• 1 Post
  • 11 Comments
Joined 1 year ago
cake
Cake day: June 25th, 2023

help-circle

  • Seems like a huge headache with stolen/lost phones, wonder how they handle revokation…

    Right maybe should have clarified that. The authentication is facilitated by the trusted middle party aka phone company.

    When you log in using this service, you tell using service your phone number. Well their contacted authentication handler (usually one of the phone operators), they forward the request to your operator, who knows to forward it to the phone (as I understand as a network service SMS, like how operators settings updates also get send to the SIM and phone), this service message is handed by the phone cellular interface to the SIM. SIM applet notices “oh this is authentication request”. It displays the session ID of authentication (generated at the original authentication session and displayed there also) and then asks to enter security code to approve (or decline the request)

    As such revocation is two fold. First your operator will list the certificate/key invalid. Secondly, since operator is handling the message passing anyway, they know to refuse to send the authentication requests in the first place to the compromised SIM. since as the SIM, that also defines where to send the requests. It is both the independent crypto validation, but also the cell network subscriber identity. Compromised sim stops getting any requests, since it is shutout from cellular connection. Can’t make calls, can’t send and receive texts, since the sim isn’t anymore tied to valid subscriber contact.

    Plus with crypto system there is always the option of official public revocation server. Which kind of system is what the national ID smart card system uses. Anyone accepting identifying by those signatures gets told “the official key/certificate/revocation server is this one. Regularly check it for listed revocations by the root trust authority”


  • i don’t agree that it keeps users locked in. convenience wise it should be alot easier with e-SIM, technically you should just be able to open up an app and install a new e-SIM and voila your on a new provider.

    As long as the phone maker and the phone service company play nice. The whole point of physical sims is. “you break your phone screen and phone? You can literally in the minute borrow your buddy’s phone, slap your sim in it”.

    Why would it matter? For example here in Finland we have this thing called The Mobile ID. Which is commercial high security identification method, that works on the SIM. It’s user interface is the phone, but the actually crypto and logging works on the SIM. Just as with PIN number, the phone is just keypad to tell the SIM the security code to unlock it and operate. Not only does it work on SIM, due to security it is tied to the SIM. Each ID is a cryptographic key living physically in the SIM. never to leave it. public-private key exchange between the authentication server and SIM. on first boot/activation, SIM generates in-situ the private key, sends the public key to phone company, normal registrations hand shakes. Only thing anyone else has is the publickey. they private key lives it’s live in the SIM and just on getting signatory request and then correct unlock PIN signs the request and sends it back.

    Which again means in the “oh my phone broke” situation means I haven’t lost my mobile ID. Just yank the SIM out of the husk of the broken flagship expensive smart phone and slap it into the cheapest 30 euro “I make calls and send text” budget phone. Still works just as well. Any phone you find (that isn’t SIM locked) will work, since as said the ID is the SIM, the phone is just keypad interface.

    Also physical external sim allows physical update of the crypto processor. with eSim, if there is hardware fault or vulnerability found with the eSim, you are toast. With physical sim? So sorry customer, there has been vulnerability wound with the Sim crypto. Do you come to visit nearest operator store to get your new sim for your phone or do you want it sent by mail. Specially on say long lasting equipment… It is a very good thing there is a physically exchangeable cryptographic component. Rest of the equipment isn’t toast, just because someone cracked the SIM crypto.


  • I really don’t think they should be dictating how companies must design their products.

    Like say telling to automakers they must include this design feature called seat belt and this another design feature called airbag? Also EU isn’t dictating anything about the design. They are giving regulation on minimum technical features. How to design within that minimal technical requirement is free for the maker to decide. Just as say there is minimum technical regulation about safety of electric appliances in general.

    Again poor, poor companies being told by the regulation they can’t use their favourite “design feature” of "exposed uninsulated power wirings " on their products.

    Regulations have existed and will exist. Companies operate at the please of society offering them a market to operate in. Offering such things as contracts needing to be honored, people not just being allowed to steal their property, enjoying the protected relative piece of national military keeping the mongol horde away and so on. In exchange the businesses shall play by the rules society sets.

    This matter was decided by the duly elected representatives of the EU citizenry (directly as the European Parliament and more indirectly the national democratically elected governments in the Council. Well except maybe governments of Hungary and Poland… … …). This is the will of the European society, so this stands.



  • It would have to be personal imports. Since the regulation concerns not just the manufacturer, but Any natural or legal person that places on the market product (that phrasing appears lot on the regulation 😆). So for example importers and distributors. A retail electronics shop is responsible to make sure they don’t offer on sale any new product with no replaceable battery. Obviously to their own amount of reasonable amount of responsibility. Retailer isn’t responsible to go check the product in detail for all the nitty gritty technical compliance, but they have to do due diligence from the manufacturer or importer on “and this product you offer us does fulfil EU regulations. You do have the spare batteries in offer like regulation demands, you plan to honor the 5 year offer period of spare batteries” and so on. Can’t be knowingly importing or retail selling non compliant products.


  • Well some sneaky legislative aide in EU already thought about that.

    Any natural or legal person that places on the market products incorporating portable batteries or LMT batteries shall ensure that those batteries are available as spare parts of the equipment that they power for a minimum of five years after placing the last unit of the equipment model on the market, with a reasonable and non-discriminatory price for independent professionals and end-users.

    Software shall not be used to impede the replacement of a portable battery or LMT battery, or of their key components, with another compatible battery or key components.


  • Well battery shapes will be custom, but the regulation does include demand to offer said batteries as spare parts.

    shall ensure that those batteries are available as spare parts of the equipment that they power for a minimum of five years after placing the last unit of the equipment model on the market, with a reasonable and non-discriminatory price for independent professionals and end-users.

    This being EU, EU will actually even police that reasonability clause via consumer protection agencies. You might not like the still probably pretty hefty price, but outright monopoly price gouging will not be allowed. Atleast not with in EU jurisdiction. Also makers will tend to gravitate to number of pretty standard battery sizes and geometries. Simply out of economies of scale. If you have to offer the batteries available as spares. You don’t want to offer 150 different battery models on you warehousing and supply to your retail stores. You want as few as possible. Maybe say 5 different sizes or maybe couple ten different kinds on the biggest makers with the largest product range. Cheaper to buy more of similar batteries from battery supplier, than have custom module developed for each new phone model. Well unless one is apple and only has couple new models per year. They probably will have now just little bit different optimized shape battery for each models, but they also have the scale per model to make sense for that.

    also:

    Software shall not be used to impede the replacement of a portable battery or LMT battery, or of their key components, with another compatible battery or key components.

    Meaning companies can’t use software locks to deny third party batteries. Since the language says compatible battery, not replacement battery. Which wouldn’t make sense anyway, since replacement battery would be the one the OEM offers. Ofcourse I’m sure there will be lot of hurdur by makers over “don’t use third party batteries, those aren’t as safe” and “well but that isn’t compatible”. However as one remembers during the early 2000’s and upto mid 2010’s there was a very healthy both OEM and third party replacement battery market. As with that experience, yes shoddy batteries from non-reputable people can be problem. However in this basic consumer electronic safety regulation (aka you can’t just shovel anything to the market with utterly nuts unsafe circuitry in the first place) and the market itself handles it. Again it will be found out over little time, which makers are the reputable ones with the good batteries with all the proper safeties and good production quality. Reputable big chain electronics dealers then focus on only offering the established reputable third party batteries and parts out of their own reputation (You sold me a shoddy battery. It burst and ruined my phone. I’m never buying from this phone store ever again). Plus same with the actual makers with stuff like offering extensive warranties, warranting the replacement of the device, if their battery messes it up and so on.

    This is all “we have already been here” ground except instead of the T9 numpad on the phone front, there is now a whole front covering touch screen on it’s place.


  • Not really. Expect in that obviously many of the exact current water resistant phone design can’t be used. Since those don’t have replaceable battery. However already at this very moment there is smart phones on the market with both replaceable battery and water resistance. Like Samsung Xcover6 pro . Not that it is the only one, but example from the major brands instead of the more niche rugged phone specialist brands. In fact in my experience in the rugged phone market replaceable battery is quite common (and thus apparently desired by customers) feature. I assume on the rugged phone user segment liking the ruggedness of “I can continue the lifespan with new battery” and even “Well I’m going to middle of no where wilderness, spare battery might not be stupid idea”.

    In opposite to the hurdurhurdur can’t make water and dust resistant phone with battery covers. Yes we can. We figured this out by early 2000’s. Touch screens on the other side of the phone taking place from the old numeric T9 pad doesn’t change the design fundamentals of the back of the chassis. Rigid enough cover plate with rigid enough pressure applying latching combined with rubber seal designed and molded to seal the desired areas will do the job exactly 2027 as well as those did in 2002.

    As said all it takes is a redesign job with the battery swapping idea being kept in mind from start on the chassis design. Maybe it means couple mill thicker phones, since the phone isn’t a single glued together slab from front display glass to the back cover glass, so it isn’t rigid by being single monolith resign block essentially. However as far as the massively bulky thick rugged phones, all phones aren’t headed there. That is about impact resistance instead of water or dust resistance. Thick layers of metal and rubber both to withstand and to soften impact.


  • Yeah. Hearing about to whole feinstein thing, that is pretty disqusting levels of political machining. Since anymore it isn’t even about Feinstein. Since as i understand it, she is way too out of it to even be considered for whether she retires herself or not. She is not of sound enough mind and body. Looking at couple previous interviews, she was way out of it. Like for example not remembering she had been absent for months. Insisting she had been voting all the time and so on. Which could be her lying, but more likely literally she has dementia son bad, that last thing she remembers clearly enough is “I was at senate voting, like I have been for decades” and missing the whole “you have been on deaths door for couple months and absent from Congress”. Her short term memory is shot and so on.

    What she can blamed for is for not retiring way before this already, when her health started to go down in the first place. Then she was of sound mind, could have seen what was coming and retired in peace.