Hacker News Reader

Comment by coretx | Hacker News Reader

Because it's in software, they can legally disable your phone and force you to buy a new phone every 3 year citing "security patches no longer being issued". Bye bye aftermarket firmware second life !

View on HN

What do you think would stop them from doing this to a phone using a physical SIM card? I don’t see how an eSIM makes a difference in this scenario.

Because doing that on a phone with a physical SIM does not have a plausible justification.

But with a software-based solution, they can argue that due to the lack of updates your device is now vulnerable and your SIM can be cloned, spoofed and so you should get rid of it.

With a physical SIM those hacks are not possible even if I'm on a 20 yr old dumb-phone, because all the auth logic resides in the SIM itself.

> With a physical SIM those hacks are not possible even if I'm on a 20 yr old dumb-phone, because all the auth logic resides in the SIM itself.

Not nearly all parts of authentication and encryption happen in the SIM, and older generation phones are regularly deprecated (most recently for CDMA in the US and 3G in Germany for example, but also for non-VoLTE-capable devices on some networks in the US).

>most recently for CDMA in the US and 3G in Germany for example, but also for non-VoLTE-capable devices on some networks in the US

This is quickly turning into all networks. I'm seeing a lot more people running into VoLTE issues now in dumbphone and digital wellbeing groups that are picking up old/cheap LTE capable phones to try out the lifestyle. T-Mobile was the last to fold and start whitelisting even in the MVNO space where usually we don't run into problems. There are cheap VoLTE capable phones that are available, but its become an easy way for carriers to thin out older devices from the networks.

They could be doing this already if they wanted to. I agree they shouldn't have this ability in the first place, but this doesn't change anything.

They can't do that with physical SIMs, because at least in the EU, there are regulations against that (to regulate stuff like phones and SIMs locked to each other)

I couldn't find that regulation and looking at wikipedia regulations about that are country specific:

https://en.wikipedia.org/wiki/SIM_lock#European_Union

It seems sim locking is legal, but unlocking has to be allowed after some time.

I couldn't see anything that would differentiate between a carrier lock by esim vs a sim.

By EU law, the vendor of the phone has to provide updates for N year. There is no such regulation for SIM cards. ( Provided by telco's ) This means the vendor of the phone, not the telco, can simply say "we did our N years of updates", rendering the phone useless as esim requires it in order to function. It's beyond the power of the telco, because it did not provide the esim. It's not a "SIM lock", it's far more devious.

I don't believe such a law exists on the EU level.

That could be bad, I would have never thought of that implication.

I'm not sure that would happen wouldn't most telcos be interested to allow as many users on the network as possible?

People whose devices get obsoleted by eSIM won't suddenly drop off the grid - they'll go and buy a new phone, because being on the mobile network is almost a requirement in most of the world these days.

With the above in mind, note that it just so happens that telcos sell mobile devices as well as the service. This means they'll make money on increasing device churn.

Reply on news.ycombinator.com