Hacker News Reader

Comment by frantathefranta | Hacker News Reader

Using the account of probably one of the few trustworthy people in crypto probably helps.

Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login.

If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication.

I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it.

Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.

The API could return different identifiers per app

While it's also signing things for you? That seems rather hard to implement.

It's what FIDO/U2F does, right?

That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.

Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.

> Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.

I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.

> Using the account of probably one of the few trustworthy people in crypto probably helps.

The fact that some person is trustworthy by his personality traits does not imply that he does have the (also technological) skills not to become scammed or impersonated.

Reply on news.ycombinator.com