eSIM is specifically designed to deny user freedom.
They are impossible to transfer from device to device by design, for one. Every single "transfer" has to be approved and signed off by a cellular provider in an online mode. They can deny it at will, or just neglect implementing it, and you can do nothing at all.
It's pretty clear that when GSMA talks of "security", they mean "security of the business models". What does that mean for the users? It means they're getting fucked.
esim.me, 9esim and "sysmocom eUICC for eSIM" are eSIMs in the SIM card form factor that you can load the SIM profiles onto and use them in any device with a SIM card slot (and of course transfer between devices). In my opinion, that's the best of both worlds.
> It's good, but they're expensive as fuck for what they are.
Yep, I remember a time where you could extract the Ki and IMSI from legit SIMs and write that to a bog standard Goldwafer card (which were also used for cable TV hacking) including some SIM emulation software and thereby clone the SIM. That was like 30 years ago and the only thing that changed in SIMs since then is better encryption.
I'll post an example for the parent just in case they are honestly confused about use cases. Here is one that happened to me. I had an eSIM on my iPhone. My iPhone broke (screen became somewhat unusable, and the phone was stuck in a restarting loop). It was an older model phone so I checked the repair cost and thought I'd rather buy a new one.
Bought a new phone. Now, to transfer my eSIM from the old phone to the new phone, I needed the carrier to approve. But I was away from my home country and on roaming. So I tried to call them. They needed me to use a verification PIN they would send via SMS on the old phone, to verify the transfer to the new one. Impossible since the old phone is unusable.
Back in the day, I'd have just taken out the sim from the old phone and moved it to the new one. Easy peasy.
The only other option in this case now was to visit one of their stores thousands of miles away. Eventually just ended up doing that when I returned weeks later but during this time I could not access several services due to lack of access to my number plus 2 factor codes being sent there.
Moving a sim from phone to phone was seamless. Now the carrier needs to approve this swap. Even with two working phones sometimes it's a hassle and there will be delays while carriers decide to approve the move. There is a new feature that allows you to transfer eSIMs easily between phones but carriers seem to be holding onto their power in this regard and not every carrier will let their sims move so easily. This possibly requires regulators to step in and solve the issue - make it up to the user to move eSIMs. I would count on the EU to make this easier at some point.
On the plus side, eSIMs are nice to be able to signup and provision them through an app. Helps with travel and roaming. So there's that too.
“I’m across an ocean from any of my network’s stores and need to activate a different phone on my regular network and number right now, on the side of the road, without WiFi or a computer or a different, working phone already on my account” is to me the most obvious case where eSIM is weak. And having been in that situation before eSIMs, it was really easy - remove SIM, put in backup phone, use. Not so much now.
this carrier approval to move esim problem is more generalized on modern “smartphones”. unless you opt in to cloud providers holding your data there is no easy way afaik to migrate your authenticator apps to another phone. and a host of other authentication/authorization data is tied to the device in an opaque way. don’t get me started on apple’s unpredictable model of sending 2fa to some other “trusted” device which means tou never know what tou need to bring with you.
> unless you opt in to cloud providers holding your data there is no easy way afaik to migrate your authenticator apps to another phone.
You could self-host Bitwarden/Vaultwarden, or something like that.
> don’t get me started on apple’s unpredictable model of sending 2fa to some other “trusted” device which means tou never know what tou need to bring with you.
I think they send 2FA to all supported devices on one's Apple account?
i just ran into a situation activating a new device in which apple were trying to send to a device i had forgotten to “properly” remove from that icloud account.
and also another situation in which the 2fa code would flash on the remote device and disappear in a fraction of a second. i eventually captured it with screen recording but every time i did it the code was not accepted.
my conclusion: apple had silently ruled that i would not be allowed to activate using that particular icloud account. no idea why. i tried a different one and things went through ok.
that’s good to know thanks but creates more special cases to manage if i just want to backup my stuff so i can manually recover when i need to (on lost device say).
They are impossible to transfer from device to device by design, for one. Every single "transfer" has to be approved and signed off by a cellular provider in an online mode. They can deny it at will, or just neglect implementing it, and you can do nothing at all.
It's pretty clear that when GSMA talks of "security", they mean "security of the business models". What does that mean for the users? It means they're getting fucked.