XMRSIM - Buy Anonymous eSIM Plans with Monero (No KYC)

@xmrsim Why should I choose over silent.link who has been around for a while?

@Stylus1063 We provide data-only travel eSIM plans, unlike their GB-based pricing. Which are usually cheaper if you are planning a trip in multiple countries.

nothing personal but i just have trust issues at like a human level or somethin type thing

esim dataplan providers are like isps, there is so much trust involved and i dont trust isps...
like, sure i guess could do the whole vpn, orbot thing or whatever and it would mitigate that
for less technical people tho, that's a risk for them

there's been an history of creeps getting employed by companies like google and whatnot, like, there was a story like that, with a google employee getting in a game with some kid or something then accessing his gmail account content, just... creepy shits :/

it's like, there's a reason some people ending up in a specific job position, like police people, they dont do it "to protec teh people" or whatever, they have their own motivation to get in that position in the first place

so changing from a mobile data provider / isp for an other one would be quite a decision there, considering that for example, some other providers been having a decent track record so far, and werent "xmr providers" at first, they started as btc services and then added xmr at a later date
on that end, xmr has just so many adversaries, which would make sense for adversaries to start making xmr targeted services in the first place

so that would be my concerns here, regarding newer xmr specific services
and to give an other example, protonmail... like, past few years they have had so many redflags, but on top of that, they also trying to have a whole ecosystem for themselves
and since people are lazy, they like to have everything in one place, then they fall into the trap of centralizing all of their data with a single provider, that is an issue if that provider is compromised

then there was stories like the "anom phone": https://www.vice.com/en/article/anom-phone-arcaneos-fbi-backdoor/
that's some next level commitment right here from adversaries, making a whole phone thing, selling that whole phone thing... so, what's the next step for those adversaries? is this it? that's my concerns...
and mobiles are heavily targetted on that, pegasus been a thing... idk, its a headache avoiding the creeps lol

so i guess, one simple question for newer services:

• since there is lots of trust involved for some of the services, what makes you trustworthy and not being an actual honeypot type thing?

@SpinningCat Why would you need to trust an eSIM service? Data shared over eSIM connection and ways to minimize the risk your identity being exposed is simple.
Mullvad has no-log policy, and swears to God they don't share our info with governments, yet none of us trust them blindly. Pretty much same thing.

@xmrsim
yea fair enough there, honestly i just dont know enough about mobile tech, so just being extra tinfoil there
like, what data/metadata the provider has access to, i literally have no clue there

i like what silent.link been doing tho, routing traffic to different countries so the default ip address is not the one you would get from the nearest cell tower i guess? idk, its just too techy for me but i like what they doing there
and being able to just doing a single payment and it can work for years without needing to refill, that's nice QoL for them too, instead of like having to remember to refill when the plan gets close to expiry

still, more provider options are nice, leaves more choices for people to choose from depending on their usecase

@xmrsim How this differ from Silent link, Nadanada or Voidmob? Tell us more about your USPs.

while still havent tried the service, still posted negative review for now over there:
https://monero.forum/reviews
above poster did a lenghty thread reviewing all the esim providers over there:
https://monero.forum/thread/tested-no-kyc-esim-providers-actually-take-monero-notes-what-works
and yet had their question unanswered regarding USPs (Unique Selling Points)

OP being dismissive to my post with a: "Why would you need to trust an eSIM service?"

just asked LLM what would be the concerns regarding mobile data providers and what would be mitigated and what would not be mitigated by using grapheneOS/VPN, output from the prompt was:

1. Cell Tower Geolocation — NOT mitigated. The modem/baseband communicates with towers at the firmware level. GrapheneOS can't spoof what the SIM reports (IMSI, TMSI) or which tower you're handed off to. The carrier tracks physical location regardless of OS.

2. Traffic Metadata — NOT mitigated at the provider level. The carrier still sees encrypted packets to your Tor/VPN endpoint, their size, timing, and volume. They can detect Tor usage (known node IPs) and perform traffic analysis on packet timing patterns (website fingerprinting). The destinations are hidden, but the metadata is not.

3. Monero Timing Side-Channel — NOT mitigated. GrapheneOS doesn't alter when you pay or activate. Payment timestamp + network activation time + tower location at that moment is still a correlatable triplet.

4. Device Fingerprinting at Provisioning — PARTIALLY mitigated. Vanadium (GrapheneOS browser) has anti-fingerprinting patches (restricted WebGL, reduced canvas entropy, no PDF viewer). But enough entropy remains: screen resolution, timezone, installed font set, browser version. Mitigation depends on the browser you use, not the OS itself.

5. Wholesale Carrier Exposure — NOT mitigated. GrapheneOS has no control over the upstream carrier (BICS/Tata/Truphone etc.) that actually peers your traffic. They see everything the MVNO sees.

6. Honeypot/Seizure Risk — NOT mitigated. If the provider is adversary-run or gets seized, the data and infrastructure are out of your control. No OS-level protection applies.

7. VPN Illusion — PARTIALLY mitigated. GrapheneOS's always-on VPN + kill switch prevents cleartext leaks if the VPN drops. Orbot/Tor integration works well. But the carrier still sees: Tor entry node IPs (known), traffic volume/shape, and tower location — so the "illusion" is reduced but not eliminated.

Summary: GrapheneOS helps with device-level leaks (app permissions, network kill switch, browser fingerprinting), but does nothing against the network-level visibility the carrier inherently has (location, traffic metadata, timing correlation). The unmitigated risks are structural, not OS-dependent.

did a follow up prompt:

isnt location somewhat approximate tho? is it through triangulation or something else? how precise is it compared to like GPS data, does the carrier can access that data too?

output was:

Triangulation vs. GPS:

Cell triangulation (OTDOA/UTDOA/RTT): 50–300m typical on 4G; 5G NR positioning can hit <10m in dense urban (rivals GPS). Rural areas are worse (1–5 km). The modem reports timing measurements to the network at the firmware level — GrapheneOS can't touch this.

Yes, the carrier can access GPS-level precision — and this is the bigger point. The modem has its own GPS receiver and responds to LTE Positioning Protocol (LPP) requests from the network independently of Android. Even with device location services disabled, the network can request GNSS measurements via SUPL (Secure User Plane Location) and the modem will respond. This is part of the 3GPP standard, baked into baseband firmware.

So the real situation is worse than "the carrier has approximate triangulation." The carrier can effectively get GPS coordinates from your modem on demand, regardless of what the OS does, and there's no way for GrapheneOS to block it because it happens below the application processor level.

interestingly enough, 2G towers been discontinued in many countries already, more still planning shutting those down coming forward, for USA AT&T 2G ded since 2017, Verizon since 2020, T-Mobile since feb 2025
which apparently, 2G would be safer against the carrier itself, way worse regarding any attackers within radio range, so if the threat model is the carrier because corporate slop, that sucks lol, options are nice depending on threat models lol, o7

edit:
well i guess XMRSIM might not even be a phone carrier thing but literally just a reseller of esim giftcards type thing?
they did a reply on some other thread today tho, worthy of some pothead that has no clue of what even is what, the unanswered question was from a different user (the post above), not from myself and was literally a simple one liner, not even a long post but they called it "LLM powered critique", like, nah, one liner simple question from a different user
if that's what's expected from their customer support then yea, ill pass on that and stand by the negative review i left