If you have a credit/debit card with a chip, look at the arrangement of the contacts and compare to a SIM card. It's essentially the same standard (ISO 7816) at the lower layers, but with different application-layer protocols on top.
Also, as a matter of being the only device in posession of the subscriber but arguably owned by the telco, I'd definitely prefer it to be a removable piece which communicates over a standard interface. The alternative of embedding it into the handset is far worse from the perspective of lock-in and perhaps security.
the sim card has one important difference. It lives in a device that provides it with 24/7 battery and radio access.
That is really worrisome when you think about. A tiny computer running applications you have no idea/access. powered 24/7. Always with you. With access to battery, network, mic, etc. And the other side of the network that could monitor it's traffic for malicious actions is owned by the very people that could abuse it in the first place.
I'd be far more concerned with the hundreds of microcontrollers running proprietary code.
[network] <-> [phone] <-> [SIM card]
In theory. Not sure how well practise matches this though.
Is it? When you turn on "airplane mode" on a phone, is there a reason for the SIM to still be receiving power at that point?
Easy to test: add a SIM pin, turn on airplane mode and reboot your phone.
the sim has direct access to the radio and other modules, by design. it only needs the actual phone cpu/os for use interface.
if it wants to take the radio out of silent mode it can.
I always presumed "airplane mode" was the specific set of features required by the FAA to enable the phone to do the same thing as a phone that's off, from the perspective of potential interference with a plane's communications.
If the SIM can still enable and use the radio despite "airplane mode" being on, then "airplane mode" is not really "a mode for making your phone safe to stay on while on an airplane."
try this: enable airplane mode and then open any app that has system permission to change gps or Bluetooth or wifi settings. it will enable those radio and the ui will still show the little airplane there.
In other words, SIMs seem disproportionally secure w.r.t. credit cards.
EDIT: Thank you whoever downvoted an honest question that added to the discussion
The Estonian method is described as using a private key present on the SIM card, just like a normal smart card used for authenticating/signing.
Besides, pretty much all banks simply use 2 or 3 factor authentication as an anticompetitive tactic (half the businesses in most countries pay the banks 2-300$ per month just for scheduled download of transactions)
My explanation is that it's difficult to change something that literally the entire world uses.
SIM cards are cryptographic hardware tokens. They are much more secure than passwords.
In fact, they do need a password as well on top of the hardware token, that's the 'PIN code' you have to enter when you (re)boot your phone.
I transferred my mobile phone number etc over to a new SIM card the other week and all I needed was name, address, DOB and proof of ID... of course my network didnt have any of these on file yet, so I had to first tell them these details, and then show ID to verify that I was who I had just told them that I should be. Yeah... this is the state of consumer mobile security.
None of this required physical access to the phone, I just had to login to their website, with a username and password, and change my details.
On most networks you can steal someones mobile number with just a few minutes of physical access and a bit of planning.
It means that carriers don't have to maintain "sessions" centrally. The SIM can authenticate you to the base station without the base station having to check back to see if you're logged in elsewhere - vital in reducing the latency of cell changes.
(It also stores various bits of technical information for SMS/MMS routing, and was intended to be a platform for "value added" applications.
Authentication in a telco context is a good thing, the fact that the web doesn't have it enabled a large number of applications to flourish, it also made some other things devilishly hard, or even almost impossible.
Its helpful to understand the history of mobile/wireless I think since the Telecom industry takes acronyms to an insane level. The terminology changes slightly depending on which generation of mobile is being discussed. This is a good breakdown of the evolution of mobile networks. I think its a good starting point:
http://www1.i2r.a-star.edu.sg/~wongtc/EE5406-Network-Archite...
This is a good resource for understanding more recent and relevant mobile architecture. This has a lot more detail:
http://www.slideshare.net/abhishekshringi/gsm-architecture-1...
If you really want to learn mobile and wireless networking, this is unbeatable and very thorough, I highly recommend it, grab a used copy.
https://www.amazon.com/Wireless-Communications-Andreas-F-Mol...
If you just want the 10K view see:
Only on home network, everybody who knows your IMSI and have low level access to phone network can clone your identity in roaming.
The alternatives are worse in usability AND security.
If you don't want your account to be hacked: yes.
(and Even if you did, it would need to be backward-compatible and still support SIM cards)
There is a good deal more to telecoms tech than just the tech side - the standardisation process brings a whole bunch of competitor companies into a room to develop a solution, incrementally over a number of years.
This applies from physical aspects all the way up to higher level concerns like security. It's a fascinating development process.
At the same time I totally trust my sim, it's never been more than 10 meters away from me in the last decade or two, hasn't failed me even once and it would be very hard to get it to cough up its secrets without my cooperation (so rubber hose cryptography would still work).
Contrary to www security the phone system seems - from my perspective - at least to have done a half decent job at integrating 2FA when your average website - 20 years later - is still making up its mind about whether or not that might be a useful thing to add.
What we need is a SIM-type system on the web as well, not to bring the broken web password system elsewhere.
I believe he's contrasting this between a built-in solution. So say Samsung would put a hardwired UICC (SIM) in the phone and ATT say would make Samsung give ATT an "area" (Security Domain" in UICC parlance) to provision. For all intents and purposes it would work the same. If you wantd to switch carriers I'm guessing there would be a 'virtual' switch SIM app or some such.
If you're bored, you can read about it here:
In most western countries, SIMs do little else; however, they are full application platforms, allowing stuff like Kenya's mobile payment network https://en.wikipedia.org/wiki/M-Pesa.
For what it's worth, you really don't want to have every network provider negotiate with Samsung for the particular access policy of that network. "Not compatible with your telephone" indeed!