42
NFC payments on GrapheneOS
(monero.town)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 23 Nov 2023
42 points (95.7% liked)
Android
28000 readers
57 users here now
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
founded 1 year ago
MODERATORS
Why hasn't someone made a FOSS NFC payments app yet? Any bored Android FOSS developers, please make this your next project.
If it was as simple as writing an app it would be done by now. The problem is authorisation, the bank isn’t going to action the transfer request just because Bob’s Banking app says so. The request either needs to come from their own app or from one of their partners (Apple).
I'd be interested to know what happens if you use one of the official apps on a rooted phone.
If you hide root, you're fine.
That suggests you can get credentials out of the phone, at least for non-google phones. I doubt that the Moto G that I just got has a security chip like the one in the Pixels and Iphones. It's possible though. I do want to start messing with the phone's NFC reader, though more as a general security thing than for payments in particular. Maybe I'll get to understand it better.
Probably the issue lies somewhere else, like legal, infrastructure or sm.
It's more down to trust and attestation than a technical implementation. Whoever makes an NFC payment system needs to prove to payment processors that the chain of software and hardware from the payment terminal to whatever proves you're the account holder (a card or a phone) can be identified. And, separately, the implementation needs to be audited.
This may sound like they're trying to make this horrible walled garden on the surface, but bank users expect their money to not get stolen. And if it is, they expect the bank to make that problem disappear. The bank can only provide these assurances if they control everything.
This is why they use hardware attestation and a chain of trust all the way through to the OS to identify the specific implementation of an NFC payment system. They want to know they can go after whoever created the buggy NFC payment implementation to recover the money or to least stop partnering with them.
Not a lot of FOSS developers would go through the trouble.