sim card, and getting it done via a failure of identity verification or a collaborator working at the operator. What is to stop just requesting the re-issue of an eSIM to a new device in the same way?

Yes, only every successful SIM swapper I am aware of. It sure is hard protecting a glass house.

You can say that again. Zero trust that Cloudflare, the largest man-in-the-middle of the Internet which began its life as a CIA honeypot, will not abuse this.

Bingo. Way too much centralization of communications in exchange for mild convenience.

And of course, it will be dismissed with a "you're just paranoid" pat on the back until, inevitably, and predictably, they weaponize it (with the back-patters being nowhere to be found).

Yeah I was just thinking the same thing, zero trust except of course for CloudFlare, you have to trust them implicitly.

I'd not heard of Cloudflare starting out as a CIA honeypot. What are the details on this?

Also looking for a source for this claim.

Any source at all.

Please make this product available for non-enterprises too (at a cost, of course.) @jgrahamc @eastdakota

That's kind of our playbook, right?

that's great to hear. thought it was going to be locked behind enterprise door.

As a consumer, if pricing was reasonable, I would switch to this is a heartbeat.

Looking forward to hearing about it -- but I really do want to be able to use it with my phone ISP (Irritating Service Provider :-) and not have to switch to some specific provider. I use MVNOs (specifically, Ting Mobile now, but I'll be switching to US Mobile soon).

Also, I'd like to be able to use your DNS and NextDNS's one -- I love your security, but (particularly on mobile where I pay per byte for data!) I love that NextDNS blocks tons of ads and trackers. So much less data downloaded. So much faster internet. So much nicer too.

Thanks for doing CloudFlare! I use it for my websites, would be cool to know it's (deeply) protecting my phone too.

You can set up a Zero Trust policy with block lists and use it with the 1.1.1.1 Warp app on any platform, which provides not just DNS but VPN too. It's more sophisticated than NextDNS, the only downside is that because it's an enterprise offering, there are a ton of options and it's a bit complicated to set up.

There are built-in blocklists for malware, suspicious domains, and much more. To block ads and trackers requires uploading custom block lists, which requires manually uploading a csv file (annoyingly, limited to a maximum of 1000 entries per file).

https://developers.cloudflare.com/cloudflare-one/policies/fi...

Wow, great idea... I guess I was hoping they'd do the hard work :-) but I'll look into this.

Also, countries specifically South Asia

I know you're the CTO, I just wanted to say that Cloudflare is an amazing company that recently took a couple of steps in the wrong direction. The new playbook seems like it has added a page of crayon doodles.

Intellectuals understand what happened with the censorship incident on both sides of the argument, but both agree that trust is one of those things that builds over time and difficult to achieve. IMO a company such as Cloudflare needs to build trust through extreme sense of stability and guarantee. Rule book needs to be super explicit with zero ambiguity written with a precision pencil, not a spray can.

The only attack this is preventing is corrupt or confused mobile network customer service representatives issuing a valid SIM card to an attacker so that the attacker can intercept 2FA SMS messages, but any larger-ish company should already have a corporate phone plan with clearly established contact points to do any kind of change.

So what I don't really get is, what is the actual advantage? And besides, Cloudflare will have to run as an MVNO if they're rolling their own SIM cards / eSIM keys, which almost always means lower quality of service in congested network areas - there is no requirement for equal treatment of MVNOs I'm aware of, and even here in the EU you can clearly see that providers discriminate even between premium post-paid contracts and pre-paid contracts. Switching from Telekom's own MVNO Congstar to Telekom proper was night and day.

The attack you describe (somewhat dismissively) is extremely common.

Against private phone contracts, yes indeed - but as I said, large companies (which CF targets here) already shouldn't be vulnerable.

For private phone contracts, we should kick the arses of our politicians and the regulatory agencies to finally do their job.

> but as I said, large companies (which CF targets here) already shouldn't be vulnerable.

Only if you're willing to trust the reset process. The whole point of this is to remove that trust.

Further, as noted, this doesn't just protect against that attack. It also allows for filtering at the data layer, so you can remove malicious traffic. And it also gives SIM a stronger identity, so if you're using a heuristic for identification (as you always are) it becomes a much more powerful entry.

The same attack can be mounted against your corp IT admin in charge of your Cloudflare account.

Oh, that's disappointing, I was hoping they're entering the MVNO space with a consumer offer. Instead, it's an offer for companies to further spy on their employees :(

I’m confused about what it is.

It looks like it’s Cloudfare’s MVNO eSIM. What’s zero trust about it?

> Preventing employees from visiting phishing and malware sites: DNS requests leaving the device can automatically and implicitly use Cloudflare Gateway for DNS filtering.

> Enabling secure, identity-based private connectivity to cloud services, on-premise infrastructure and even other devices (think: fleets of IoT devices) via Magic WAN. Each SIM can be strongly tied to a specific employee, and treated as an identity signal in conjunction with other device posture signals already supported by WARP.

That is a lot of text to say "trust us bro". First we gave cf decryption keys to most of https web traffic, now they want to own cellphones, for our privacy of course!

>But in recent years, nearly every modern phone shipped today has an eSIM

How many phones other than iPhone, Pixel, and (very recent) Galaxy S/Z have eSIM? There aren't that many cellular IoT boards that support swappable eSIM either (some boards say eSIM, but what they mean is that the IoT vendor's SIM is soldered onto the board - thus "embedded SIM"- not that you're allowed to load eSIM of your choice).

Is the idea with this that it'll be a data-only eSIM? I'm not seeing any mentions of phone service in the blog post (maybe it's just implied and I'm dumb). I think iOS and Android have support for multiple eSIMs where one is used for data service, so that would work, although I don't know if companies want to pay for everyone to have a data plan AND a SMS+phone plan.

Currently data only.

So, a matter of time before Cloudflare acquires https://gigs.com?

We’re not for sale ;)

And 1 year ago figma said they don’t want to be adobe.

Hey, gigs looks super neat--I couldn't find any information on the markets you're in. We operate in subsaharan Africa, so don't want to take time from your sales team if that's not a good fit, but I couldn't find anything on your notion that was publicly available.

Not sure about gigs, but airalo vends African eSIMs: https://www.airalo.com/africa-esim

Feel free to submit a request on our form and our team will get back to you ASAP on that.

This is cool. I noticed a bug on your main page. The section showing off what the ui looks like shows a blank white panel on firefox.

Is there a reason your eng. team is EU-only while your biz/ops is EU/US?

So its basically a Sim with a VPN Built in?

yeah. pretty innovative, love this kind of unconventional thinking. good “why now” as well with the iphone supporting esims first class

It is amazing that Cloudflare is going after CrowdStrike, AWS, ZScaler, Vimeo, Twilio, Netifly, Cisco, PA Networks, Tanium, Wiz all at once.

fwiw its not all sunshine and roses. have had a couple chats with recent ex employees that this has caused internal strain. nothing unexpected ofc

It sounds a lot like Enterprise Google Fi to me.

VPN in the sense that it puts you on the company LAN, yes.

VPN in the sense that it's private and secure, no - the carrier has full access to the traffic.

(that's not a dig at Cloudflare, it is a shortcoming of the mobile protocols - the network has to have access to the traffic by design)

Every one of these product launches makes me think Cloudflare is the CryptoAG of our time. There's an immense amount of centralization happening under this company under the guise of "security".

I honestly don't particularly get BYOD. The savings on the company side seem so marginal for a lot more uncertainty, more support issues and worse employee mental health etc.

Employees don't want to carry two devices.

I would rather carry two devices than allow an employer to use my hardware without compensation. Ideally they would furnish their own data plan, too.

This also permits leaving the work device at work where it belongs.

That’s the idea: the employer pays for the data you use to do your job.

The interesting thing about using personal devices for work is personal liability. Have you ever considered what happens if your company is embroiled in some sort of litigation, regulatory investigation, or suspected criminal activity, and undergoes discovery of evidence? If law enforcement or counsel suspects that you or your devices are harboring relevant data, then your devices could be seized, imaged, held as evidence, and possibly never returned to you, certainly not in one piece.

So if you're mingling your personal data along with any sort of company data, or data that belongs to an organization that's outside your family unit, and said data is physically inseparable, then prepare to lose big in the future. You'll kiss all your backups goodbye, no matter where they're stored or how you've encrypted them.

Of course this may also apply if you've got a company-provided device (COPE) or one running MDM, and it's stolen or lost. When you report back to the company that their data's in the wind, they're going to remote-wipe and remote-brick that device, so again, kiss your personal data bye-bye.

Best practice going forward is to purchase separate devices (especially mass storage) for each individual purpose and meticulously separate out company data from personal stuff.

It never pays to mingle business with pleasure, or business with personal, and I think this liability issue is something that's a well-kept secret by companies who wish to encourage workers to BYOD and downplay the repercussions, although rare, that could put those workers into a world of hurt.

Thing is, until they've seized and inspected it, they can't tell whether my device contains relevant data or not. I'm not confident that keeping separate devices will protect me from the exigencies of discovery.

Of course nobody with a court order on your doorstep is going to take your word for anything. If the object of the order is to find some data, anything and everything that looks vaguely digital will be taken (consequentially, every physical nook and cranny will be searched for errant micro-SD cards). Stuff is handled on a per-item basis. An item is either returned (after months to years), or not.

If you end up in a situation like that - which does not mean you did anything wrong at all - your best bet at getting your personal data and items back is by 1.) having them physically separate 2.) not encrypting anything or immediately providing passwords / access so items can be cleared.

Effects and results may vary. Consult your local lawyer for more information.

> Have you ever considered what happens if your company is embroiled in some sort of litigation, regulatory investigation, or suspected criminal activity, and undergoes discovery of evidence? If law enforcement o

Very few people in real world experience this. I have some friends that do programming jobs who just ask for cellphone with at least 100 GB data as condition for employment. Companies do not care. These are not SRE that need 24 hours access but employees fell valued by these.

>You'll kiss all your backups goodbye, no matter where they're stored or how you've encrypted them.

How?

Then leave them on your desk.

I've got 2 devices, and the only downside has been needing to charge more often. Reasons I like it:

- Can keep the device for work in a secure place, never have to look for it

- Can call my personal phone when I have look for that :)

- Separate address books

- Do whatever I like with my personal phone, no worries about it affecting business

- Easy to "turn off" work

+ leaving your work phone behind is liberating + its pretty hard to run out battery on two phones in one day

If BYOD gets really good companies don't have to buy or maintain phones or laptops for employees.

I can see why it would be tempting.

All I want is to know when and where my next meeting is, without going back to my desk.

If I accept a company phone, I have to let everyone in the company have the number, and they might start calling me.

And it'll probably be some shitty $50 Android phone - a company phone isn't some huge perk or status symbol, like it might have been in 1995.

It'd be tempting to just type the password in on my personal phone.

https://silent.link/ is the real 0 trust SIM:

"Anonymous eSIM

Get global mobile 4G/5G Internet access and burner phone numbers instantly and privately on any modern eSIM-compatible smartphone.

    Pay as you go international roaming in 200+ countries
    Worldwide coverage at low prices

pay with bitcoin or lightning"

I'm just a user. I use it at times. It works well and prices are ok.

> By integrating Cloudflare's security capabilities at the SIM-level, teams can better secure their fleets of mobile devices, especially in a world where BYOD is the norm and no longer the exception.

Please consider not doing BYOD for company business.

Quick summary of IMHO, from some companies where I've defined or advised on infosec policy...

From the employer side, BYOD is bad for security and liability. From the employee side, BYOD is bad for privacy&security.

Regarding employee's personal info on BYOD (since it's less familiar concern than company protecting IP and operations)... Whether or not there's MDM, it's a big problem for employee and company, when security team needs to investigate an incident, or when legal proceedings mandate that forensics expert clone/search a device, and that bumps into personal info. (Personal info revealed can include private personal conversations, intimate photos/videos of employee and partners, job searching, medical information, non-public sex/gender/etc. identity, protected classes for discrimination, Web history, etc., to possibly the company or some outsiders.) Also a big problem if the company needs to wipe or lock a device to secure IP, and that would wipe personal data or lock employee out of it.

No work on personal devices. No personal on work devices. Being strict about this from the start is to everyone's benefit (before complicating practices set in, the wrong services are bought/deployed, etc.).

For employees who actually need to carry smartphones for business (e.g., executives, marketing, sales, other non-engineers), the company should issue devices with plans, to be used exclusively for business.

For work calls for people who don't get issued company smartphones, use a service from the work laptop.

For rare alerting eng/ops/etc. in the off-hours, when they don't have a company-issued smartphone, alerting can be to a personal device, but the alert should convey no info other than what is the urgency to get to the company laptop.

Also possible side life balance benefit of strict work and personal separation on devices, especially with WFH/hybrid and carrying a laptop home: without work on personal devices, an employee can just physically put the work device(s) in a drawer/bag for the evening, and call work over for the day, or until they're ready to take it out. (No associating their personal devices with work, no interrupting with work off-hours while people recharging and with family, no trying to use unreliable software settings correctly to suppress work messages at some times and not others, etc.)

Unfortunately, I guess, it won't available in the most part of the of the world at a competitive price to local operator.

I had hopes this product would be way less draconian. People miss the real reason you should push back on eSIM-only devices! It seems that most of HN hasn't done their DD on how eSIM provisioning dosen't work unless you're a billion dollar telco incumbant..... The eSIM-only precedent telco tech giants are pushing towards is part of the time honored tradition of locking consumers out of their own hardware. Indeed, this is another version of "the carrier owns the hardware you've purchased".

TL;DR in order to provision an eSIM to live inside the eUICC (secure element inside phone); as per GSMA standards your eSIM HAS to have a key signed by a SOLE CA determined by the GSMA and the incumbent billion dollar telco industry cartel!!! With a SIM-card you have the freedom to connect to any network you want including those that aren't inside the realm of:

"Only eUICC manufacturers, and SM-SR and SM-DP hosting organisations that have successfully been accredited by the GSMA SAS can apply for the necessary certificates from the GSMA Certificate Issuer to participate in the GSMA approved ecosystem."

Please push back on this draconian nonsense as a whole people!!!

eSIM Whitepaper: https://www.gsma.com/esim/wp-content/uploads/2018/06/eSIM-Wh...

Should we reject TLS certificates for the same reason then? If they aren't trusted by the "TLS cartel" then your users are told that the site is "not secure" and shouldn't be trusted. Many browsers will even completely block you from accessing pages without valid trust roots.

I can add a CA to every modern OS with a few clicks and a password can't I? Furthermore, in a browser it's usually 2 clicks away from getting to a site with an expired TLS cert...Why can't I do similar with a eUICC in a device I paid for and own? Hint: control.

Furthermore "reject TLS certificates" implies rejecting a useful security mechanism as a whole...eSIM provides no further security mechanism to a [p]SIM as far as LTE/5G security goes... ie. MILENAGE etc. The only added security of an eSIM is that it adds security to big telcos subscriber revenue and makes them sticky as providers. It's a big telco cartel and if you ain't in it you're dependent on them at the very least.

How are they the first? MobileIron and others have been offering solutions for at least 2.5 years now.

random fun cloudflare related thing I learned last week, their "private dns" address is "one.one.one.one" which is even easier to remember than "dns.google" (there is also "dns.adguard.com" and "dns.quad9.net")

Wow, TIL ...I had heard of the ip address 1.1.1.1 (and yes, for dns), but never knew about the spelled-out website: https://one.one.one.one/

wait till clouflare decides to ban a website from their network and you suddenly cannot access them unless YOU CHANGE YOUR SIM PROVIDER, that sounds fun

Wait until they block your SIM for posting wrongthink. Now you cannot access any website on your phone!

A bit like any ISP then. You have to change ISP or use a VPN to access the pirate bay if you are on the Shell Energy ISP in the UK.

I am NOT using a sim from Cloudflare

I think the term "zero trust" creates a bit of confusion, in this and other contexts -- not Cloudflare's fault, because the term has been used/abused quite a bit. I think it's a good idea to prevent SIM swapping attacks, and it looks like this will, like Efani does.

TLDR: this will lock a corporate SIM to a device and then connect the device to the perimeterless corporate network.

> then connect the device to the perimeterless corporate network

With the huge caveat that the carrier can still see all the traffic and reissue the "trusted" eSIM to a different device and take over this data connection.

Even for basic https request, would you need certificates ?

They want to be in front of every website, behind every DNS request and now they want to control your cellphone traffic - while bleeding money by tens of millions of dollars a year and making promises they don't intent to keep. The trajectory of this company's life is obvious in advance.

Seeing as how Cloudflare can cancel and censor you at will and has done to others recently, you'd have to be crazy to trust them with your phone and sim.

Wow, eSIMs hit first in this discussion? Not the glaring nightmare of security QR codes are. I thought about providing links but there's such a vast host of writeups about it I'll leave it for the reader to search and discover. Yikes.

Reply on news.ycombinator.com