Ask HN: Why are SIM cards still a thing?

Because they handle private keys that is soldered to chip and can't be retrieved at all. Before sim cards there was something in the phones that can be easily reprogrammed and you always have to walk to your carrier office to "program" your phone. Swapping of sim cards is much easier.

At least one can change the SIM and can un-locked phones that dan be used all around the world and I can easily swap the SIM card. Why change it, it works great as intended and all software service solutions would mean a middle man is in the game - that would suck, right? (except you eant to be the middle man)

You know if that happen then flip phone users will have hard time because network will promote only high end selective phones. SIM card gives you freedom of putting it in $25 or $640 phone and it works just fine. People with security, budget and privacy concern go for flip phones. Just like net neutrality, phone neutrality is a good thing. One should never be forced to purchase smart phone if he does not want it. A dumb phone just works fine for calling and text messaging. I have never used internet on my phone and I will never be excited about it (3G 4G, 5G or anything). I carry my laptop everywhere I go and it serves my need well.

I must add you can find flip phones cheaper than cost of lightening cables.

Yes, security and flexibility.

1) Security: telco laws these days often require registration of accounts to your personal ID (i.e. no anonymous usage any more). How would a pure soft-SIM be able to fetch the data from the network?

2) Flexibility: SIM is pretty much standardized. This means a newcomer MVNO just has to issue SIM cards and the customer can use any kind of phone (or other interface, like a modem, a 2G/3G shield, ...) to use the network. And if a device breaks, then the SIM card usually stays intact and can be placed in a new device. Not sure how to securely do this with a soft-SIM.

The SIM card is a smart card, i.e. a secure piece of hardware, that protects the telephone network from the subscriber - most importantly, it ensures that the network has someone to bill.

In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa.

For what it's worth, you really don't want to have every network provider negotiate with Samsung for the particular access policy of that network. "Not compatible with your telephone" indeed!

SIM card provides hardware-based, simple and secure authentication of subscribers to mobile network operators. Until manufacturers start to embed standardized secure element on all phones, alternative software based solutions (password, etc.) are more complicated and insecure.

If you have an iPad there is already a software solution: http://www.apple.com/ipad/apple-sim/

It contains what is known as a remote provisioning SIM: https://www.gsmaintelligence.com/research/?file=81d866ecda8b...

So clearly the only thing stopping the industry is the telcos who would very much like to make it as difficult as humanely possible for you to switch carriers. Especially in the US where there is a lot of competition and hence high churn.

There are some solutions out that are in software that are "eSIM" which allow devices to switch carriers through an OTA update.

Also see a company called SIMless.

There's a lot of market momentum around SIM cards and it keeps a telco's offering really sticky. It is more effort for people to swap hardware instead of software.

For some perspective, check electronupdate's recent 'decapping': http://electronupdate.blogspot.com.au/2016/10/decap-of-cell-... It is not just a little block of secure RAM labelled a 'smartcard'. It contains as much CPU as a low end phone. Amazing.

I think it is more of a traditional security approach of "pairing hardware with hardware" and a case of "not fixing what is not broken" instead of making consumers suffer. It just works.

Locking devices to networks (as US telcos do) makes it harder to switch providers than swapping a $5 SIM.

Same with switching devices and keeping a provider. Using a SIM, takes about a minute. Not using a SIM? Call them or whatever, maybe pay a fee.

> Feels like this is probably the result of telco networks wanting as much friction as possible to change providers, but is there something more to it?

In 3rd world countries, people regularly swithch their SIMs as they travel across borders because no one has cross-country access. Taking a SIM out only uses up a minute of your time, and standizing on a hardwardware dongle like that is great because if company A goes out of business, you just grab a new SIM and stick it in.

It's a bit harder in the US, where phones are locked to their providers, and you need IDs to buy SIMs but that's really all just a regulation issue, not a technical one.

SIM: Subscriber Identity Module almost says it all, on top of that a SIM can store your contacts (up to a certain number).

The SIM is what separates your identity from the hardware of the phone (which has its own identity called 'IMEI').

A 'software solution' would need a carrier, that carrier IS the SIM.

Another nice benefit of having the SIM device is that it makes it much harder to 'clone' a subscriber ID, something that would regularly happen in the days before the SIM card, note that the SIM was a development that came along with GSM, and that GSM was the first mobile phone standard resistant against cloning. It's one part of the 2FA (something that you have) that gives you access to the phone network (the other being the PIN code (something that you know) required to unlock the SIM).

'eSIM' is on the way to replace sim cards. The biggest challenge of 'downloading a sim card' to a secure enclave on a phone is of course security.

The GSMA and members (i.e. telcos) have been working on secure remote provisioning. I think it'll take a while for the technology to make it in to consumer devices, though it's likely to be used in IoT relatively soon.

It takes a long time to spec these things up collaboratively and then even longer for telco's to act on it!

See: http://www.gsma.com/rsp/2016/04/27/esim-opportunity-operator... and http://www.gsma.com/rsp/ (Warning: Lots of marketing BS)

On the contrary, it is the result of a concerted effort to reduce friction.

With SIM cards, users can switch to a new phone by just moving the SIM, or switch to a new provider while keeping their phone (assuming its unlocked) by just replacing the SIM.

Prior to SIM cards phones where frequently programmed to be tied to a specific provider.

A pure software solution could work, but requires the network operators to be able to trust the phone manufacturers to secure it well enough to not let end users change things in ways they're not supposed to (e.g. consider a hacker harvesting authentication details from phones). The SIM card is the simple solution.

  - http://www.androidauthority.com/best-dual-sim-android-phones-529470/

My 5 yo phone eventually died at the beginning of October. I put the SIM in my tablet and I kept going until I received the new one two days later. A pure software solution would have worked as well, but the SIM is an authentication token. 2FA are all the rage nowadays and if we went pure software I bet we'll have to use a separate token anyway.

As others have pointed out, SIM cards are basically smart cards. There's PKI, private keys, the ability to perform mutual authentication (although that's not usually done, at least in .us), and much more.

Honestly, I wish their use would expand into other areas of our lives -- replacing username and password combinations for various devices (working for an ISP, home routers are one good example).

As much as I'm against the idea of a mandatory "national ID", I'm convinced that it will happen someday (in .us, where I live). When it does, I believe it'll be something similar to US DoD's CAC [1]: a physical identification card that doubles as a smart card. The private keys stored on the card will allow you to prove your identity to your banks/financial institutions, e-mail account (100% encryption of all e-mails? Yes, please!), and so on.

[1]: https://en.wikipedia.org/wiki/Common_Access_Card

> Feels like this is probably the result of telco networks wanting as much friction as possible to change providers

No, it is the opposite.

It is exactly done like this so you only need to get the sim card and not need to have the operator decide for you (of course people shoot themselves in the foot by signing a long term contract while getting a locked mobile phone)

The SIM smartcard is a cryptographic device that prevents people from stealing/copying/hijacking/cloning other phones/accounts/billing/credit/etc.

Each SIM has a unique ID that is used to track/bill/identify your phone.

Because of a power struggle between os vendors, hardware makers and telcos. The SIM provides a neutral way for them to coexist. Also, this decouples a lot if certification. A SIM and a phone are easier to work with than a phonesim

The actual reason it's still a thing is because changing how thousands of network operators work in over 200 countries is quite difficult to coordinate. Even Apple tried to push a soft-SIM and couldn't get it going.

But I'm glad for it, because the foresight of the designers of GSM to put your private key in a smartcard has absolutely improved consumer choice worldwide. I can buy an unlocked phone, travel to any country, buy a SIM card at the airport and pop it in my phone and the GSM(/UMTS/LTE) standards say it must work.

A software-based system will quickly devolve into a "oh we haven't approved this phone on our network, sorry we won't activate it" and other anti-consumer activities you saw on the ESN-registration-based US CDMA networks.

Hopefully when the GSMA adds eSIM to the standard, they add protections for consumer choice, but in the current corporate climate I fear they won't.

Xiaomi offers a Virtual SIM for years now. [0]

[0]: http://en.miui.com/thread-146080-1-1.html

I work in the industry. I somewhat agree with you, SIM cards are a hassle, and I hope they will go away at least partially.

As for why you still need them, I see some reasons:

1. The alternative may be worse. At least with SIM cards you can switch operator when you want (if the phone is not carrier locked, bleh), or use a local prepaid SIM when abroad.

2. Inertia. Removing the physical SIM would require getting operators and phone manufacturers to coordinate.

3. The IM card is what securely identifies the owner of a phone number, and makes sure they are not two phones with the same number. With a software SIM, if it is done wrong, you risk getting malware that steals your phone number.

Personally, I think we will eventually see SIM-free data only connections without a phone number. You really should be able to buy an LTE tablet, get online and just pay for some data. Apples has been trying a bit with the Apple SIM, but it is US only, and only works with a few operators.

There is actually an eSIM (embedded sim) specification (http://youtu.be/mLouo2mYjAU) that was released quite a while ago by the GSMA and its mostly up to the device manufacturers and carriers to implement it now.

It lets you virtually subscribe to a network, so for example if you're traveling, you don't need a local card just pop up some software and choose a new network.

Apple already has some devices that implement it, AFAIK, the iPad Pros use this. Apple calls it Apple SIM (https://techcrunch.com/2016/03/23/explainer-alert-heres-what...)