For years, each cellphone included a tiny smart card called a SIM (Subscriber Identity Module) that contained the “identity” of that device so that it could connect to a specific cellular network.

Data on SIM cards includes user identification, location, and phone number, network authorization information, personal security keys, contact lists, and saved text messages.

When Apple introduced the new iPhone 14, they repeated something they had done years before. They removed a piece of hardware from the phone. First, it was the earphone jack and now it was the removable SIM card and tray. Just like the earphone jack, Apple is touting this change as a boon for consumers. Now, all iPhone 14s sold in the US will use eSIM technology.

"I think it's transformational," Ahmed Khattak, founder and CEO of US Mobile, a mobile virtual network operator that offers service on Verizon and T-Mobile's respective networks. "I think the fact that it even happened ... I'm shaking my head ... because it really democratizes connectivity." 

A type of programmable SIM card known as an eSIM (embedded-SIM) consists of software put onto a chip permanently installed in a device, as opposed to an integrated circuit on a releasable universal integrated circuit card, which is commonly constructed of PVC.
​
Once an eSIM carrier profile has been installed, it operates the same as a physical SIM, complete with a unique integrated circuit card identifier (ICCID) and network authentication key generated by the carrier.
So, why is this change so important? For users, there are three advantages to eSIMs over physical SIM cards:
     •  It’s more secure, because no one can remove it from the phone and use it to intercept phone calls or text messages. (This isn’t the most common form of SIM card hijacking, but it is still possible for someone with physical access to the phone.)
     •  Switching carriers is easier, because you don’t have to wait for a SIM card to arrive or pick one up at a store.
    •  Adding extra lines is easier, because you no longer need a phone with dual SIM card trays. (On the iPhone, Apple supports up to two phone numbers and eight data lines with eSIM.)

An eSIM also benefits phone manufacturers and wireless carriers.
    • By getting rid of the SIM tray, Apple will gain more valuable interior space it can use to install more technology.
     • For carriers, it's a money-saver because they no longer must spend between $10-$20 per physical SIM card.

Like almost every change, there are going to be some growing pains. Not all US carriers are eSIM compatible. Some alternative providers that lease capacity from the major carriers–known as Mobile Virtual Network Operators, or MVNOs, in industry jargon–don’t support eSIM today, which means you can’t use an iPhone 14 on their networks. Some notable examples include Ting, Walmart Mobile, US Mobile, Net10, and Tello.

Conversely, there are small carriers like Mint Mobile, US Mobile and Boost Mobile in the US who have been preparing for this change for some time.
​
"Mint has always believed in digital technologies that enhance and ease wireless services," Aron North, Mint Mobile's chief marketing officer, said in a statement. "Mint has been supporting [the] eSIM for almost two years because we knew, even back then, this innovation would allow users to switch faster and easier."

How many people do you know who use the same password for everything and it isn’t even something hard to guess, like a birthday, anniversary, address or just “password” or “123456”? There are a lot and even with today’s excellent password managers, users have to be proactive to be sure they have rock solid passwords, change them regularly and protect them by not using them more than once.

Standards. A group of technology giants, including Apple, Google and Microsoft, have banded together to form the FIDO Alliance. This is an open industry association with a focused mission: authentication standards to help reduce the world’s over-reliance on passwords. FIDO promotes the development of, use of, and compliance with standards for authentication and device attestation. 

Apple is the first of the major players in FIDO to bring out their standards compliant solution to removing passwords from online security. The new technology is called Passkeys and will debut this fall on all of Apple’s operating systems: macOS Ventura, iOS 16, iPadOS 16, and Apple TV.

How do Passkeys Work? Passkeys are unique digital keys that are easy to use, more secure, never stored on a web server, and stay on your device. Hackers can’t steal Passkeys in a data breach or trick users into sharing them. Passkeys use Touch ID or Face ID for biometric verification, and iCloud Keychain to sync across iPhone, iPad, Mac, and Apple TV with end-to-end encryption.

When you create an online account on a website, you will use a Passkey instead of a password. “To create a Passkey, just use Touch ID or Face ID to authenticate, and you’re done,” said Darin Adler, Apple’s P of internet technologies.

When you go to log in to that website again, Passkeys allow you to prove who you are by using your biometrics rather than typing in a pass phrase (or having your password manager enter it for you). When signing in to a website on a Mac, a prompt will appear on your iPhone or iPad to verify your identity. Apple says its Passkeys will sync across your devices using iCloud’s Keychain, and the Passkeys are stored on your devices rather than on servers. (Using iCloud Keychain should also solve the problem of losing or breaking your linked devices.) Under the hood, Apple’s Passkeys are based on the Web Authentication API (Within) and are end-to-end encrypted so nobody can read them, including Apple. The system for creating Passkeys uses public-private key authentication to prove you are who you say you are.

A password-less system would be a significant step forward for most people’s online security. As well as eliminating guessable passwords, removing passwords reduces the likelihood of successful phishing attacks. And passwords can’t be stolen in data breaches if they don't exist in the first place. (Some apps and websites already allow people to log in using their fingerprints or using face recognition, but these usually require you to first create an account with a password.)
​
When all the tech companies have rolled out their version of passkeys, it should be possible for the system to work across different devices—in theory, you could use your iPhone to log in to a Windows laptop, or an Android tablet to log in to a website in Microsoft’s Edge Browser. “All of FIDO’s specs have been developed collaboratively, with inputs from hundreds of companies,” says Andrew Shikiar, the executive director of the FIDO Alliance. Shikiar confirms Apple is the first company to roll out passkey-style technology and says this shows “how tangible this approach will soon be for consumers worldwide.”

Early in June, Apple’s Tim Cook wrote to legislators involved in the drafting of the American Data Privacy and Protection Act (ADPPA). In the letter, Mr. Cook said that Apple realizes that there are several outstanding issues, but “the areas of agreement appear to be far outweigh the differences.”

Cook said that privacy is a “fundamental human right” for Apple and we believe in protecting users and their information by default. “We do this by minimizing the data we collect, processing as much data as possible on a user’s device, giving users transparency as to what data is collected and control as to how it is and building robust systems to protect user data,” Cook wrote.

Shortly after the letter was made public, users began posting on social media their disbelief in Cook’s sincerity. 

Shortly thereafter, Simon Randall, CEO of Pimloc (a video privacy and security company) came to Cook’s defense. “Apple is proof that it is possible to build a thriving digital company without harming people’s civil liberties,” Randall told Infosecurity Magazine.

“It is possible for companies to generate huge value from the digital ecosystem while still respecting privacy. Regulators must design rules that enable technology to serve mankind, not enslave it.”

There appears to be some hope for new privacy legislation after three key legislators released a bipartisan discussion draft of ADPPA. On June 1st, the draft of the bill was released by House Energy and Commerce Chair Frank Pallone (D-N.J.), ranking member Cathy McMorris Rodgers (R-Wash.) and Sen. Roger Wicker (R-Miss.), ranking member of the Senate Commerce Committee. Notably missing from this group of supporters was Senate Commerce Committee Chair Maria Cantwell (D-Wash.) who believes that the bill needs to be stronger.

The International Association of Privacy Professionals (IAPP) has been following the ADPPA and its Managing Director, Coburn Zweifel-Keegan, recently threw a wet towel on the negotiations, saying that it will be at least 2023 before we see some legislation enacted.
​
If you are interested in the status of privacy legislation at the state level, IAPP has an informative website with the latest information.