Android now lets you transfer eSIMs between your phones

Original Article ↗ Hacker News Discussion ↗

Android’s new tool for transferring eSIMs between phones is welcomed for making upgrades and travel connectivity more convenient, but it also raises concerns about security and user control. Commenters worry that easier eSIM moves could expand the attack surface for SIM-swap style takeovers and further entrench carrier lock‑in, especially where transfers require carrier approval or in‑store visits. Others note that eSIMs work well in some regions and use cases (like international travel, IoT, and corporate fleets), but argue that reliance on phone numbers and SMS for authentication should be phased out in favor of stronger, device‑based methods.

Security & eSIM Transfer Mechanism

  • SIMs are meant to hold non-extractable crypto keys; with eSIMs, provisioning typically issues new keys via carrier backends rather than copying old ones.
  • Commenters worry Android’s eSIM transfer could become an attack vector: if someone gets temporary access to an unlocked phone, they might hijack the number.
  • Some hope there will be backend logs, explicit controls, or ways to disable transfers, but details are unclear.
  • People expect “0‑day” style exploits and argue SMS-based 2FA should be abandoned anyway.

Carrier Control, Lock‑In & Regulation

  • Strong view that eSIMs shift power from users to carriers and platforms (Google/Apple), making it harder to just move a SIM between phones.
  • Several examples of carriers blocking or complicating eSIM transfers, requiring store visits, or refusing eSIM moves while physical SIM swaps remain trivial.
  • A concrete case: AT&T using eSIM-specific “carrier visibility/reveal” locks on iPads, effectively restricting non-AT&T eSIMs until an FCC complaint forced a fix.
  • Others say this is not inherent to eSIM but to “shitty carrier policy”; regulation is seen as the main counterweight, with EU cited as more protective than the US.

User Experience: Good and Bad

  • Positive: instant provisioning, no waiting for mail, dual-SIM on single-SIM hardware, and smooth number porting in some regions (e.g., parts of EU, India).
  • Negative: failed migrations, non-reusable or expiring QR codes, inconsistent carrier support, and serious pain when a phone is lost or broken and the eSIM can’t easily be moved.
  • Some carriers still force in-person verification for eSIM (especially for transfers), which users see as security theater and a regression from physical SIM flexibility.

Travel & Secondary Use Cases

  • Widely praised for travel: easy purchase of local or regional data eSIMs via apps or marketplaces; avoids roaming and airport SIM hassles.
  • Counterpoint: travel eSIMs often cost more per GB than local physical SIMs and can be permanently roaming; prepaid eSIM support is spotty in some European markets.
  • eSIMs are also valued for IoT and corporate fleets: remote reprovisioning, reduced risk of SIM loss, and easier inventory control.

Security Models & Alternatives

  • Some argue physical SIMs are a strong security anchor; they recommend never putting a primary number on an eSIM.
  • Others mitigate by porting their “real” number to VoIP (e.g., Google Voice/Twilio) and treating the cellular SIM/eSIM as disposable, though some services block VoIP numbers.
  • Debate over phones as a 2FA factor: many criticize SMS 2FA but defend app-based or device-based MFA on phones as both secure and convenient.
  • Concern that as devices (notably iPhones) go eSIM-only, avoiding eSIM for primary numbers will become impractical.

Ecosystem & Openness

  • Complaints that GSMA security requirements and certificate chains make it hard for small operators or hobbyists to provision their own eSIMs, unlike programmable physical SIMs.
  • Interest expressed in open-source eSIM emulation, but people note it likely depends on proprietary keys and secure hardware, so feasibility is unclear.