4 ms·

Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can act

Ironically, every SIM card is a cryptographic secure element, and it would've been ideal to do public key login. If you plug SIM card into desktop, you can actually do signing with it, and TLS authentication. I recall, only Nokia S60 series, and A200 had a SIM card API exposed to apps. Ios does not give you access to SIM, Android does only for system apps.

londons_explore 3y ago
Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.
- skdk 3y ago
  The API could return different identifiers per app
  - eli 3y ago
    While it's also signing things for you? That seems rather hard to implement.
    - wiml 3y ago
      It's what FIDO/U2F does, right?
  - slashdev 3y ago
    That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.
    - londons_explore 3y ago
      Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.
      - aleph_minus_one 3y ago
        > Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example. I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.
- lawlessone 3y ago
  My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it. Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.

londons_explore 3y ago

Giving apps access to the sim is a privacy leak. Every app would use it to get a unique user identifier and track you between apps.

skdk 3y ago
The API could return different identifiers per app
- eli 3y ago
  While it's also signing things for you? That seems rather hard to implement.
  - wiml 3y ago
    It's what FIDO/U2F does, right?
- slashdev 3y ago
  That’s meaningless if you can also use it to compute a signature. Just use the signature of a constant string as the id.
  - londons_explore 3y ago
    Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example.
    - aleph_minus_one 3y ago
      > Android could append the unique app identifier (ie. "com.myapp") to the end of any data to be signed. Then the user can't be tracked between apps. But it also prevents you using 'sim sign in' to sign in to the same service from a web browser and app for example. I doubt that: simply add two "SIM identities" (which on the mobile phone map to the same SIM card) to the account of the respective service.
lawlessone 3y ago
My redmi has a sim card toolkit app, i've never used it . Reading this i am now more suspicious of it. Before you all warn me i know it is the worst possible brand to own, i am getting spied on by all the regulars that come with Android - Google/ US agencies but i also get the added bonus of China spying on the device. But i was broke.