SIM PIN entry dialog: font and haptic wrong

Hardware Librem 5
1

The SIM PIN entry dialog uses the normal keyboard and this is to small, esp. when you’re on the road or train or car which moves you and your device. It’s highly possible that you enter a wrong PIN and have only three tries.

It should have the same size as the the unlock-PIN entry dialog, same size and the same haptic, i.e. the entered digit is clearly highlighted with a big grey circle.

Even better would be a plain ASCII dialog with the option to switch off/on the clear text:

SIM PIN: ****                 (-)

SIM PIN: 1234                 (*)

You have three tries
4 Likes
2

It’s a good idea to be in possession of the PUK so that this is not the case.

Bear in mind that while the SIM PIN may be numeric only (I’m not certain of this), the e.g. OpenPGP card PIN allows all printable ASCII characters (and likewise the unlock PIN is not restricted to numbers) so the user interface may need to continue to support switching to the normal keyboard.

1 Like
3

Yes, the PUK has with its 6 digits the same problem or even worth, because it has 6 digits.

I was not talking about the OpenPGP card PIN (this has an ASCII pinentry). I was only talking about the SIM PIN.

1 Like
4

But you get more tries to enter the PUK. :wink:

Aside: I think the PUK is usually 8 digits.

My concern was that it might be code / widget in common.

If you are not overly bothered by the security implications, having regard to your threat model, you can try to store the SIM PIN on the phone, rather than having to enter it. That could be done with greater or lesser degrees of security.

I’m not sure that it even makes much sense any more to have a SIM PIN. Most people here are on unlimited* call plans so why bother to steal someone else’s SIM? It made more sense a decade ago when calls from a mobile phone were quite expensive. Personally, I put far more value on the phone than on the SIM. So that might be another option: get rid of the SIM PIN (again, having regard to your threat model).

None of this is to discourage your original request, which I agreed with. I am just proposing other options.

1 Like
5

SIM cards are still used for two-factor authentication, so they are vulnerable to being ejected, placed in an attacker-controlled smartphone, and having recovery one-time passcodes or automated voice calls sent there instead.

2 Likes