Ask HN: Why are SIM cards still a thing?

[glennos]

Using SIM cards in mobile phones seems antiquated. Should there not be a software solution that lets you select which network/s the phone should connect to?

Feels like this is probably the result of telco networks wanting as much friction as possible to change providers, but is there something more to it?

[JoachimSchipper]

The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the network has someone to bill.

In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa.

For what it's worth, you really don't want to have every network provider negotiate with Samsung for the particular access policy of that network. "Not compatible with your telephone" indeed!

[userbinator]

The SIM card is a smart card

If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top.

Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.

[Strom]

In Estonia, you can use your SIM to create a government recognizeed digital signature. [1] Thus, you not only identify yourself to the mobile operator, but you can also identify yourself to banks, government services, and more.

[1] https://e-estonia.com/component/mobile-id/

[RyJones]

Here is a great video[0] with an exploration of using SIMs for a (very) micro telco, including a discussion of the APIs available

[0] https://www.youtube.com/watch?v=_-nxemBCcmU

[mherrmann]

Doesn't every login form on the web also protect the respective operator from the subscriber? Why can't a "software SIM" simply be a username and a password?

My explanation is that it's difficult to change something that literally the entire world uses.

[RandyRanderson]

Even small carriers have software customizations done to phone firmware deployed on their network. This is common.

I believe he's contrasting this between a built-in solution. So say Samsung would put a hardwired UICC (SIM) in the phone and ATT say would make Samsung give ATT an "area" (Security Domain" in UICC parlance) to provision. For all intents and purposes it would work the same. If you wantd to switch carriers I'm guessing there would be a 'virtual' switch SIM app or some such.

If you're bored, you can read about it here:

https://www.globalplatform.org

[uola]

Yeah, while I can appreciate the question (curiosity is a good things) I don't think anyone with experience of software should be surprised. When you consider things like passwords, credit cards, wifi login and e-mail addresses the question is really why aren't more things like sim cards. (which is kind of what Apple is trying to do these days?)

[glennos]

I hadn't thought about the security of being a physical token. Feels like you could do 2FA using someone's email (or similar) to protect against some scenarios, but take the point that someone having to steal something physical changes the attack surface.

[agumonkey]

I recently read the Wikipedia pages for health cards, and was surprised that these are demi-computers (by that I mean, no IO, no power). Standard chips are 4MHz >8bits these days (with added crypto etc). A Gameboy Air.

[arsmoriendi]

I'd love to study a piece of software like M-Pesa.

[vidarh]

On the contrary, it is the result of a concerted effort to reduce friction.

With SIM cards, users can switch to a new phone by just moving the SIM, or switch to a new provider while keeping their phone (assuming its unlocked) by just replacing the SIM.

Prior to SIM cards phones where frequently programmed to be tied to a specific provider.

A pure software solution could work, but requires the network operators to be able to trust the phone manufacturers to secure it well enough to not let end users change things in ways they're not supposed to (e.g. consider a hacker harvesting authentication details from phones). The SIM card is the simple solution.

[glennos]

I take the point on the security of physical + pin for protection. I guess I'd just love a solution where I could simply switch between accounts without physically swapping something or having a multi-SIM phone.

[RandyRanderson]

Unless you personally know some heads of some major carriers you can't say that and also it's unlikely carriers do things to reduce friction.

Unlocked phones are still relatively rare in the US so I don't agree with your second point either.

Network operators trust Gemalto, etc to write the SIM card software and also the provisioning and tower software. They also trust the phone manufacturer software as they rigorously test it before it's pushed to it's subs. That's actually why updates take so long (excl apple, of course).

Note that I have actually worked for some major carriers and have been in discussions with VPs discussing this very issue. See my other answer further down the thread.

[kalleboo]

The actual reason it's still a thing is because changing how thousands of network operators work in over 200 countries is quite difficult to coordinate. Even Apple tried to push a soft-SIM and couldn't get it going.

But I'm glad for it, because the foresight of the designers of GSM to put your private key in a smartcard has absolutely improved consumer choice worldwide. I can buy an unlocked phone, travel to any country, buy a SIM card at the airport and pop it in my phone and the GSM(/UMTS/LTE) standards say it must work.

A software-based system will quickly devolve into a "oh we haven't approved this phone on our network, sorry we won't activate it" and other anti-consumer activities you saw on the ESN-registration-based US CDMA networks.

Hopefully when the GSMA adds eSIM to the standard, they add protections for consumer choice, but in the current corporate climate I fear they won't.

[vinay427]

Samsung succeeded with its eSIM implementation on the Gear S2 smartwatch, which works on a limited number of mobile operators.

http://www.theverge.com/2016/2/18/11044624/esim-wearable-sma...

[RandyRanderson]

The phone can theoretically work but the network operator can still ban your phone, even if it has a valid SIM, by manufacturer, software version, baseband version or a host of other reasons.

[wyldfire]

IMO the fact that the device subsidy is so popular with both consumers and network operators in the US means that all of this ostensibly anti-consumer stuff will be with us for a while. The (hard) SIM cards don't even offer the desired portability if you have to go beg for the device to be unlocked.

[jacquesm]

SIM: Subscriber Identity Module almost says it all, on top of that a SIM can store your contacts (up to a certain number).

The SIM is what separates your identity from the hardware of the phone (which has its own identity called 'IMEI').

A 'software solution' would need a carrier, that carrier IS the SIM.

Another nice benefit of having the SIM device is that it makes it much harder to 'clone' a subscriber ID, something that would regularly happen in the days before the SIM card, note that the SIM was a development that came along with GSM, and that GSM was the first mobile phone standard resistant against cloning. It's one part of the 2FA (something that you have) that gives you access to the phone network (the other being the PIN code (something that you know) required to unlock the SIM).

[djhworld]

> on top of that a SIM can store your contacts (up to a certain number).

This presented a usability nightmare back in the days of feature phones, where if you didn't specifically say where to store contacts, it would often default to the phone's storage rather than SIM, or if you breached the number of contacts on a SIM you'd have overspill onto the phone memory (sometimes without realising)

This presented a lot of unnecessary confusion when it came to upgrading devices, or if you damaged your phone.

[RandyRanderson]

When ppl mention a "software SIM" they mean the same basic chip embedded in the handset that you can switch with software. It has the same level of security as removable chips.

[rblatz]

I don't recall ever needing a PIN to unlock a SIM card.

[aq3cn]

You know if that happen then flip phone users will have hard time because network will promote only high end selective phones. SIM card gives you freedom of putting it in $25 or $640 phone and it works just fine. People with security, budget and privacy concern go for flip phones. Just like net neutrality, phone neutrality is a good thing. One should never be forced to purchase smart phone if he does not want it. A dumb phone just works fine for calling and text messaging. I have never used internet on my phone and I will never be excited about it (3G 4G, 5G or anything). I carry my laptop everywhere I go and it serves my need well.

I must add you can find flip phones cheaper than cost of lightening cables.

[uph]

> People with security, budget and privacy concern go for flip phones.

No. That ensures you can't send encrypted messages or do encrypted calls.

Also see one of the reasons Signal moved to sending encrypted messages as data and stopped supporting encrypted messages sent as sms.

> SMS and MMS are a security disaster. They leak all possible metadata 100% of the time to thousands of cellular carriers worldwide. It's common to think of SMS/MMS as being "offline" or "peer to peer," but the truth is that SMS/MMS messages are still processed by servers--the servers are just controlled by the telcos. We don't want the state-run telcos in Saudi, Iran, Bahrain, Belarus, China, Egypt, Cuba, USA, etc... to have direct access to the metadata of TextSecure users in those countries or anywhere else.

https://whispersystems.org/blog/goodbye-encrypted-sms/

[bizzleDawg]

'eSIM' is on the way to replace sim cards. The biggest challenge of 'downloading a sim card' to a secure enclave on a phone is of course security.

The GSMA and members (i.e. telcos) have been working on secure remote provisioning. I think it'll take a while for the technology to make it in to consumer devices, though it's likely to be used in IoT relatively soon.

It takes a long time to spec these things up collaboratively and then even longer for telco's to act on it!

See: http://www.gsma.com/rsp/2016/04/27/esim-opportunity-operator... and http://www.gsma.com/rsp/ (Warning: Lots of marketing BS)

[i336_]

A form of this has existed for a while but never caught on for fairly understandable reasons.

Quite a few years ago (2005?) a family member purchased a Samsung-branded dumbphone on a contract. (Monochrome LCD (something like 128x64?), polyphonic ringtones, 3 fixed games, a (really slow, GSM data) WAP browser; that was it. Model SGH-something, I vaguely recall.)

It had no SIM card slot. It was locked to the network (Orange - in Australia FWIW) via software. In order to unlock it we had to call up the telco and go through some process, which we decided not to do in the end (whatever it was, I don't recall), since the phone had less capabilities than the Nokias that flood India and similar places, so we concluded there was no point selling it by the time we dug it out one day and tried to figure out what to do with it. (It's still buried in a box somewhere IIRC.)

I think this is why SIM-less phones are reasonably rare - it's really, really hard to de-contract them, unlock them and put them into sellable (or whatever) condition. Then once you've done that the recipient has to go through some equally arcane process to get the thing linked to a plan/contract too. And considering the ability to pass a phone on is a fairly major selling point - phones aren't solely purchased [preconfigured] on plans, then disposed - I think this was explored somewhat by the industry but ultimately left alone.

Some of the other things I've found in this thread are really interesting, although I wonder how difficult it is to "unconfigure" such a device to sell or pass it on.

[mianos]

For some perspective, check electronupdate's recent 'decapping': http://electronupdate.blogspot.com.au/2016/10/decap-of-cell-... It is not just a little block of secure RAM labelled a 'smartcard'. It contains as much CPU as a low end phone. Amazing.

[kalleboo]

And it runs Java!

[ex3ndr]

Because they handle private keys that is soldered to chip and can't be retrieved at all. Before sim cards there was something in the phones that can be easily reprogrammed and you always have to walk to your carrier office to "program" your phone. Swapping of sim cards is much easier.

[dismantlethesun]

> Feels like this is probably the result of telco networks wanting as much friction as possible to change providers, but is there something more to it?

In 3rd world countries, people regularly swithch their SIMs as they travel across borders because no one has cross-country access. Taking a SIM out only uses up a minute of your time, and standizing on a hardwardware dongle like that is great because if company A goes out of business, you just grab a new SIM and stick it in.

It's a bit harder in the US, where phones are locked to their providers, and you need IDs to buy SIMs but that's really all just a regulation issue, not a technical one.

[mrb]

There are many poor design decisions in the cellphone infrastructure, but the SIM card is probably one of its best pieces.

Broken phone? Pop the SIM card into another phone, and you can immediately make and receive calls & texts on the new phone using your phone number.

If you had no SIM card, how would you authenticate yourself to the cell network (that's what the SIM card does)? Going online and then providing a username/password? This would be horrible security-wise as we all know people are terrible at picking secure unique passwords. So hackers could try to guess your password, then they would use your account, receives your calls & texts, and they could steal your cell data, causing you to receive large cellphone bills, etc. A total nightmare.

[raverbashing]

> Feels like this is probably the result of telco networks wanting as much friction as possible to change providers

No, it is the opposite.

It is exactly done like this so you only need to get the sim card and not need to have the operator decide for you (of course people shoot themselves in the foot by signing a long term contract while getting a locked mobile phone)

[kalleboo]

I imagine one of the main reasons it was done like this was because when the GSM standard was designed, a non-insignificant number of phones were fixed mounted into cars (due to the sheer bulk), and then being able to bring your smartcard with you in your wallet and swap between phones (cars) would be a very handy feature.

[TorKlingberg]

I work in the industry. I somewhat agree with you, SIM cards are a hassle, and I hope they will go away at least partially.

As for why you still need them, I see some reasons:

1. The alternative may be worse. At least with SIM cards you can switch operator when you want (if the phone is not carrier locked, bleh), or use a local prepaid SIM when abroad.

2. Inertia. Removing the physical SIM would require getting operators and phone manufacturers to coordinate.

3. The IM card is what securely identifies the owner of a phone number, and makes sure they are not two phones with the same number. With a software SIM, if it is done wrong, you risk getting malware that steals your phone number.

Personally, I think we will eventually see SIM-free data only connections without a phone number. You really should be able to buy an LTE tablet, get online and just pay for some data. Apples has been trying a bit with the Apple SIM, but it is US only, and only works with a few operators.

[Razengan]

It says Apple SIM works in over 100 countries:

http://www.apple.com/ipad/apple-sim/

[matheweis]

Personally I really appreciate the fact that providers have SIMs. Verizon (major network in the USA) used to NOT have SIMs, and it was a huge pain to change phones out. Now it's as simple as swapping out the SIM.

I hear you that it should be doable in software, although I'd argue that if anything you should still need the SIM as a sort of second factor. (Otherwise you run the risk of people stealing your phone account remotely).

[fernandotakai]

same! whenever i travel, i can get a sim card on that country and use my phone like i was using before.

without that, i would have to either buy a local phone or deal with how expensive my carrier makes to use internet outside my own country.

[jlgaddis]

As others have pointed out, SIM cards are basically smart cards. There's PKI, private keys, the ability to perform mutual authentication (although that's not usually done, at least in .us), and much more.

Honestly, I wish their use would expand into other areas of our lives -- replacing username and password combinations for various devices (working for an ISP, home routers are one good example).

As much as I'm against the idea of a mandatory "national ID", I'm convinced that it will happen someday (in .us, where I live). When it does, I believe it'll be something similar to US DoD's CAC [1]: a physical identification card that doubles as a smart card. The private keys stored on the card will allow you to prove your identity to your banks/financial institutions, e-mail account (100% encryption of all e-mails? Yes, please!), and so on.

[1]: https://en.wikipedia.org/wiki/Common_Access_Card

[pmontra]

My 5 yo phone eventually died at the beginning of October. I put the SIM in my tablet and I kept going until I received the new one two days later. A pure software solution would have worked as well, but the SIM is an authentication token. 2FA are all the rage nowadays and if we went pure software I bet we'll have to use a separate token anyway.

[atamyrat]

SIM card provides hardware-based, simple and secure authentication of subscribers to mobile network operators. Until manufacturers start to embed standardized secure element on all phones, alternative software based solutions (password, etc.) are more complicated and insecure.

[smileysteve]

> Using SIM cards in mobile phones seems antiquated.

In the U.S., LTE is the first time that CDMA phones have had sim cards, that's ~2 years ago.

The software solution (using IMEI and PUK) is the old technology. It's less secure; verizon and sprint will charge you ~$40 activation fees, etc.

[informatimago]

The software equivalent would be a TEE (Trusted Execution Environment), but it relies on hardware support. Only a few arm processors and a few Android phone support this option. Apple has its secure enclave, but you cannot download trusted application in it, only Apple can do that.

A 100% purely software solution can be built based on white box encryption. It's slower and may be more easily attacked than a hardware protection (you never know if/when some genius mathematician or physician (quantum cryptographic attacks) breaks your encryption. But it has the advantage that it can run on all devices. cf. eg. https://www.trustonic.com/solutions/trustonic-hybrid-protect...

Then of course, there's the problem of key management and distribution thru software. Using a physical token has several good security properties. Replicating them in software (encryption) is difficult and error-prone. For end users, and service provides, it's much easier to swap a SIM card, than to install securely cryptographic keys and authentication tokens into his trusted execution environment even with the help of well written software.

[bogomipz]

I think they are still a thing because of the following:

1) One SIMs are a bit harder to tamper with than the OS of a phone which I am assuming would be the alternative to a SIM card i.e storing the same information on NAND flash accessible to the OS. SIMs have some threshold(it used to be 3) of unsuccessful attempts to read the card. A lock is activated and can only be unlocked entering the unlock code.

2) Carriers can talk directly to the SIM - A "SIM" is basically a Java applet that runs on UICC(Universal Integrated Circuit Card - the smart card itself.) I think a lot of people don't know that SIMs run Java - well Java Card. This mean that they can remotely lock a SIM card to prevent it from further accessing their network. If someone stole my phone or even just my SIM card I could call my carrier and they could lock the SIM remotely and consequently unlock it. They can also use the SIM to push new PRLs - preferred roaming lists. This is generally called OTA or over the air provisioning.

3)Convenience, if I use a pre-paid services with an MVNO or travel to another country and buy a pre-paid SIM while on holiday, I don't need to do anything else except insert the new SIM and power on the phone. What would the non-SIM card alternative look like? Its hard to imagine it being easier.

4)Carrier-locked phones, such as what you get when you are under contract to a carrier. The way phones are locked is by having the phone only accept SIMs from the carriers network. An unlocked phone will accept a SIM from any carriers network.

If anyone is interested this DEFCON presentation - "The Secret Life of SIM Cards", is pretty interesting:

https://www.defcon.org/images/defcon-21/dc-21-presentations/...