They used cool hardware to do this research: the sysmoEUICC1 (https://shop.sysmocom.de/sysmoEUICC1-eUICC-for-consumer-eSIM...) which is a physical SIM card onto which one can load an eSIM, and they put it in a SIMtrace 2 device (https://osmocom.org/projects/simtrace2/wiki) to trace the data packets to/from the eSIM profile, which is normally not easily doable as modern phones load the eSIM on a chip soldered onto the phone's motherboard. So you end up with a goofy contraption (see figure 4 on page 8) but you have full visibility into the communications to/from the eSIM profile. Fun!
> We first show how travel eSIMs often route user data through third-party
networks [---] Second, we analyze the implications of opaque provisioning
workflows, documenting how resellers can access sensitive user data [---]. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed.
So not about eSIM the technology, but the business landscape inviting opportunistic business people when the bar of entry is lowered. Table 1 is worth a read. The outrage bait about traffic being routed through China shouldn't matter too much to the common person, since we're mostly using TLS. If you're on DoH (DNS over HTTPS), you're even using it for host lookups.
> The outrage bait about traffic being routed through China shouldn't matter too much to the common person, since we're mostly using TLS.
That should matter a lot to the common person, TLS or not doesn't matter, what matters is who talks to who, and who talks when. That information alone can give you many useful insights.
It’s a bold assumption that only China is tracking this info though. Mobile operators are some of the worst at selling ‘anonymised’ data on their users
Is it not worth it to keep private data flowing through companies which we could hold to account and, perhaps later on, restrict from such practices, than flowing through a jurisdiction over which we have no control and which does not much care about our opinion?
Is it possible? The EU is finding now that it is hard to keep data from the USA, which as a jurisdiction falls as much into that category as China does.
I would argue it is not possible to ever consider the internet 'safe' because you happen to flow through country x, and not country y. Instead, we must keep working on the protocols that we use to try to reduce exposure as much as possible.
Depends. Obviously Tanzania can't do it. Neither could the EU, the tech sector's not big enough. But the US could. And you can always keep it to "geopolitical allies", or at least away from "geopolitical enemies".
> I would argue it is not possible to ever consider the internet 'safe' because you happen to flow through country x, and not country y. Instead, we must keep working on the protocols that we use to try to reduce exposure as much as possible.
Firstly, there are only three ways that I know of to keep metadata (not content, which can simply be encrypted) away from the people that route your packets.
1) Onion routing (Tor). This cannot be used for general purpose multimedia usage because of slow speeds (any slow middle node can make it slow, and the higher you speed you require your nodes to bee, the fewer nodes you have, lowering the security of your network)
2) VPNs. This obviously pushes the problem of trust back to the VPN company. Which is fine, it only needs to be more trustworthy than the ISP. But jurisdiction is a very important topic here, which only makes my point more so.
3) Put everything on one of a few global CDNs. That way, all network traffic is just encrypted requests to Google, Cloudflare, Amazon and Azure servers. This obviously has the problem that the CDN company now know what you're doing.
Unfortunately, the EU doesn't seem interested in private protocols.
It might not matter hugely to most people, that's true, but as someone who's used eSIMs while abroad in both Australia and Canada earlier this year (from Airalo and Nomad - they seemed at the time to be fairly well regarded), I was surprised to see my traffic routed through Hong Kong in both cases.
Google and Duck Duck Go both on the phone assumed I was in Hong Kong when searching, even though I was in Sydney and Vancouver respectively, which did make searching for local places a tiny bit more frustrating.
When the selected here its are using the worst lowest bar providers that are reseller of lowest cost network with the absolute lowest quality, In this case roaming probably Three HK and Plus Poland are the "norm"
These are some of the most "slop" provider, which is mostly ads and affiliate links unfortunately. It's same reputation as nordvpn whereas the best you could say is it's well known
What matters very much in practice is the latency. It's fine if you just need a little bit of connectivity to occasionally send a message or be able to find something on Google Maps, but just browsing the web can be painfully slow with some of the providers.
Because there are a lot of situations, like being in a hotel, where you simply can't do anything to avoid it and have live with it / work around it.
And while we all would like to live in that perfect ivory tower of CIA-level security, we mostly live in the real world and have to make do with what we have.
The solution is to detect it happening, and then switch to a different 'mode' where you ignore all https certs but never send any private data and never trust any data received.
Often the wifi will not let you "out" until you've been through their landing page, and there's no other mechanism to do this other than hijacking DNS?
Ideally it’d actually be RFC 8910 detection (and subsequently RFC 8908 API) but standards usage is generally incompatible with giving POs something to do
Which cost me a fortune once when I plugged my phone into laptop to charge (before free global roaming). Dropbox had been blocked for a week, suddenly a flurry of sms arrived (out of order). I’d spent £250 in 3 minutes.
I feel for you. Why would you allow laptop traffic to be routed through the phone though? At least in iOS plugging the phone for charging or backup does not automatically tether.
I’m a little confused, are you physically located in China or is your data getting routed through China despite you live somewhere else? I can’t figure out what’s being said here.
> So not about eSIM the technology, but the business landscape inviting opportunistic business people when the bar of entry is lowered.
When the bar of entry is lowered, than that makes it easier for providers who offer privacy to enter the market. So that people who care about this sort of thing can choose them.
Nothing. If you want perfect secrecy, you gotta use one-time pads with a one-time MAC, which is not really practical. Think having to buy disposable SD cards with 1 TB of randomness on them from your ISP, making your data cap very literal.
Even then, you'd be relying on the randomness source being good, which is not trivial. What if the ISP colludes, how would you ever know?
The most secure way to communicate is to not communicate at all, as always. Or to be more specific, to at least not involve an intermediary if you can choose so. Short of that, all that remains is the unproven hardness assumptions.
I'm actually surprised that steganography isn't talked about more yet. Tor and Monero are conrete examples of systems that work as long as they have enough traffic. But being able to overlay Tor on normal traffic would be really annoying for those trying to listen.
TLS exposes hostnames in plaintext via SNI. If using TLS version below 1.3 hostnames contained in the server certificate are in plaintext, too. ECH still "experimental", not in widespread use, no delivery deadline.
In theory encryption is something that protects the "common person", but SillyCon Valley's version of encryption, "TLS", is, unfortunately, mostly used for data exfiltration by third party intermediaries, so-called "tech" companies, i.e., opportunistic "business people".
Rather than protecting the "common person", the _primary_ use of "TLS"
is to faciltate violation of the "common person's" privacy for profit, and to protect the third party intermediary's privacy intrusions from detection by the "common person", by making it difficult for the "common person" to monitor the outgoing traffic from their computers.
The privacy risk created by this third-party controlled encryption ("TLS") is why corporations must perform "TLS inspection". They have to decrypt TLS connections and then re-encrypt them in order to monitor the outgoing traffic from their networks. But the opportunistic "business people" in SillyCon Valley know the "common person" will not do TLS inspection.
But that's not all. Further third parties, more opportunistic "business people" called "certificate authorities" play a disproportionate role in brokering TLS connections, deciding on behalf of the "common person" who is trustworthy and who is not. This largely relies on "ICANN DNS", another laughable SillyCon Valley implementation, and is thus severely flawed, but that is another topic.
SillyCon Valley's so-called "tech" companies utilise this third party "CA system" to make it difficult for the "common person" to exercise control over deciding who they want to trust or distrust, e.g., by frustrating the use of so-called "self-signed certificates" by the "common person". Meanshile, the SillyCon Valley companies ensure that _by default_ the SillyCon Valley companies' certificates are trusted. In some cases, the certificates (or their digital fingerprints) are hardcoded into software used by the "common person".
Despite what the average "tech" worker would like the "common person" to believe, "TLS" is not synonymous with "encryption". Nor is criticism of TLS necessarily criticism of encryption. TLS is only a lame, user-hostile implementation of encryption that the "common person" must suffer while so-called "tech" companies use it to protect their surreptitious data collection from the "common person".
I will keep using SIM as long as it is possible, not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones, some really like to take their cut every time that eSIM gets moved, for something free of charge and doable under a few seconds with a regular SIM.
I've bought a 9esim, which is a physical SIM you can download eSIMs to. It's the best of both worlds for me, and I can move my data eSIM between phones, routers, and car.
No, since eSIMs are basically just programmable SIMs literally soldered onto the motherboard, I imagine it works with all providers that support eSIMs.
Thanks, that makes sense. I’m curious how this works when it comes to the sim management in the phone. For example on iOS, one SIM and one eSIM have independent on/off switches. If you have one SIM but it contains multiple eSIMs inside of it, I wonder if iOS displays only one SIM or multiple eSIMs.
Ahh I see makes sense. So it’s not entirely a replacement if you wish to utilise the feature of having multiple eSIMs enabled at the same time. Thank you for the details.
I don't think you can do that with any phone, though. Given that the eSIM is a programmable SIM soldered onto the motherboard, you can always only have one connection active on it at a time.
> You can have two eSIMs active at the same time on supported iPhone models. For example, you can use one eSIM for your home phone number and another eSIM for the place you're visiting.
That would make sense, but it does indicate that 9eSIM isn’t a 100% replacement. If you wish to use multiple eSIMs at the same time, you will need to stick with the phones feature, instead of 9eSIM.
Not really true. I definitely failed to get one of these cards working with a provider. Some providers insist on only allowing device models they're familiar with, based on the IMEI/EID/etc.
And that's a major flaw of eSIM. Providers shouldn't even have been given that kind of discrimination capability.
With a physical SIM, I can pry my card out of one phone and put it into another, and expect it to work. With eSIM, every single eSIM has to be carrier approved and GSMA approved, and every single transfer from one eSIM to another has to be carrier approved too.
That's bad enough, but my biggest beef isn't even the need for carrier approval per se, but the fact that even when the carrier would intend to approve it, it still requires (a) an additional hurdle, (b) often a separate internet connection, and (c) an unbounded amount of wasted time to make it happen.
eSIM seems like a gradual return to the device-locked model that was IS-95/CDMA in the 90s and early 2000s, where it contrasted with the openness of GSM.
> not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones
Are you outside the US? I've used eSIM on iOS many times with a number of carriers and MVNOs and never noticed a fee (unless you're talking about a postpaid carrier's line activation fee, usually around $36, not related to esim or not)
An eSIM only phone could have a bigger battery, if the manufacturer replaces the sim tray with a larger battery. That’s what Apple has done in the iPhone 17 series released last week. The US versions are eSIM only, and have better battery life.
The iPhone 17 in the UK still has the SIM tray, something I'm glad about. Knowing I can pull the SIM and slot it into my old iPhone 8 where there is no eSim support is valuable to me.
And how about knowing that it takes a minute to swap a physical sim and there is no server to take its sweet time and at worst not respond like for eSIM?
Say you arrive somewhere where your regular provider doesn't have signal so you get a prepaid sim from the one provider that does have signal. How do you install it if it's an eSIM? You don't have connectivity on your regular.
> Say you arrive somewhere where your regular provider doesn't have signal so you get a prepaid sim from the one provider that does have signal. How do you install it if it's an eSIM?
One, you can plan ahead. Two, most of those spots have Wi-fi for this purpose.
There are legitimate reasons to prefer a physical SIM. This isn't one.
I'm not saying your scenario is unrealistic. I'm just saying it's avoidable. I'll generally buy an eSim, if I need it, before taking off for my destination. In the cases where I forgot and was somewhere I couldn't get it, the SIM vendor let me hotspot to activate.
Only time I’ve used an eSIM was a potential problem with roaming on our corporate deal (was supped to be free roaming but they stop said $1.80 a meg) when I landed in New York. I was connecting before we’d finished taxiing.
I have no idea where to get a local sim from, but it would mean I wouldn’t have my normal phone number (unless I had a phone with two physical sims - very rare), and presumably would have had to find a shop at 3 am body clock time and 10pm local time. Maybe there was one post customs, I don’t know as I was autopiloting to the taxi.
Bouygues France still charged a 10€ fee as of September 2024. Didn't need to move it to another phone though, so I don't know how that works.
That 10 € fee is exactly the cost they would have charged for a physical SIM, shipping included.
Bouygues was one of the companies lamenting the change. They viewed it as a "loss of connection with their customers", whatever that means. I haven't set foot in a phone store in I don't even remember how long, but at least 10 years, so I have no idea what the hell they're talking about.
I agree. Thankfully in my country (Australia) eSIMs are handled pretty well, no charges for updates/changes and can be done without interacting with a customer service rep. You can also switch back from eSIM to a new physical SIM (say if preparing to travel).
This is a place where I really think Apple, Google, etc could throw their weight around for good.
If Apple just said to carriers: "You can't sell any iPhone's unless eSIM activations, changes, and updates are free for everyone, and take less than one hour." I think many would follow suit.
The iPhone transfer process actually tries to transfer the eSIM automatically, but it seems to require the carrier to support it.
I suspect Apple is still in the process of forcing every carrier to just support eSIM in the first place, before trying to push making it work well. The second part might end up being implemented through law though.
I think carriers always need to be pushed via law. Australia mandated carriers to support number portability (including transfer time-frames) in 2001-ish. It suddenly became so easy to shop around, keeping your number was super easy.
Some started charging 'port out' fees, but that was squashed too.
eSIM provisioning needs wifi. Which means that eSIM transfer can be blocked at any of the bajillion internet levels. eSIM is backwards technology at DRM'ing our devices and the access service
Yeah plus you can take out the physical SIM to (mostly?) guarantee your cellular service won't be utilized by the phone. I mean, barring some hidden back-door eSIM, I guess.
At least in Europe and the US, you can call emergengy numbers (112, 911) without any SIM card installed. So your phone can certainly connect to the cellular network without a SIM.
To piggyback, the SIM card is only needed for identify/authentication/billing. Your phone is already in contact with all the towers nearby. Emergency calls, by law in the US, go out to the strongest towers in reach, get tagged high priority, any bypass any authentication/billing.
Wtf! Why do I need to find this out via HN? I live in Germany and all info I've ever seen says you can always call 112 in Europe with any phone you have on hand, active subscription or not, and worldwide potentially a different number but that it's part of the GSM standard that it lets you call via any carrier because your emergency call is treated differently, always gets accepted and routed with priority
Also considering you're required to authenticate to the government before being allowed to have a mobile phone number in Germany, some people might choose to mainly use their device on WiFis and with downloaded maps and other data. It's not like mobile data is that reliable in Germany anyway. That'd be an unpleasant surprise if you are subsequently denied emergency services in the life-threatening situations that 112 is for
I didn't believe you, or that it was possibly a temporary thing, but I checked and it seems to be true since 2009 with no news since. I'm curious to try it (if there were a test number like 117 and 119 in Belgium¹) because I'm still a bit in disbelief, or to know if it e.g. works with a data-only SIM, or if an expired SIM works (if it ran out yesterday and you haven't had time to fix it or charge up the prepaid card), or if you forgot the SIM PIN due to stress (happened to me once when the phone needed a reboot, so I spent my trip abroad without mobile service until I got home and could reset it). Is it that easy to change the IMEI of a device, that pranksters abuse the service with it constantly if not blocked outright? Why isn't this a thing in other countries? I have so many questions
What a backwater this is in terms of communications infrastructure
I bought an iPhone 16e which I am about to sell, not only because of iOS 26 (horrific looking and battery drain), but I did not know they switched to only eSIMs. I have a flip phone which I like to use when I have no need for a smart phone. Now there is no way for me to switch. Plus, I know when I take out my SIM there is no way any one is tracking my phone.
eSIMs just another way these companies are trying to control, and as you said, profit, off of their customers.
I see this as taking ownership away from the customer as well. I no longer own the SIM in essence.
Thanks to Wireguard and basically 0% battery overhead on Android I always keep it activated. If you don't have a Wireguard endpoint just use Orbot to route it through Tor.
Did that several times using cheap eSIMs while traveling.
Never had a single problem with it (but increased latency because of weird routings around the world).
What I meant was, I don't subscribe to a public VPN service, so routing all my traffic through my wireguard tunnel back home would merely mean it went through a different ISP.
I already use SDNS with Nextguard, and all traffic is https encrypted, and my day to day business on the internet is probably rather boring to the majority of people. Not saying I have nothing to hide, everybody does, but my visits to various news outlets, social media and other sites is probably not all that interesting.
The most interesting data about you comes from your phones constant reporting of cell towers, which can be used to triangulate you, and put a timestamp on where you were, when.
> Never had a single problem with it (but increased latency because of weird routings around the world).
UDP (which WireGuard uses to encapsulate your data) traffic is often de-prioritized. You won't notice it when the network load is low, but it will seriously degrade experience during high load periods.
Wouldn't deprioritizing interfere with regular web traffic these days, given that close to one third of non-bot traffic reported by Cloudflare is over UDP with HTTP/3[0]?
Recently I was looking for solution to have multiple VPN running at the same time, and without work profile I am limited to one. I want to run two (or more) and be able to tell which app uses no VPN, which routes through vpn1, which routes through vpn1, etc. so far it looks like I need multiple profiles, and that requires root, which Google actively discourages.
The fact that Chinese domestic cell users can only use phones sold in China on eSim, and as soon as they leave China the eSims no longer work, gives me pause that there is some nascent security hole in them.
Why would they take such extreme measures if there wasn’t some issue with the security?
Incorrect. Chinese mobile carriers only issue eSIM to their approved models, which are devices sold in China. Once the eSIM is activated, users can roaming with their Chinese phone number to any country just like a physical SIM card.
Also, iPhone and iPad sold in China can install and activate an eSIM from foreign carriers when the device is not located in China. They only banned activating foreign eSIM within China.
I activated a Thai SIM (True) inside of Europe before traveling no problem, so it's not a technical limitation. I think brands like Saily that specifically target travelers are also activated beforehand, so when you arrive you immediately have data.
True, both networks I have in Europe don't allow it. It's one of the reasons I don't like eSIM, there are a lot more restrictions than with real SIMs. With those I can simply pull one of my cards out of my phone and put it in my tablet or 4G modem for an hour while travelling. With eSIM I have to unregister it and get a new QR every time, registering it doesn't work abroad, and they can deny activation based on the device.
> Is that even a ban? I didn’t think eSIM activation typically roams — I thought it only worked on home networks.
While I was in the US, I swapped iPhones and successfully activated both NTT docomo and Au (KDDI) eSIMs while roaming. It definitely works when you're out of home network.
Thanks, It seems I misunderstood the restrictions when they were first introduced. The purpose appears to be preserving the Great Firewall by preventing Chinese citizens from easily bypassing it with a foreign eSIM. Unlike a physical SIM, which must be imported and activated abroad, a foreign eSIM could be downloaded directly onto a domestic phone, making circumvention much simpler. By restricting eSIM activation, authorities effectively require someone to import a separate device, such as an iPhone purchased overseas, and keep it alongside their domestic phone if they want to activate and use a foreign eSIM within China. I had first read about these restrictions when the iPhone Air was announced but not yet released, and at the time the rules were not clearly explained, which led to my initial misunderstanding. Thanks so much!
I did come across non-English article that all-eSIM policy is destroying grey market imports into primarily China and also into Russia. Previously one could easily flip iPhone at or above MSRP to milk carrier subsidies, but those flippers aren't taking iPhone 16/17 as it's harder for the clientele in totalitarian and/or sanctioned countries to use it.
I'm not sure if it's an undisclosed security hole or a backdoor, but there does seem like the eSIM push has something to do with China.
It could be simply IMEI tracking. Turkey also has it. Without being registered in the country registry, the modem just stops getting answers from cell towers.
It is interesting, my EU iPhone can use Chinese eSims unrestricted in Mainland (via trip.com), advertised as HK/Macao/Mainland travel eSims. As other have said, iPhones for the Chinese market can not. So the phone smuggling is still big business. Also, there is a quota on the amount of sims given out each month, but dont er quote me on that (at least that was the case with physical HK/Mainland sims sold in HK Shamshuipo etc).
This is a weird title and IMO should have included "international resellers" to emphasise the risks are sourced from there, not really due to the eSIMs themselves. Those online-only, travel-oriented resellers, are incorporated or using providers from unregulated or less regulated markets.
If you use an eSIM provided by your own domestic carrier, which I do and many of my friends, especially when having more than one phone number, almost none of the risks in the paper are applicable.
Install phone company app, login, and click migrate eSIM to this phone. Whole process can take up to 5min depending on how fast wifi is to connect to your phone company.
I don't install the samsung dishwasher app or the mcdonalds value points app or the Mountain Dew summer of fun app ... why would I install some random national carrier telco app ?
The flip-side to that is what if your phone had been stolen or lost? You're out of luck with a physical SIM, but eSIM could be transferred to a new device.
When my wife’s German T-Mobile eSIM vanished during transfer to a new phone, their portal for downloading a new one required a token sent to that very phone number we just lost access to.
This meant we had to do a trip to their store where they said that there’s no process for the store to supply us with an eSIM, but they’ll setup a new traditional SIM which we could then convert to eSIM. Ridiculous! At least it was all free - apart from the time spent.
That was a few years ago, though. So, I very much hope they’ve improved on the process.
How do they know it's you, what makes you able to download the subscription token onto your device but not me? Do you need to receive a letter, or email via WiFi somewhere? Do mobile carriers accept unauthenticated devices to let them download SIMs, or does it require WiFi always?
You scan the QR code and then download. Sometimes there is like a code you have to enter. It's a prepaid SIM, the carriers--particularly in East Asia or Africa--aren't particularly concerned with authenticating that much.
Calling it "eSIM" is BS marketing. Every time I've used them it's been painful. I don't know the details but it absolutely is not "SIM technology". "eSIM" is something completely different.
A regular SIM: you just pop a SIM card into your phone and it just God damn works.
But eSIMs? I've used eSIMs from five carriers in three different countries and every time there is some issue:
* "Oh you need our god awful app to install an eSIM" (of course I couldn't easily download it because Google play geo hides apps).
* "If your phone is stolen overseas you can simply use this QR barcode again to register an eSIM to a new phone" (I couldn't).
* "Works with all phones". (It didn't because phone manufacturers have to bake Telco specific data into your phones firmware. Not supported? You're shit out of luck).
I could go on..
The fact that there are now privacy and security issues is not surprisingly at all. This isn't teetching issues. The drafters of the eSIM standard should be publicly flogged.
It's an emulated sim card, it really does emulate that weird little Java processor and everything. It's totally "SIM technology" in that sense, even if it's not conventient because of the restrictions of the emulation device.
Well, a regular SIM mostly just works, except for when it doesn't.
I haven't had any APN issues with regular SIMs in a while actually, but it used to be a common problem that would only sometimes auto-configure correctly. I've definitely had to google carrier APN settings and fiddle with them for a while to get text, MMS, and internet access working properly.
I also recently had an issue where I moved my US MVNO provider SIM to a new phone and it mostly worked, except for RCS. When I called them, they claimed my phone model wasn't compatible with their network, despite me already using it on their network for months. Apparently in their opinion SIMs should never actually be moved to a different phone. They offered to sell me a new phone, but I switched to a new carrier instead.
I've also had APN issues with physical SIMs, they are definitely not perfect. But I have never had an unusable "bricked" physical SIM. My eSIMs gripes are from being unable to use the eSIM at all. It's essentially a brick at that point.
RCS is a whole another kettle of fish indeed and the fact it only works with Play Integrity being on Device/Strong and the bootloader being locked is absolutely asinine to me.
> This has fueled a global marketplace of online eSIM resellers [54], operating across borders with minimal regulatory oversight. These services are typically marketed through web stores and mobile apps, with providers operating across borders and often facing minimal regulatory oversight.
But this is exactly the situation we have with VPNs. VPNs have proven themselves to be a useful tool for censorship circumvention, and foreign eSIMs are thus an interesting alternative suitable for this purpose, especially if traditional VPNs are blocked by the state.
The paper is somewhat title-bait: most of the data flow and privacy concerns (section 3) isn't caused by eSIM but by MVNO and business practices which applies to physical SIM as well. Additionally, it's expecting too much from _travel_ SIM cards (physical or embedded) where the primary consumer concern is cost.
The telco is probably from Hong Kong, and using home-routed roaming, that is subscribers access the visited network through the home PDN gateway (H-PGW). When I roam with mine my IP is always from my home country. There is nothing insidious happening.
I read some of the article and stil not sure what is so unique about eSIM compared to physical SIMs. Is routing user traffic through third-party infrastructure unique to eSIM?
The other risks mentioned are mostly rare edge cases
Removing the need to ship a physical SIM card created an entirely new ecosystem.
There is very little difference between a physical SIM from provider X and an eSIM from provider X (except that one requires an available physical slot and the other is a pain to move between devices), but eSIM allowed many new provider and reseller business models.
In practice, this means much more choice, much lower prices, but often also lower quality because everything is optimized to be as cheap as possible and often involves roaming agreements where your traffic gets sent on high-latency world tours.
* Provision of Services The Services to Customer will be provided by our Technology Partner - TP Global Operations Limited, a limited liability company incorporated and registered in England and Wales with company number 14109189 whose registered office is at 109 Farringdon Road, Farringdon, London, EC1R 3BW, UK (“1GLOBAL”). *
They have a lot of obnoxious advertising which makes me not trust them.
I've used Airalo without much hassle, but I can't say that they're any better. I did have an incident where the phone I was using broke, and I was unpleasantly surprised to find that I couldn't just load the eSIM onto the replacement phone, seems like you only get one shot at downloading it.
(Dragonpass is pretty good though, I recommend getting that through a credit card or whatever if you spend a lot of time habging around airports.)
I had to edit and take out my reasoning for asking (I said why I liked it), as it seemed like I was shilling the service, which I wasn't intending to do.
Thank you for the insights!
Registered address:
The Valley - Beethovenstraat 505 North tower, Level 6. Amsterdam 1083HK, Netherlands
So we're at 3 levels of indirection on ownership already.
In practice, 1 Global is the trading name of TP Global because it's the successor company to 'Truphone':
> In 2022 the Company was selected in a competitive bidding process, conducted by a UK court appointed administrator
of Truphone Limited (“Truphone”), to acquire all the business and assets of Truphone (the “Acquisition”).
And this company was an investment option for Russian oligarchs:
> In December 2024, German Manager Magazin revealed that Russian oligarchs Abramovich, Abramov and Frolov, who had previously owned 96% of Truphone and invested more than €360 million in the company, could still benefit from any success achieved by 1Global.
Yeah but on the bright side, Google's total lack of customer service means nobody will ever be able to talk a minimum wage clerk in the middle of nowhere into transferring your phone number to somebody else without your permission.
> This paper presents an empirical investigation of how eSIM adoption affects user privacy, focusing on routing transparency, reseller access, and profile control. We first show how travel eSIMs often route user data through third-party networks, including Chinese infrastructure, regardless of user location. This raises concerns about jurisdictional exposure. Second, we analyze the implications of opaque provisioning workflows, documenting how resellers can access sensitive user data, proactively communicate with devices, and assign public IPs without user awareness. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed.
They used cool hardware to do this research: the sysmoEUICC1 (https://shop.sysmocom.de/sysmoEUICC1-eUICC-for-consumer-eSIM...) which is a physical SIM card onto which one can load an eSIM, and they put it in a SIMtrace 2 device (https://osmocom.org/projects/simtrace2/wiki) to trace the data packets to/from the eSIM profile, which is normally not easily doable as modern phones load the eSIM on a chip soldered onto the phone's motherboard. So you end up with a goofy contraption (see figure 4 on page 8) but you have full visibility into the communications to/from the eSIM profile. Fun!
> We first show how travel eSIMs often route user data through third-party networks [---] Second, we analyze the implications of opaque provisioning workflows, documenting how resellers can access sensitive user data [---]. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed.
So not about eSIM the technology, but the business landscape inviting opportunistic business people when the bar of entry is lowered. Table 1 is worth a read. The outrage bait about traffic being routed through China shouldn't matter too much to the common person, since we're mostly using TLS. If you're on DoH (DNS over HTTPS), you're even using it for host lookups.
> The outrage bait about traffic being routed through China shouldn't matter too much to the common person, since we're mostly using TLS.
That should matter a lot to the common person, TLS or not doesn't matter, what matters is who talks to who, and who talks when. That information alone can give you many useful insights.
It’s a bold assumption that only China is tracking this info though. Mobile operators are some of the worst at selling ‘anonymised’ data on their users
Is it not worth it to keep private data flowing through companies which we could hold to account and, perhaps later on, restrict from such practices, than flowing through a jurisdiction over which we have no control and which does not much care about our opinion?
Is it possible? The EU is finding now that it is hard to keep data from the USA, which as a jurisdiction falls as much into that category as China does.
I would argue it is not possible to ever consider the internet 'safe' because you happen to flow through country x, and not country y. Instead, we must keep working on the protocols that we use to try to reduce exposure as much as possible.
Depends. Obviously Tanzania can't do it. Neither could the EU, the tech sector's not big enough. But the US could. And you can always keep it to "geopolitical allies", or at least away from "geopolitical enemies".
> I would argue it is not possible to ever consider the internet 'safe' because you happen to flow through country x, and not country y. Instead, we must keep working on the protocols that we use to try to reduce exposure as much as possible.
Firstly, there are only three ways that I know of to keep metadata (not content, which can simply be encrypted) away from the people that route your packets.
1) Onion routing (Tor). This cannot be used for general purpose multimedia usage because of slow speeds (any slow middle node can make it slow, and the higher you speed you require your nodes to bee, the fewer nodes you have, lowering the security of your network)
2) VPNs. This obviously pushes the problem of trust back to the VPN company. Which is fine, it only needs to be more trustworthy than the ISP. But jurisdiction is a very important topic here, which only makes my point more so.
3) Put everything on one of a few global CDNs. That way, all network traffic is just encrypted requests to Google, Cloudflare, Amazon and Azure servers. This obviously has the problem that the CDN company now know what you're doing.
Unfortunately, the EU doesn't seem interested in private protocols.
https://www.europarl.europa.eu/doceo/document/E-10-2025-0032...
> Neither could the EU, the tech sector's not big enough.
Sorry? You're aware of the fact that the EU tech sector has several parties that could do this by themselves if they felt the need to do so?
> It’s a bold assumption that only China is tracking this info though
It's not an assumption? Nowhere in the above thread is that an assumption made, neither do any of the relevant points rest on such an assumption.
Like saying 'It should not matter too much to the common person if most of their shit makes it into the toilet.'
It might not matter hugely to most people, that's true, but as someone who's used eSIMs while abroad in both Australia and Canada earlier this year (from Airalo and Nomad - they seemed at the time to be fairly well regarded), I was surprised to see my traffic routed through Hong Kong in both cases.
Google and Duck Duck Go both on the phone assumed I was in Hong Kong when searching, even though I was in Sydney and Vancouver respectively, which did make searching for local places a tiny bit more frustrating.
When the selected here its are using the worst lowest bar providers that are reseller of lowest cost network with the absolute lowest quality, In this case roaming probably Three HK and Plus Poland are the "norm"
These are some of the most "slop" provider, which is mostly ads and affiliate links unfortunately. It's same reputation as nordvpn whereas the best you could say is it's well known
What matters very much in practice is the latency. It's fine if you just need a little bit of connectivity to occasionally send a message or be able to find something on Google Maps, but just browsing the web can be painfully slow with some of the providers.
1/ ISP or the website Youre accessing can see the DNS queries and block traffic. My eSIM routes through Hong Kong, which means no ChatGPT.
2/ iPhones don't get you set the DNS provider / DoH for cellular
3/ DoH breaks wifi redirect walls, making it tedious to enable/disable. Like you cant just enable DoH for certain apps or disable it for others.
2) I believe you can using profiles like those available here[0].
[0]: https://github.com/paulmillr/encrypted-dns
> 3/ DoH breaks wifi redirect walls, making it tedious to enable/disable
Since this is a security focused discussion, why do you see wifi hijacking your dns lookups as something desirable?
Because there are a lot of situations, like being in a hotel, where you simply can't do anything to avoid it and have live with it / work around it.
And while we all would like to live in that perfect ivory tower of CIA-level security, we mostly live in the real world and have to make do with what we have.
wifi hijacking is here to stay.
The solution is to detect it happening, and then switch to a different 'mode' where you ignore all https certs but never send any private data and never trust any data received.
You have use a client side app firewall to prevent all traffic until you have acquired your session.
This is extremely difficult to do even for skilled people.
Android has the ability to isolate the network stacks for different apps/connections till you have cleared the wifi portal.
Often the wifi will not let you "out" until you've been through their landing page, and there's no other mechanism to do this other than hijacking DNS?
> DoH breaks wifi redirect walls
Is that really true? I would have thought all the automatic detection features try with unencrypted DNS? They should anyway.
Ideally it’d actually be RFC 8910 detection (and subsequently RFC 8908 API) but standards usage is generally incompatible with giving POs something to do
Just get a VPN and then you can route your traffic wherever you want and not have to worry about what the carrier is doing.
vpn appears to only work sporadically in china.
All VPNs work without problems with China if you roaming into their network with a foreign (e)SIM.
You will get unfiltered western internet as a tourist.
Which cost me a fortune once when I plugged my phone into laptop to charge (before free global roaming). Dropbox had been blocked for a week, suddenly a flurry of sms arrived (out of order). I’d spent £250 in 3 minutes.
I feel for you. Why would you allow laptop traffic to be routed through the phone though? At least in iOS plugging the phone for charging or backup does not automatically tether.
I often tether off my phone so has tethering enabled, just hasn’t charged from the laptop in all that time
Wasn’t a lot in the end scheme of things - less that the cost of a night in the hotel, let alone the full trip
> Dropbox had been blocked for a week
Why was it blocked for a week? Not sure I understand what happened to you.
China blocked it.
[dead]
iCloud Private Relay fixes all three i think :)
[dead]
I’m a little confused, are you physically located in China or is your data getting routed through China despite you live somewhere else? I can’t figure out what’s being said here.
> So not about eSIM the technology, but the business landscape inviting opportunistic business people when the bar of entry is lowered.
When the bar of entry is lowered, than that makes it easier for providers who offer privacy to enter the market. So that people who care about this sort of thing can choose them.
What if TLS won't be relevant in a few years to a decade? Bad actors can hoard encrypted traffic and have the data decrypted when the time comes?
Nothing. If you want perfect secrecy, you gotta use one-time pads with a one-time MAC, which is not really practical. Think having to buy disposable SD cards with 1 TB of randomness on them from your ISP, making your data cap very literal.
Even then, you'd be relying on the randomness source being good, which is not trivial. What if the ISP colludes, how would you ever know?
The most secure way to communicate is to not communicate at all, as always. Or to be more specific, to at least not involve an intermediary if you can choose so. Short of that, all that remains is the unproven hardness assumptions.
I'm actually surprised that steganography isn't talked about more yet. Tor and Monero are conrete examples of systems that work as long as they have enough traffic. But being able to overlay Tor on normal traffic would be really annoying for those trying to listen.
TLS exposes hostnames in plaintext via SNI. If using TLS version below 1.3 hostnames contained in the server certificate are in plaintext, too. ECH still "experimental", not in widespread use, no delivery deadline.
In theory encryption is something that protects the "common person", but SillyCon Valley's version of encryption, "TLS", is, unfortunately, mostly used for data exfiltration by third party intermediaries, so-called "tech" companies, i.e., opportunistic "business people".
Rather than protecting the "common person", the _primary_ use of "TLS" is to faciltate violation of the "common person's" privacy for profit, and to protect the third party intermediary's privacy intrusions from detection by the "common person", by making it difficult for the "common person" to monitor the outgoing traffic from their computers.
The privacy risk created by this third-party controlled encryption ("TLS") is why corporations must perform "TLS inspection". They have to decrypt TLS connections and then re-encrypt them in order to monitor the outgoing traffic from their networks. But the opportunistic "business people" in SillyCon Valley know the "common person" will not do TLS inspection.
But that's not all. Further third parties, more opportunistic "business people" called "certificate authorities" play a disproportionate role in brokering TLS connections, deciding on behalf of the "common person" who is trustworthy and who is not. This largely relies on "ICANN DNS", another laughable SillyCon Valley implementation, and is thus severely flawed, but that is another topic.
SillyCon Valley's so-called "tech" companies utilise this third party "CA system" to make it difficult for the "common person" to exercise control over deciding who they want to trust or distrust, e.g., by frustrating the use of so-called "self-signed certificates" by the "common person". Meanshile, the SillyCon Valley companies ensure that _by default_ the SillyCon Valley companies' certificates are trusted. In some cases, the certificates (or their digital fingerprints) are hardcoded into software used by the "common person".
Despite what the average "tech" worker would like the "common person" to believe, "TLS" is not synonymous with "encryption". Nor is criticism of TLS necessarily criticism of encryption. TLS is only a lame, user-hostile implementation of encryption that the "common person" must suffer while so-called "tech" companies use it to protect their surreptitious data collection from the "common person".
I will keep using SIM as long as it is possible, not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones, some really like to take their cut every time that eSIM gets moved, for something free of charge and doable under a few seconds with a regular SIM.
So far, the main effect of eSIM was creating a lot of competition and forcing prices down.
If your provider is trying to charge you every time yo need to move your SIM, have you considered a different provider?
Maybe that is an US thing, there has alway been enough pre-paid competition in Europe, and I bet on other continents as well.
I've bought a 9esim, which is a physical SIM you can download eSIMs to. It's the best of both worlds for me, and I can move my data eSIM between phones, routers, and car.
This is interesting, does it only work with specific mobile providers though?
No, since eSIMs are basically just programmable SIMs literally soldered onto the motherboard, I imagine it works with all providers that support eSIMs.
Thanks, that makes sense. I’m curious how this works when it comes to the sim management in the phone. For example on iOS, one SIM and one eSIM have independent on/off switches. If you have one SIM but it contains multiple eSIMs inside of it, I wonder if iOS displays only one SIM or multiple eSIMs.
The OS only ever sees one SIM on this SIM, you have an app to program the SIM you want to actually be active on the card, and that's how you switch.
Ahh I see makes sense. So it’s not entirely a replacement if you wish to utilise the feature of having multiple eSIMs enabled at the same time. Thank you for the details.
I don't think you can do that with any phone, though. Given that the eSIM is a programmable SIM soldered onto the motherboard, you can always only have one connection active on it at a time.
On iOS you can have 2 active at the same time:
https://support.apple.com/en-ae/118227
> You can have two eSIMs active at the same time on supported iPhone models. For example, you can use one eSIM for your home phone number and another eSIM for the place you're visiting.
I think that's because the phone has two eSIM modules, same as if you have a two-SIM phone with two of these eSIM SIMs.
That would make sense, but it does indicate that 9eSIM isn’t a 100% replacement. If you wish to use multiple eSIMs at the same time, you will need to stick with the phones feature, instead of 9eSIM.
If your phone has two physical SIM slots you can fill them both with removable eSIM cards.
[dead]
Not really true. I definitely failed to get one of these cards working with a provider. Some providers insist on only allowing device models they're familiar with, based on the IMEI/EID/etc.
And that's a major flaw of eSIM. Providers shouldn't even have been given that kind of discrimination capability.
With a physical SIM, I can pry my card out of one phone and put it into another, and expect it to work. With eSIM, every single eSIM has to be carrier approved and GSMA approved, and every single transfer from one eSIM to another has to be carrier approved too.
That's bad enough, but my biggest beef isn't even the need for carrier approval per se, but the fact that even when the carrier would intend to approve it, it still requires (a) an additional hurdle, (b) often a separate internet connection, and (c) an unbounded amount of wasted time to make it happen.
SoftSIM is straight up a better deal. But it's B2B only for now.
> With a physical SIM, I can pry my card out of one phone and put it into another, and expect it to work
Is anything preventing the provider from denying a SIM swap based on IMEI?
eSIM seems like a gradual return to the device-locked model that was IS-95/CDMA in the 90s and early 2000s, where it contrasted with the openness of GSM.
> not only is eSIM a way for operators to impose restrictions on unlocked pre-paid phones
Are you outside the US? I've used eSIM on iOS many times with a number of carriers and MVNOs and never noticed a fee (unless you're talking about a postpaid carrier's line activation fee, usually around $36, not related to esim or not)
It's not only the fee. eSIM simply needs too many entities to cooperate just so you don't have to look for a paper clip.
An eSIM only phone could have a bigger battery, if the manufacturer replaces the sim tray with a larger battery. That’s what Apple has done in the iPhone 17 series released last week. The US versions are eSIM only, and have better battery life.
That’s a trade a lot of people would gladly make.
The iPhone 17 in the UK still has the SIM tray, something I'm glad about. Knowing I can pull the SIM and slot it into my old iPhone 8 where there is no eSim support is valuable to me.
And how about knowing that it takes a minute to swap a physical sim and there is no server to take its sweet time and at worst not respond like for eSIM?
Say you arrive somewhere where your regular provider doesn't have signal so you get a prepaid sim from the one provider that does have signal. How do you install it if it's an eSIM? You don't have connectivity on your regular.
> Say you arrive somewhere where your regular provider doesn't have signal so you get a prepaid sim from the one provider that does have signal. How do you install it if it's an eSIM?
One, you can plan ahead. Two, most of those spots have Wi-fi for this purpose.
There are legitimate reasons to prefer a physical SIM. This isn't one.
I just think your mountain holidays aren't remote enough :)
I'm not saying your scenario is unrealistic. I'm just saying it's avoidable. I'll generally buy an eSim, if I need it, before taking off for my destination. In the cases where I forgot and was somewhere I couldn't get it, the SIM vendor let me hotspot to activate.
Only time I’ve used an eSIM was a potential problem with roaming on our corporate deal (was supped to be free roaming but they stop said $1.80 a meg) when I landed in New York. I was connecting before we’d finished taxiing.
I have no idea where to get a local sim from, but it would mean I wouldn’t have my normal phone number (unless I had a phone with two physical sims - very rare), and presumably would have had to find a shop at 3 am body clock time and 10pm local time. Maybe there was one post customs, I don’t know as I was autopiloting to the taxi.
>a phone with two physical sims - very rare
...? - they are literally the norm in Android land nowadays, it's only Apple that INSISTS upon a single SIM or, in third-world variants, two eSIMs.
People can buy roaming and travel sims before they travel and have them delivered to them and activated.
In Europe, in the past it used to cost about 5€ and there was a limitation on the amount of swaps.
As it is nowadays, I am not up to date.
Bouygues France still charged a 10€ fee as of September 2024. Didn't need to move it to another phone though, so I don't know how that works.
That 10 € fee is exactly the cost they would have charged for a physical SIM, shipping included.
Bouygues was one of the companies lamenting the change. They viewed it as a "loss of connection with their customers", whatever that means. I haven't set foot in a phone store in I don't even remember how long, but at least 10 years, so I have no idea what the hell they're talking about.
Read it as: "we wouldn't be able to use our physical stores and physical SIM card distribution as an advantage anymore".
Makes it harder to sell a SIM card along with a new phone, or upsell an entire new phone to someone who wants a SIM card.
eSIM profiles also cost money in a sense - there’s a cost per-profile generated and per download usually from the eSIM personalization provider.
I agree. Thankfully in my country (Australia) eSIMs are handled pretty well, no charges for updates/changes and can be done without interacting with a customer service rep. You can also switch back from eSIM to a new physical SIM (say if preparing to travel).
This is a place where I really think Apple, Google, etc could throw their weight around for good.
If Apple just said to carriers: "You can't sell any iPhone's unless eSIM activations, changes, and updates are free for everyone, and take less than one hour." I think many would follow suit.
The iPhone transfer process actually tries to transfer the eSIM automatically, but it seems to require the carrier to support it.
I suspect Apple is still in the process of forcing every carrier to just support eSIM in the first place, before trying to push making it work well. The second part might end up being implemented through law though.
That's true.
I think carriers always need to be pushed via law. Australia mandated carriers to support number portability (including transfer time-frames) in 2001-ish. It suddenly became so easy to shop around, keeping your number was super easy.
Some started charging 'port out' fees, but that was squashed too.
eSIM provisioning needs wifi. Which means that eSIM transfer can be blocked at any of the bajillion internet levels. eSIM is backwards technology at DRM'ing our devices and the access service
Yeah plus you can take out the physical SIM to (mostly?) guarantee your cellular service won't be utilized by the phone. I mean, barring some hidden back-door eSIM, I guess.
At least in Europe and the US, you can call emergengy numbers (112, 911) without any SIM card installed. So your phone can certainly connect to the cellular network without a SIM.
To piggyback, the SIM card is only needed for identify/authentication/billing. Your phone is already in contact with all the towers nearby. Emergency calls, by law in the US, go out to the strongest towers in reach, get tagged high priority, any bypass any authentication/billing.
Some countries (e.g. Germany) disabled this because there was too much abuse.
Wtf! Why do I need to find this out via HN? I live in Germany and all info I've ever seen says you can always call 112 in Europe with any phone you have on hand, active subscription or not, and worldwide potentially a different number but that it's part of the GSM standard that it lets you call via any carrier because your emergency call is treated differently, always gets accepted and routed with priority
Also considering you're required to authenticate to the government before being allowed to have a mobile phone number in Germany, some people might choose to mainly use their device on WiFis and with downloaded maps and other data. It's not like mobile data is that reliable in Germany anyway. That'd be an unpleasant surprise if you are subsequently denied emergency services in the life-threatening situations that 112 is for
I didn't believe you, or that it was possibly a temporary thing, but I checked and it seems to be true since 2009 with no news since. I'm curious to try it (if there were a test number like 117 and 119 in Belgium¹) because I'm still a bit in disbelief, or to know if it e.g. works with a data-only SIM, or if an expired SIM works (if it ran out yesterday and you haven't had time to fix it or charge up the prepaid card), or if you forgot the SIM PIN due to stress (happened to me once when the phone needed a reboot, so I spent my trip abroad without mobile service until I got home and could reset it). Is it that easy to change the IMEI of a device, that pranksters abuse the service with it constantly if not blocked outright? Why isn't this a thing in other countries? I have so many questions
What a backwater this is in terms of communications infrastructure
¹ https://nl.wikipedia.org/wiki/Noodcentrale_112#Testnummers_n..., English translation on https://www.reddit.com/r/belgium/comments/191hryo/comment/kh...
I bought an iPhone 16e which I am about to sell, not only because of iOS 26 (horrific looking and battery drain), but I did not know they switched to only eSIMs. I have a flip phone which I like to use when I have no need for a smart phone. Now there is no way for me to switch. Plus, I know when I take out my SIM there is no way any one is tracking my phone.
eSIMs just another way these companies are trying to control, and as you said, profit, off of their customers.
I see this as taking ownership away from the customer as well. I no longer own the SIM in essence.
Thanks to Wireguard and basically 0% battery overhead on Android I always keep it activated. If you don't have a Wireguard endpoint just use Orbot to route it through Tor.
Did that several times using cheap eSIMs while traveling.
Never had a single problem with it (but increased latency because of weird routings around the world).
Wireguard is amazing.
I have an "always on" VPN routing back home. Anything destined for my home network gets routed that way, and there's literally zero battery drain.
I'm not paranoid enough to route everything through VPN though.
For me it's not paranoia.. more like: I have a ton of unused GBit/s left.. so routing a few kBit... MBit/s of mobile data doesn't hurt.
What I meant was, I don't subscribe to a public VPN service, so routing all my traffic through my wireguard tunnel back home would merely mean it went through a different ISP.
I already use SDNS with Nextguard, and all traffic is https encrypted, and my day to day business on the internet is probably rather boring to the majority of people. Not saying I have nothing to hide, everybody does, but my visits to various news outlets, social media and other sites is probably not all that interesting.
The most interesting data about you comes from your phones constant reporting of cell towers, which can be used to triangulate you, and put a timestamp on where you were, when.
> Never had a single problem with it (but increased latency because of weird routings around the world).
UDP (which WireGuard uses to encapsulate your data) traffic is often de-prioritized. You won't notice it when the network load is low, but it will seriously degrade experience during high load periods.
Wouldn't deprioritizing interfere with regular web traffic these days, given that close to one third of non-bot traffic reported by Cloudflare is over UDP with HTTP/3[0]?
[0]: https://radar.cloudflare.com/adoption-and-usage?dateRange=52...
I'd certainly hope ISP follow your reasoning. BTW that was why I put my WireGuard server on port 443, hoping it would avoid the tragic QoS…
[dead]
FYI, most of your comments show up as [dead]. I assume that the ones that didn't (like this one) have been vouched by others.
Not sure if dang see this, but it might be worth asking hn@ycombinator.com otherwise
Interesting. I didn't verify my mail address.
Maybe a flood protection for new accounts.
Recently I was looking for solution to have multiple VPN running at the same time, and without work profile I am limited to one. I want to run two (or more) and be able to tell which app uses no VPN, which routes through vpn1, which routes through vpn1, etc. so far it looks like I need multiple profiles, and that requires root, which Google actively discourages.
Maybe someone knows better alternatives?
I think "WG Tunnel" should be able to do that. You can add multiples profiles and link apps to it.
The fact that Chinese domestic cell users can only use phones sold in China on eSim, and as soon as they leave China the eSims no longer work, gives me pause that there is some nascent security hole in them.
Why would they take such extreme measures if there wasn’t some issue with the security?
Incorrect. Chinese mobile carriers only issue eSIM to their approved models, which are devices sold in China. Once the eSIM is activated, users can roaming with their Chinese phone number to any country just like a physical SIM card.
Also, iPhone and iPad sold in China can install and activate an eSIM from foreign carriers when the device is not located in China. They only banned activating foreign eSIM within China.
> They only banned activating foreign eSIM within China.
Is that even a ban? I didn’t think eSIM activation typically roams — I thought it only worked on home networks.
I activated a Thai SIM (True) inside of Europe before traveling no problem, so it's not a technical limitation. I think brands like Saily that specifically target travelers are also activated beforehand, so when you arrive you immediately have data.
True, both networks I have in Europe don't allow it. It's one of the reasons I don't like eSIM, there are a lot more restrictions than with real SIMs. With those I can simply pull one of my cards out of my phone and put it in my tablet or 4G modem for an hour while travelling. With eSIM I have to unregister it and get a new QR every time, registering it doesn't work abroad, and they can deny activation based on the device.
> Is that even a ban? I didn’t think eSIM activation typically roams — I thought it only worked on home networks.
While I was in the US, I swapped iPhones and successfully activated both NTT docomo and Au (KDDI) eSIMs while roaming. It definitely works when you're out of home network.
Mysterious - I have downloaded UK eSIMs over WiFi, and then activated/connected as if I were roaming, from other parts of Europe.
Thanks, It seems I misunderstood the restrictions when they were first introduced. The purpose appears to be preserving the Great Firewall by preventing Chinese citizens from easily bypassing it with a foreign eSIM. Unlike a physical SIM, which must be imported and activated abroad, a foreign eSIM could be downloaded directly onto a domestic phone, making circumvention much simpler. By restricting eSIM activation, authorities effectively require someone to import a separate device, such as an iPhone purchased overseas, and keep it alongside their domestic phone if they want to activate and use a foreign eSIM within China. I had first read about these restrictions when the iPhone Air was announced but not yet released, and at the time the rules were not clearly explained, which led to my initial misunderstanding. Thanks so much!
I did come across non-English article that all-eSIM policy is destroying grey market imports into primarily China and also into Russia. Previously one could easily flip iPhone at or above MSRP to milk carrier subsidies, but those flippers aren't taking iPhone 16/17 as it's harder for the clientele in totalitarian and/or sanctioned countries to use it.
I'm not sure if it's an undisclosed security hole or a backdoor, but there does seem like the eSIM push has something to do with China.
It could be simply IMEI tracking. Turkey also has it. Without being registered in the country registry, the modem just stops getting answers from cell towers.
To prevent them from using Hong Kong eSIMs to bypass site blocks?
It is interesting, my EU iPhone can use Chinese eSims unrestricted in Mainland (via trip.com), advertised as HK/Macao/Mainland travel eSims. As other have said, iPhones for the Chinese market can not. So the phone smuggling is still big business. Also, there is a quota on the amount of sims given out each month, but dont er quote me on that (at least that was the case with physical HK/Mainland sims sold in HK Shamshuipo etc).
This is a weird title and IMO should have included "international resellers" to emphasise the risks are sourced from there, not really due to the eSIMs themselves. Those online-only, travel-oriented resellers, are incorporated or using providers from unregulated or less regulated markets.
If you use an eSIM provided by your own domestic carrier, which I do and many of my friends, especially when having more than one phone number, almost none of the risks in the paper are applicable.
Last vacation, one of our phones broke. We bought a new one, popped in the old SIM, and went on vacationing.
How does that work with an eSIM?
Install phone company app, login, and click migrate eSIM to this phone. Whole process can take up to 5min depending on how fast wifi is to connect to your phone company.
"Install phone company app ..."
You've already lost me there.
I don't install the samsung dishwasher app or the mcdonalds value points app or the Mountain Dew summer of fun app ... why would I install some random national carrier telco app ?
The flip-side to that is what if your phone had been stolen or lost? You're out of luck with a physical SIM, but eSIM could be transferred to a new device.
> How does that work with an eSIM?
Same, except you download it.
Ha, you say that.
When my wife’s German T-Mobile eSIM vanished during transfer to a new phone, their portal for downloading a new one required a token sent to that very phone number we just lost access to.
This meant we had to do a trip to their store where they said that there’s no process for the store to supply us with an eSIM, but they’ll setup a new traditional SIM which we could then convert to eSIM. Ridiculous! At least it was all free - apart from the time spent.
That was a few years ago, though. So, I very much hope they’ve improved on the process.
If we're going on anecdotes, I've had a number of times when a physical SIM popped into a smartphone started behaving bewilderingly.
How do they know it's you, what makes you able to download the subscription token onto your device but not me? Do you need to receive a letter, or email via WiFi somewhere? Do mobile carriers accept unauthenticated devices to let them download SIMs, or does it require WiFi always?
> How do they know it's you
You scan the QR code and then download. Sometimes there is like a code you have to enter. It's a prepaid SIM, the carriers--particularly in East Asia or Africa--aren't particularly concerned with authenticating that much.
Connect to Wi-Fi and download your service providers mobile app. Load eSIM via that.
Calling it "eSIM" is BS marketing. Every time I've used them it's been painful. I don't know the details but it absolutely is not "SIM technology". "eSIM" is something completely different.
A regular SIM: you just pop a SIM card into your phone and it just God damn works.
But eSIMs? I've used eSIMs from five carriers in three different countries and every time there is some issue:
* "Oh you need our god awful app to install an eSIM" (of course I couldn't easily download it because Google play geo hides apps).
* "If your phone is stolen overseas you can simply use this QR barcode again to register an eSIM to a new phone" (I couldn't).
* "Works with all phones". (It didn't because phone manufacturers have to bake Telco specific data into your phones firmware. Not supported? You're shit out of luck).
I could go on..
The fact that there are now privacy and security issues is not surprisingly at all. This isn't teetching issues. The drafters of the eSIM standard should be publicly flogged.
It's an emulated sim card, it really does emulate that weird little Java processor and everything. It's totally "SIM technology" in that sense, even if it's not conventient because of the restrictions of the emulation device.
I did not know that. It's amazing how the usability and utility has taken such a big hit.
Well, a regular SIM mostly just works, except for when it doesn't.
I haven't had any APN issues with regular SIMs in a while actually, but it used to be a common problem that would only sometimes auto-configure correctly. I've definitely had to google carrier APN settings and fiddle with them for a while to get text, MMS, and internet access working properly.
I also recently had an issue where I moved my US MVNO provider SIM to a new phone and it mostly worked, except for RCS. When I called them, they claimed my phone model wasn't compatible with their network, despite me already using it on their network for months. Apparently in their opinion SIMs should never actually be moved to a different phone. They offered to sell me a new phone, but I switched to a new carrier instead.
I've also had APN issues with physical SIMs, they are definitely not perfect. But I have never had an unusable "bricked" physical SIM. My eSIMs gripes are from being unable to use the eSIM at all. It's essentially a brick at that point.
RCS is a whole another kettle of fish indeed and the fact it only works with Play Integrity being on Device/Strong and the bootloader being locked is absolutely asinine to me.
> This has fueled a global marketplace of online eSIM resellers [54], operating across borders with minimal regulatory oversight. These services are typically marketed through web stores and mobile apps, with providers operating across borders and often facing minimal regulatory oversight.
But this is exactly the situation we have with VPNs. VPNs have proven themselves to be a useful tool for censorship circumvention, and foreign eSIMs are thus an interesting alternative suitable for this purpose, especially if traditional VPNs are blocked by the state.
The paper is somewhat title-bait: most of the data flow and privacy concerns (section 3) isn't caused by eSIM but by MVNO and business practices which applies to physical SIM as well. Additionally, it's expecting too much from _travel_ SIM cards (physical or embedded) where the primary consumer concern is cost.
Used an eSim on a trip to Japan recently. I wasn't happy when I realized my IP was in Hong-Kong.
The telco is probably from Hong Kong, and using home-routed roaming, that is subscribers access the visited network through the home PDN gateway (H-PGW). When I roam with mine my IP is always from my home country. There is nothing insidious happening.
There are companies in Japan that provide esim connections that don't route via an overseas provider, e.g.
https://www.sakuramobile.jp/japan-sim-card/local-japan-esim-...
EDIT: Last time I went to Japan, I bought an esim from https://jjesim.com/esim
thank you!
Just switch on a VPN.
No reason to avoid cheap providers.
Routing through another country unexpectedly already makes your latency worse. Adding a VPN on top possibly worsens it again.
Which goes through HK and somewhere else..
I read some of the article and stil not sure what is so unique about eSIM compared to physical SIMs. Is routing user traffic through third-party infrastructure unique to eSIM?
The other risks mentioned are mostly rare edge cases
Removing the need to ship a physical SIM card created an entirely new ecosystem.
There is very little difference between a physical SIM from provider X and an eSIM from provider X (except that one requires an available physical slot and the other is a pain to move between devices), but eSIM allowed many new provider and reseller business models.
In practice, this means much more choice, much lower prices, but often also lower quality because everything is optimized to be as cheap as possible and often involves roaming agreements where your traffic gets sent on high-latency world tours.
In this aspect, what does people on here think about the eSim provider Saily[0][1]?
[0] Website, https://saily.com/
[1] Actual operator is 1GLOBAL alias TP Global
* Provision of Services The Services to Customer will be provided by our Technology Partner - TP Global Operations Limited, a limited liability company incorporated and registered in England and Wales with company number 14109189 whose registered office is at 109 Farringdon Road, Farringdon, London, EC1R 3BW, UK (“1GLOBAL”). *
https://saily.com/legal/b2b-terms-of-service/
They have a lot of obnoxious advertising which makes me not trust them.
I've used Airalo without much hassle, but I can't say that they're any better. I did have an incident where the phone I was using broke, and I was unpleasantly surprised to find that I couldn't just load the eSIM onto the replacement phone, seems like you only get one shot at downloading it.
(Dragonpass is pretty good though, I recommend getting that through a credit card or whatever if you spend a lot of time habging around airports.)
I had to edit and take out my reasoning for asking (I said why I liked it), as it seemed like I was shilling the service, which I wasn't intending to do. Thank you for the insights!
1 GLOBAL is owned by 1GLOBAL Holdings B.V.
Registered address: The Valley - Beethovenstraat 505 North tower, Level 6. Amsterdam 1083HK, Netherlands
So we're at 3 levels of indirection on ownership already.
In practice, 1 Global is the trading name of TP Global because it's the successor company to 'Truphone':
> In 2022 the Company was selected in a competitive bidding process, conducted by a UK court appointed administrator of Truphone Limited (“Truphone”), to acquire all the business and assets of Truphone (the “Acquisition”).
And this company was an investment option for Russian oligarchs:
> In December 2024, German Manager Magazin revealed that Russian oligarchs Abramovich, Abramov and Frolov, who had previously owned 96% of Truphone and invested more than €360 million in the company, could still benefit from any success achieved by 1Global.
So yeah, maybe avoid.
If you want no/less bs, I recommend Google Fi eSim
But then if Google's incomprehensible security algorithm locks your account you don't have a phone anymore and zero recourse.
Yeah but on the bright side, Google's total lack of customer service means nobody will ever be able to talk a minimum wage clerk in the middle of nowhere into transferring your phone number to somebody else without your permission.
The double edged sword of security.
[dead]
[dead]
[flagged]
you could just have read the abstract instead
to save you from loading the pdf:
> This paper presents an empirical investigation of how eSIM adoption affects user privacy, focusing on routing transparency, reseller access, and profile control. We first show how travel eSIMs often route user data through third-party networks, including Chinese infrastructure, regardless of user location. This raises concerns about jurisdictional exposure. Second, we analyze the implications of opaque provisioning workflows, documenting how resellers can access sensitive user data, proactively communicate with devices, and assign public IPs without user awareness. Third, we validate operational risks such as deletion failures and profile lock-in using a private LTE testbed.
Scientific papers have an abstract, which already serves as a short summary.
Have you read the abstract? Most of them is a teaser, and does not contain any information from the conclusion etc. So a summary is still valid?