Subject: RE: AW: [Sipping] FYI: RADIUS & SIP

From: "Gunn, Janet" <[email-masked]>
Date: Thu, 31 Jul 2003 11:05:14 -0400

The SIM card in my GSM phone doesn't have a PIN associated with it.  Or if
it does, I have no idea what it is and have never needed to use it.  It has
all sorts of "secret codes" as part of the authorization process, but I, the
human, never deal with them.

I think the model would be a "SIM card" that you keep in your wallet, like a
credit card, and use on whatever "phone" you want.  And/or have multiple SIM
cards- one/some that you leave in your "regular phone(s)", and one you keep
in your wallet.

-----Original Message-----
From: Henning Schulzrinne [mailto:[email-masked]]
Sent: Thursday, July 31, 2003 10:39 AM
To: Beck01, Wolfgang
Cc: [email-masked]
Subject: Re: AW: [Sipping] FYI: RADIUS & SIP

Don't SIM cards also have PINs? Thus, you still have to tell the 
customer "don't choose the last four digits of your social security 
number or 1234"... Obviously, requiring both "something you have" and 
"something you know" is more secure than jut "something you know".

Also, while SIM cards work ok when kept in the cell phone, the existing 
card mechanics don't seem to work well if you want to, say, quickly use 
the phone in the meeting room. Would you need to remove and insert the 
SIM card each time? "Oops, I left the card in my office phone, I can't 
make a call from home right now."

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 31 Jul 2003 11:14:09 -0400

It then becomes like a credit card - if I have it in my possession, I 
can make calls around the world. Who is going to foot the bill for this?

---

From: Michael Haberler <[email-masked]>
Date: Thu, 31 Jul 2003 19:44:08 +0200

The GSM operators have been through this many moons ago, through the courts 
and all. This is established legal ground.

There is a pin code by default on GSM SIM cards.

It is the protection for your account from stealing the phone (or card). 
This is also why you usually have three tries on the PIN, and then the card 
locks up until you unlock it with a another "more powerful" PIN unlock 
code. You fail here as well a few times the card permanently disables itself.

You can remove the PIN code, however you cannot complain to your phone 
company because you didnt make all those calls on your bill if you do. Its 
your responsibility if you opt out of PIN code protection.

-Michael

At 11:14 31.07.2003 -0400, Henning Schulzrinne wrote:

>It then becomes like a credit card - if I have it in my possession, I can 
>make calls around the world. Who is going to foot the bill for this?
>
>Gunn, Janet wrote:
>