Caution: never use eSIM with your real phone number; always get a new phone number just for use with eSIM.
OTP does a way better job giving consumer absolutely control than the eSIM does for mobile providers. (Yeah, re-read that last sentence carefully).
Disclaimer: I do eUICC vulnerability analysis with eIM.
https://www.ericsson.com/en/blog/2023/12/simplifying-iot-inn...
eSIM has the advantage of allowing me to switch to cheaper services without paying $10 and waiting for a physical card to arrive. Is it's security crap? Well so is the security of my mobile provider's kiosk minimum-wager workers.
Reducing delays to near instantaneous is an argument, but having to pay $10 for a physical SIM sounds like a scam. Yet I've seen providers making people pay for eSIM as well so it seems they like to do this.
On my provider, physical SIM are free and available under 24h. eSIM are free as well and I haven't seen a single SIM on any local provider more expensive than 1€.
I still like the feature that I keep my number as long as I pay. With other 2FA I'm always one device failure from permanent lockout.
Namely that physical SIMs are an excellent security feature, provided carriers aren’t cavalier about managing them.
Nowadays US carriers put up a few more hurdles here and there after some highly publicized issues, but it’s still bonkers that I can ultimately just read off the ICCID of a card in my possession and get a number ported to it.
Most European carriers don’t allow you to bring your own SIM and will instead only link numbers to SIMs issued to the customer by themselves.
That in and of itself would make things safer, but, and this practice varies from carrier to carrier and country to country, often times they require in-person pickup with ID check or courier delivery with ID scan. Although there are also plenty that just send it to the address on file.
Honestly, with normal SIM cards this shouldn’t be possible, as you cannot program the keys into the card. There are some eSIM-on-SIM-cards that you could use if your phone isn’t eSIM capable. But again, would be nice to check.
You don't need to program the keys into the card, you program the card's identity/public key into the network.
What I guess you mean is, you buy an inactive SIM from Vodafone (which has Vodafone-known keys on it), and then you’re telling Vodafone to use that card.
By „bring your SIM“ I thought of something non-branded and was surprised.
Essentially that is what’s happening with eSIM, hence the need for the provisioning step that also makes transferring hard.
Coincidentally, SIM swapping is unheard of in a majority of European countries. ENISA claims about half of European telcos had zero(!) incidents in 2021. (That stat was easiest to find)
Yet again, having ported my phone number to Google Voice (GrandCentral back then), and never giving out whatever my current SIM's phone number is, pays off
Source: GV user since Grand Central days.
Everything else (including paypal, fidelity, schwab, sofi, discover, capital one, to name a handful) work fine.
The Internet is more harsh than telco backend infrastructure.
Sorry, I still don't get it. Telco's backend is a mess. It has a profusion of processes and frontend systems for customer service teams to interface with user records, which creates all sort of loopholes. Any sufficiently motivated attacker can pull a SIM swap attack, as it happens frequently, and the weak link is always a variation of: a clueless agent somewhere trying to help a poor "customer" who dropped their phone in the toilet, and needs to urgently to recover the number.
Or are you suggesting that Google's GV backend is riskier than the carriers?
Agreed.
My phone number lives at twilio and I couldn't tell you the physical phone number on my SIM card ... I have no idea what it is without looking it up.
In addition to the obvious benefits of never caring whether you lose your phone or being vulnerable to a SIM swap there are other "telco superpowers" that come along with this arrangement:
- I can text you, from my number, from the command line (curl API)
- I can lose my phone and still send and receive SMS (again, curl API)
- I can "sanitize" incoming text messages to ascii-256, block attachments, block or alert on silent SMS, etc.
- block lists for incoming voice and SMS
- CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice).
Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A:
For SMS, Google Vooice both sends to and receives from email. I have a cronjob set up to `mail` a TextNow number that needs activity every 28 days to stay alive.
>- CC incoming texts to a mailspool which allows me to browse my SMS history as if it were email (this one is particularly nice).
Oh, I like this. I tend to delete most of my SMS-via-email, and the texts are always searchable in my Google Voice account, but can definitely see the appeal of always archiving all incoming texts with my mail so that I can use `mairix` for search.
>Finally, I cannot participate in a discussion of hosted/VOIP vs. physical SIM numbers without reminding readers that a "2FA Mule" solves the problems of providers not supporting VOIP numbers for 2A:
Nice. I do use my phone's SIM (now eSIM) number when (and only when) 2FA won't take Google Voice, but if I decide that is a meaningful security flaw, your approach would work.
Speaking of telco superpowers, I don't know if Twilio lets you do this but Google Voice has always supported voice calls by browser. The only time I make or answer a phone call on my phone is when I am away from my computer. When iOS 8 appeared, I'd enjoyed the equivalent of Continuity for years.
This seems to be impractical advice with the way devices are going. Look at iPhones.
Unfortunately, quite a few security practices are sometimes "impractical". If you go purely by practicality, all computers would always trust you and do as you request — what is that if not the most practical way of interacting with a computer?
You always need to decide where to place your personal trade-off, maximize in that direction, and be honest about it to yourself. If you don't care about security to this degree, buy an iPhone. If you don't care about their known shortcomings, use face ID and/or fingerprint sensors. Or buy a different phone.
> way devices are going. Look at iPhones.
Also, FTR, almost all US people have a distorted view of iPhone market share. It's only the US where they have about half the market. It's far less in the rest of the world. That said, they still have somewhat of a "technology leader" position where everyone else feels like they have to imitate it, so… meh.
i don't understand why people say "meh" about companies copying apple, _as if it is apple's fault_. it's samsung, google, huawei, etc. making those decisions. if apple has 20-30% marketshare in most of the world, but has stronger fanbase, makes more money, and pushes tech boundaries, of course other companies will want to follow.
I'm saying meh because people copying Apple include the dumb decisions Apple makes without applying their own brain. Which in case of this specific thread is removing physical SIM slots. This is both Apple's fault for making a questionable decision as well as other companies for copying it.
> if apple has 20-30% marketshare in most of the world
Apple's global market share in 2023 was just about 20%, carried by it being 39% in the US; as such it is in fact below 20% in most of the world.