Hacker News Reader

Comment by londons_explore | Hacker News Reader

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

View on HN

My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it.

Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.

The API could return different identifiers per app

While it's also signing things for you? That seems rather hard to implement.

It's what FIDO/U2F does, right?

That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.

Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.

> Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.

I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.

Reply on news.ycombinator.com