[Q] Import NFC tag - One (M8) Q&A, Help & Troubleshooting

My bus ticket is using NFC technology. I tried to import data from card to NFC tag, than stick that tag to back of my phone, so I don't have to carry that card always with me, just the phone.
But problem is that I can't import data because NFC bus ticked is protected by serial key. Any way to crack that key?
Thank you

hrvoje334 said:
My bus ticket is using NFC technology. I tried to import data from card to NFC tag, than stick that tag to back of my phone, so I don't have to carry that card always with me, just the phone.
But problem is that I can't import data because NFC bus ticked is protected by serial key. Any way to crack that key?
Thank you
Click to expand...
Click to collapse
Someone has asked this question before. Not sure if it was you but I'll return to same answer someone else gave to the same question. The protection is installed to stop people replicating it and creating their own 'amended' data. Probably with new dates of validity.
What you are requesting is
a) Illegal
b) Against XDA rules.
I think I can say this with confidence. This site won't give you the answer.

grentuu said:
Someone has asked this question before. Not sure if it was you but I'll return to same answer someone else gave to the same question. The protection is installed to stop people replicating it and creating their own 'amended' data. Probably with new dates of validity.
What you are requesting is
a) Illegal
b) Against XDA rules.
I think I can say this with confidence. This site won't give you the answer.
Click to expand...
Click to collapse
Well, thank you for your answer. Seems illegal but I just wanted to 'upgrade' the technology which bus company is using. They probably won't do it since 2020...

Bah humbug. There's nothing illegal about taking a bus pass which you own and making something else produce the same NFC signal. That's like saying that I can scan my frequent buyers cards into an app and then use them all on my phone.
The key is probably easily cracked, but I know of no available way to crack it, short of writing your own script to brute-force it.

danguyf said:
Bah humbug. There's nothing illegal about taking a bus pass which you own and making something else produce the same NFC signal. That's like saying that I can scan my frequent buyers cards into an app and then use them all on my phone.
The key is probably easily cracked, but I know of no available way to crack it, short of writing your own script to brute-force it.
Click to expand...
Click to collapse
The key is in the language used.
Quote - "But problem is that I can't import data because NFC bus ticked is protected by serial key. Any way to crack that key?"
You're right, there is nothing illegal with your scanning frequent buyers cards. I hadn't realised they had protection on. (I never use them anyway so wouldn't know)
The owners of the software/data have put a serial key on it. To protect against it being hacked. It isn't open source. You only purchase to use said ticket for one day/week/month, however long you bought the ticket for. Once it's hacked what next? (We both know the possibilities that exist once it's hacked)
I have a suggestion, why waste time using brute force? If it isn't illegal why not phone the travel company who issued the ticket and ask them for the key.
Surely if it isn't illegal they will only be too happy to supply.
Problem solved.

grentuu said:
The key is in the language used.
Quote - "But problem is that I can't import data because NFC bus ticked is protected by serial key. Any way to crack that key?"
You're right, there is nothing illegal with your scanning frequent buyers cards. I hadn't realised they had protection on. (I never use them anyway so wouldn't know)
The owners of the software/data have put a serial key on it. To protect against it being hacked. It isn't open source. You only purchase to use said ticket for one day/week/month, however long you bought the ticket for. Once it's hacked what next? (We both know the possibilities that exist once it's hacked)
I have a suggestion, why waste time using brute force? If it isn't illegal why not phone the travel company who issued the ticket and ask them for the key.
Surely if it isn't illegal they will only be too happy to supply.
Problem solved.
Click to expand...
Click to collapse
If you knew something about that travel company, you would also try to do everything on your own, believe me. I bet that 90% of them don't know what NFC is, especially Mifare and protection key etc. It would be hard to contact a person in that company who know what am I talking about, probably impossible.

hrvoje334 said:
If you knew something about that travel company, you would also try to do everything on your own, believe me. I bet that 90% of them don't know what NFC is, especially Mifare and protection key etc. It would be hard to contact a person in that company who know what am I talking about, probably impossible.
Click to expand...
Click to collapse
This is the same company who own said software and wanted it encrypting?
I'm going to leave it here.
However, I want to leave you with a thought.
Five years from now you have developed an incredible app for android that expectations say will make you a millionaire.
Yet a month later you only have a 1,000 downloads at a dollar apiece. A thousand bucks! WTF!
This took you two years to assemble and market.
Then you think back and remember this post and wonder. So you search online for "insert your app name here" and the word crack and key.
Lol - thousands of entries, after all your app is popular.
thing is... no one wants to pay for it.
but the thing is... they only wanted to try it before they paid....
But no ones paying.
I'm outta here.

Companies try to lock down all kinds of things unnecessarily. It doesn't mean that you have to respect their misguided wishes.
He's not trying to steal from the bus company, he just wants to increase his convenience. There is nothing malicious about that.
There's no reason to be a negative Nelly and try to stifle his urge to innovate. There are enough entrenched market leaders trying to protect their little artificial fiefdoms without you sucking up and trying to do their work for them.
---------- Post added at 09:58 PM ---------- Previous post was at 09:55 PM ----------
hrvoje334 said:
My bus ticket is using NFC technology. I tried to import data from card to NFC tag, than stick that tag to back of my phone, so I don't have to carry that card always with me, just the phone.
But problem is that I can't import data because NFC bus ticked is protected by serial key. Any way to crack that key?
Click to expand...
Click to collapse
Starting at the beginning: What have you already tried? Do you know what kind of NFC card it is? Have you used a reader or Android apps?

Exactly,I don't want to steal anything. I've paid for a season ticket and I was just wondering if I could make it more practical, since the company doesn't offer you that option.

Related

So, I made my first NFC payment today...

I do not see the appeal.
It's just as easy (easier, really) to swipe a credit card.
I do not see the advantage of making a purchase process more complicated--NFC requires a powered, active, working phone. What if the phone crashes? What if the battery dies?
A credit card is solid state, requires no power, and is usable just about anywhere...
Am I missing something?
Deanwvu said:
Am I missing something?
Click to expand...
Click to collapse
Did you get your $10?
I don't know about purchases but I have some cool ideas about things to do with my new NFC tags.
Deanwvu said:
I do not see the appeal.
It's just as easy (easier, really) to swipe a credit card.
I do not see the advantage of making a purchase process more complicated--NFC requires a powered, active, working phone. What if the phone crashes? What if the battery dies?
A credit card is solid state, requires no power, and is usable just about anywhere...
Am I missing something?
Click to expand...
Click to collapse
It's the overall potential to removing all the clutter of having multiple credit cards with multiple bills and a wallet full of info that is hard to recover. If I lose my Wallet I have to call all my credit card companies and cancel all my cards then have to wait for them to resend them in the mail. With this I can easily recover with just a new phone. It sucks right now because not many people accept it but you are considered an early adopters if you join right now so there is going to be some teething pains you're going to go threw. Also think of this as like those key chain things that gas stations use for easier and faster gas purchases. It's like that but on a bigger scale
Sent from my LG-P999 using xda premium
Buff McBigstuff said:
Did you get your $10?
Click to expand...
Click to collapse
I did It was certainly worth $10 to give this a go!!
psychoace said:
It's the overall potential to removing all the clutter of having multiple credit cards with multiple bills and a wallet full of info that is hard to recover. If I lose my Wallet I have to call all my credit card companies and cancel all my cards then have to wait for them to resend them in the mail. With this I can easily recover with just a new phone. It sucks right now because not many people accept it but you are considered an early adopters if you join right now so there is going to be some teething pains you're going to go threw. Also think of this as like those key chain things that gas stations use for easier and faster gas purchases. It's like that but on a bigger scale
Sent from my LG-P999 using xda premium
Click to expand...
Click to collapse
I can see that as an advantage, perhaps. Maybe there will be a day when I walk out of my door carrying only my ID, my phone, and my car keys, but not yet. I do not trust my phone to be working all the time every day. All it would take is one phone failure when I actually need to purchase something to sour the experience for good.
Again, when it comes to purchasing goods/services, I think simple is best. Time will tell.
Security. Your credit card is an archaic tool rife with vulnerabilities. Chip based payment systems are arguably more secure.
psychoace said:
It's the overall potential to removing all the clutter of having multiple credit cards with multiple bills and a wallet full of info that is hard to recover. If I lose my Wallet I have to call all my credit card companies and cancel all my cards then have to wait for them to resend them in the mail. With this I can easily recover with just a new phone. It sucks right now because not many people accept it but you are considered an early adopters if you join right now so there is going to be some teething pains you're going to go threw. Also think of this as like those key chain things that gas stations use for easier and faster gas purchases. It's like that but on a bigger scale
Sent from my LG-P999 using xda premium
Click to expand...
Click to collapse
Damn, I really got to stop typing long crap like that on my cell phone. I need punctuation damnit.
I tried it a while back at Best Buy, especially since Google is handing out a free $10. Yeah, it's nothing special, but I like the idea of keeping some cash on there in case I ever leave my wallet at home. I've gone out of town on business before only to get 2 hours down the road and realize I don't have my wallet. I NEVER leave my phone. It's a good option to have.
psychoace said:
Damn, I really got to stop typing long crap like that on my cell phone. I need punctuation damnit.
Click to expand...
Click to collapse
I've seen much worse
Sent from the MIUI powered E3D
Deanwvu said:
I do not see the appeal.
It's just as easy (easier, really) to swipe a credit card.
I do not see the advantage of making a purchase process more complicated--NFC requires a powered, active, working phone. What if the phone crashes? What if the battery dies?
A credit card is solid state, requires no power, and is usable just about anywhere...
Am I missing something?
Click to expand...
Click to collapse
It's because you're now old school.
Don't worry I argued this same point - there's not much appeal when I have to carry a wallet anyway for my ID and some cash for places that charge for credit cards. Google wallet takes more work than paying for a card for me.
But I could see this being a fundamental shift in payment for younger generations who might have a phone but no real need for a wallet - who will grow up used to this system.
The real issue at the moment is battery life, I'm sure 5-10 years from now week+ battery life will be the norm and using phone for everything will become acceptable. Phones will also not be so fragile (cough iphone) so it will be as reliable as a piece of card (or almost).
Personally though, I think an NFC card would be way more convenient. It could be the size of a credit card, with a touch screen interface that lets you use it for payment or as a driver's license. But this kind of tech is probably at least 10 years away.
Can I ask you guys which method is the best one out there ?
I do have root.
http://forum.xda-developers.com/showthread.php?t=1365360
or
http://forum.xda-developers.com/showpost.php?p=20404813&postcount=350
I think I'm a little confused by wallet. I know it wasn't inclued out of the box because of Verizon. I was able to download it from the market, install and activate it. I have the $10 and went to test it. I went to pay and the phone said sent but did not display the merchant for confirmation and the merchant didn't receive it either. They are supposedly setup for it. Do I need to grab one the other APKs and reinstall or is there any ideas you guys may have? I've searched plenty and saw no mention of what I'm experiencing. Thanks for any insight.
+1
Thank you!
finally some one that sees the truth
Deanwvu said:
I do not see the appeal.
It's just as easy (easier, really) to swipe a credit card.
I do not see the advantage of making a purchase process more complicated--NFC requires a powered, active, working phone. What if the phone crashes? What if the battery dies?
A credit card is solid state, requires no power, and is usable just about anywhere...
Am I missing something?
Click to expand...
Click to collapse
Deanwvu said:
I do not see the appeal.
It's just as easy (easier, really) to swipe a credit card.
I do not see the advantage of making a purchase process more complicated--NFC requires a powered, active, working phone. What if the phone crashes? What if the battery dies?
A credit card is solid state, requires no power, and is usable just about anywhere...
Am I missing something?
Click to expand...
Click to collapse
I am on the fence, see the pros and cons with both...but eventually when the NYC MTA implements this technology broadly it would pretty sweet to use if you happen to misplace or forget your train ticket and/or metro card
For now, I have to agree. It is less convenient than just using a card.
What would ultimately be really cool is to replace all those things we're talking about with just your phone. Unlock your house, start your car, verify your identity, pay for stuff... all with one device. But until I can ditch my wallet and keys entirely, it's just another way to complicate things instead of a solution to make life simpler. Can't wait for the future!
I've now used it at about 5 different locations and it's pretty fast, with much potential. assuming you've entered your pin ahead of time, it's faster than paying with a physical card. my phone hasn't crashed for more than a month (since going to custom roms) and fcs are extremely rare. therefore it's as reliable as I expect it to be
Sent from my Galaxy Nexus using xda premium
My phone gave me fits when I tried to use Google Wallet at Rite Aid. Fortunately the cashier mived the rest of the line behind me to a free register so I could keep trying, because I had to start over like 8 times. It's a nice gimmick for now, but it won't really be practical until more businesses support it and the bugs get worked out.
Terminators run on Android
I see the appeal in that my phone is quickly becoming my life "tool"
First it integrated my iPod/music player, now does movies, now does hand held games, mobile web browser and email means its now used for work purposes... replicon now has timesheet app so it also records my time in/out of a job......google wallet is now what I use to pay for groceries at the store instead of carrying my wallet in my pocket and possibly loosing my wallet... if my phone is lost, they have to go through 3 passwords before getting to my wallet.
Im thinking more of it as a "why not"... my phone is becoming more and more useful
out for a run with only my phone, need a drink, run into cvs, swipe phone
I used it at 7-11 yesterday just to test it with the free $10. It worked flawlessly but I don't see replacing my wallet until everyone accepts this interface.
I would use it more now if I was able to add my Wells Fargo debit card. Hopefully the ability to add any type of debit/credit card will be the next stag of evolution for this service.
Sent from my Galaxy Nexus
One advantage is that you can see all your previous transactions electronically more conveniently (not having to log into your credit card account, or wait a day or two before the transaction showing up there).
Another advantage is that coupons and deals can be used more easily. For example, right now if you go into Google Wallet, you can choose offers like 15% off entire purchase at Gap & Banana Republic when you pay with NFC. The offers are pretty limited right now, but I reserve my judgement until Google Wallet or Isis (Verizon/AT&T/T-Mobile NFC payment system) take off.
In principle, it is more secure since even if you lost your phone, with your phone unlocked, other people can't use it for NFC payment since it requires an additional PIN code. But then of course losing the phone itself probably costs a lot too...
If Google Wallet or Isis gain traction, more credit card companies will jump in. And hopefully that means you can add more credit cards can be stored on your phone, eliminating the need to carry a number of physical cards.
Oh... and it saves a lot of time for a typical female not having to find an additional item in their over-stuffed purses.

2nd Google Wallet vulnerability found that effects all users, rooted or not

There is yet another security vulnerability in Google Wallet that allows a person with access to your device to change your pin without having ever known your pin at all. It doesn't require root or any special software to do either. Hopefully Google plugs this hole ASAP.
http://thesmartphonechamp.com/secon...le-wallet-rooted-or-not-no-one-is-safe-video/
canca14 said:
There is yet another security vulnerability in Google Wallet that allows a person with access to your device to change your pin without having ever known your pin at all. It doesn't require root or any special software to do either. Hopefully Google plugs this hole ASAP.
http://thesmartphonechamp.com/secon...le-wallet-rooted-or-not-no-one-is-safe-video/
Click to expand...
Click to collapse
Jesus, so don't use it. Problem solved.
This whole the sky is falling crap is pissing me off. There are inherently more risks with people stealing your credit card and identity than all this.
Yep, this was discovered awhile ago:
http://forum.xda-developers.com/showthread.php?t=1412136&highlight=wallet
If you're using Google Wallet, you should also be using either a pattern or PIN unlock for the lock screen. Common sense. In any event, in this scenario they only have access to your prepaid card which only has limited funds.
Used Wallet for the first time this morning at Wawa and loved it. Entered the PIN while I was waiting in line. Got to the register, tapped the PayPass, boom, done. So easy and quick.
Or you could...just...not lose your phone...
El Daddy said:
Or you could...just...not lose your phone...
Click to expand...
Click to collapse
When I worked retail I was once robbed at gunpoint, and the thief stole my iPhone, too.
Sometimes it's not as easy as just "not losing your phone".
That said, I used my $10 and since there's no convenient way to use my bank account with Google Wallet, I don't really have a reason to use it anymore. No skin off my back, but I'm sure Google will plug the holes soon...
Stadsport said:
When I worked retail I was once robbed at gunpoint, and the thief stole my iPhone, too.
Sometimes it's not as easy as just "not losing your phone".
That said, I used my $10 and since there's no convenient way to use my bank account with Google Wallet, I don't really have a reason to use it anymore. No skin off my back, but I'm sure Google will plug the holes soon...
Click to expand...
Click to collapse
True, but the odds of the thief finding/stealing your device with google wallet and knowing how to hack it to get access is about the same someone finding your house keys on the street, locating your house, and robbing you.
I have never seen a GSM GNEX anywhere so I'm not concerned some geek is going to drain my bank account when I'm at the local quicky mart.
FUD
Stadsport said:
When I worked retail I was once robbed at gunpoint, and the thief stole my iPhone, too.
Sometimes it's not as easy as just "not losing your phone".
That said, I used my $10 and since there's no convenient way to use my bank account with Google Wallet, I don't really have a reason to use it anymore. No skin off my back, but I'm sure Google will plug the holes soon...
Click to expand...
Click to collapse
Then call your bank to block future transaction ...
Same thing like when you lost your wallet with credit card in it ...
No issue here, just dont loose your phone. And do the right thing when that happen!
gogol said:
Then call your bank to block future transaction ...
Same thing like when you lost your wallet with credit card in it ...
No issue here, just dont loose your phone. And do the right thing when that happen!
Click to expand...
Click to collapse
Yes you can call to block transactions, but to say that there's no issue when a person can change your pin without ever even knowing your pin just by simply clearing the app's data is a bit odd. There's definitely an issue there. How can the technology be expected to grow when such glaring holes in the security are there? If I could add my bank card to Google Wallet I wouldn't do it after seeing how easy it is for someone to access it.
mobilehavoc said:
Jesus, so don't use it. Problem solved.
This whole the sky is falling crap is pissing me off.
Click to expand...
Click to collapse
Then don't read it. Problem solved.
Discussing security concerns in a development forum is fairly justified and appropriate. The reaction by the community is entirely reasonable.
Hi Guys,
We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.
We reported it to Google on January 4th and they are presently working on a fix for it.
Please note that this issue ONLY affects people's pre-paid accounts.
miasma said:
Hi Guys,
We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.
We reported it to Google on January 4th and they are presently working on a fix for it.
Please note that this issue ONLY affects people's pre-paid accounts.
Click to expand...
Click to collapse
I don't know who you are, but I like your smile so I will trust you.
miasma said:
Hi Guys,
We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.
We reported it to Google on January 4th and they are presently working on a fix for it.
Please note that this issue ONLY affects people's pre-paid accounts.
Click to expand...
Click to collapse
This so call news is as old as the app itself. It is just that one blog decided to write about and the rest followed copy/paste as every single "news" in android.
making a mountain out of a mole hill. my phone has pattern lock. if i ever lose the bloody thing i will remotely wipe it. the 20 bucks on my pre paid card wont bankrupt me if i lose it anyway.
canca14 said:
Yes you can call to block transactions, but to say that there's no issue when a person can change your pin without ever even knowing your pin just by simply clearing the app's data is a bit odd. There's definitely an issue there. How can the technology be expected to grow when such glaring holes in the security are there? If I could add my bank card to Google Wallet I wouldn't do it after seeing how easy it is for someone to access it.
Click to expand...
Click to collapse
How can that person have access to your phone?
This is the same like you lost your wallet with your credit card and money in it.
Still, you can password protect or encrypt your phone, while you can NOT do that on your wallet.
canca14 said:
How can the technology be expected to grow when such glaring holes in the security are there? If I could add my bank card to Google Wallet I wouldn't do it after seeing how easy it is for someone to access it.
Click to expand...
Click to collapse
It's worth re-iterating that this vulnerability only impacts the Google pre-paid card that you can use with Wallet - that is the only card that is automatically restored to your Wallet based on your device ID. Any physical cards that you have linked with Wallet will not be available after the "thief" has wiped your Wallet data.
You can bet if you lost your real wallet with a pile of bills in it that money would be spent faster than the person wiping G Wallets data. This whole attack G Wallet thing is driving me nuts.
I think a whole 10 people actually used Google Wallet AFTER they spent the free $10.
Sent from my Galaxy Nexus using XDA App
miasma said:
Hi Guys,
We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.
We reported it to Google on January 4th and they are presently working on a fix for it.
Please note that this issue ONLY affects people's pre-paid accounts.
Click to expand...
Click to collapse
so you were boy scouts on this one but released exploit code for the last one? Bipolar much? Thanks for letting us know that you knew about it already.
Sent from my GSM Galaxy Nexus on TMoUS using Tapatalk

NFC Vulnerability!

http://phandroid.com/2012/07/26/hac...ble/?utm_medium=referral&utm_source=pulsenews
Sent from my HTC One XL using xda app-developers app
good read good thing i keep my nfc off all the time
Can anyone confirm that the radio is actually off when NFC is unchecked in settings?
Sent from my HTC One XL using xda app-developers app
This vulnerability affects very few users. Furthermore, those users that it does affect must have their phone's screen turned on for the vulnerability to be exploited. Surely if you have your screen on, you'd be aware of any foul play from third parties; why are you worried?
Screen has to be on and it has to be VERY close or near (hence the n in nfc)
Sent from my Nocturnal HOX
JamesR913 said:
Screen has to be on and it has to be VERY close or near (hence the n in nfc)
Sent from my Nocturnal HOX
Click to expand...
Click to collapse
Screen on, device unlocked *and* within a few cm of this device (this is the NFC antenna portion of the device, not just anywhere on the device).
I'm rather interested in how exactly this could be done. Though I reckon it could potentially be dangerous to publicly release that info, I could call it a case of "it's not a bug, it's a feature" and do pretty useful things with it. I'm thinking along the lines of making the phone connect to wifi, which without such hacks is only possible if the phone that scans it has one from a number of NFC apps installed. Pre-installing that app too just so you can log into wifi at someone's house kind of eliminates the purpose of using NFC to login in the first place.
If you programmed a NFC tag with a url that contained embedded javascript (or escaped characters that would later unescape to javascript) *and* the browser interpreted them instead of ignoring them or invalidating the whole url... maybe. But it's a big 'if'.
Most new-ish browsers now disallow Javascript in URLs. The other main attack vector would be a trusted site with reflected XSS vulnerability (ie, a site that renders URL-encoded parameters into the rendered page, like a 404 page that displays the requested URL within the error message), but it's more likely that an attacker would just host his own page since the URL target of a NFC tag is opaque until read, anyway.
The main thing: don't allow NFC to launch the browser without previewing the URL's value, and don't preview the url's value in any container that can be induced to interpret its content as HTML.
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2
Well, if it is possible to make someone connect to wifi using javascript, then it might be interesting to put a small website online with just that bit of javascript. I could then put a hyperlink to that page in the NFC tag. Would still require internet access, but it would use a lot less data to work that way (the normal way is installing an app first, which costs way more data) and it would also be faster and require less actions. From the user's view, it is a lot more elegant. This would mean you don't have to inject the javascript directly into the url and run the risk of the url being blocked by the browser.
Bad side is that you will in all likelyhood practically be putting your wifi password on the internet. That might be a major security issue.
That is assuming it is possible to make devices connect to wlan using javascript, which I understand from your post it is, though I can't find out any information on this.
What do you think about this theory?
It depends mainly upon how Android handles NFC events. If it fires an intent that relays the NFC tag's content to a handler that blindly fires it off as another intent, or blindly opens it in a browser window... well... there's a good chance that Bad Things(tm) will eventually happen somehow. If Android makes at least half an attempt to sanitize the NFC-read content, and doesn't have any command-injection vulnerabilities along the way, it'll probably be OK.
I'm still reading up on Android's specific implementation of it. Much of what I wrote above is actually based on naive handling of QR-encoded URLs.
Speaking in the abstract, the worst thing I can imagine an end user doing today is downloading (or writing) cobbled-together handler with no sanity-checking or sanitizing that registers itself as a listener for NFC events, gets the user to make it the official handler, then does something completely stupid, like reading the String straight from the tag and using it to blindly construct a new Intent and fire it off. The thought of someone doing that gives me chills.
what if someone where to place a chip near a pay-pass location while using google wallet? what then?
A 'chip' ? Basically nothing, except possible denial-of-service due to interference (you can't read two tags simultaneously).
There's nothing magic about NFC. At the end of the day, it's basically a low-ceremony moderate-speed serial link that allows parasitic powering of low-cost radio+eeprom modules in the form of tags. It's what you and the software make of it.
NFC payments are no more or less inherently secure than online paypal purchases encrypted with SSL. In the grand scheme of things, the actual data transfer is usually the *least* of your problems, compared to how the data is stored on your end & handled on the other end.
Would you ever allow your PC to indiscriminately send $10 via Paypal to anybody who manages to plug in a flash drive for 7 seconds? Then don't run a payment client that automatically satisfies any payment request you literally wave in front of it without at least requiring some form of affirmative confirmation & approval from you.
Can a badly-implemented NFC app be cloned or impersonated? Sure. And so can your Visa card, if you hand it to the waiter & he swipes it through his own capture device when you aren't looking. That's why you never, ever want to agree to TOS that leave you on the hook for basically unlimited charges.
NFC payments backed by Visa or Mastercard are a wonderful thing. If somebody defrauds you, you fill out a form, file a police report if necessary, and maybe pay $50 if you have bad credit & your issuer feels like they can screw you as a subprime customer. Otherwise, that's the end of it, unless the bank can prove you committed fraud or engaged in wantonly reckless and unfathomably stupid behavior.
NFC payments backed by my checking account, and no daily hard purchase limit like $50? No. Way. In. HELL. I had a debit card stolen 10 years ago. By the time the bank contacted me, my account was overdrawn by almost $5,000. For almost a week, I couldn't even cash a check from my parents, because it would have just gotten absorbed by the overdraft. I spent 2 days just fighting with the bank to get the ongoing $29+ overdraft fees (for legit expenses autopaid after the thief overdrew my account) waived (after they finally credited the fraudulent charges back to me, ~2 weeks after it happened, and I was able to argue that they wouldn't have *been* overdrafts if the bank had done its job and noticed charges for stores and things I've never bought in my life). The truth is, it's *very* hard to unwind and fix a checking account catastrophe.
So, in summary:
* wave my phone over a sensor to blindly pay $3 and board a subway train that's going to depart without me in 17 seconds if I don't run like a mofo up the escalator, paid from a fund that gets topped off $25 at a time, at most twice per week? Sure.
* wave my phone over a vending machine that requires a pin code the first time I do it at a new location, is backed by a credit card, and maxes out at $10/day? Sure.
* ditto SPECIFICALLY for Taco Bell.
Bigger charges? Ask me, and make me explicitly authorize them after demonstrating my knowledge of a passphrase.
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2
NFC is absolutely insecure. It was discussed by Steve Gibson of GRC on last week's (Oct 3rd) podcast of Security Now.
http://twit.tv/show/security-now/372
It was discussed by him, and if you read the whole thing, he basically said exactly what I did. NFC itself is security-neutral. It's a slow short-range wireless serial port.
If someone wrote a proof-of-concept app that ran on your PC, monitored COM1 at 9600-8-N-1 & responded to "transfer://amt=100&acct=123456789" by blindly transferring $100 to account #123456789 without even asking for confirmation, would you declare that serial ports are "totally insecure", too?
NFC is a hardware capability. Nothing less, nothing more. Software can use it for good *or* mischief. Include a compensating control that requires physical affirmation of intent, and legal controls to limit your total liability, and its use for payment is no worse than a prepaid transit card. Security isn't a thing, it's a process with layers of things, some of which WILL occasionally fail.
Remember, if a mugger marches you up to an ATM with a gun in your back, the bank isn't going to refund your withdrawal, either.
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2
bitbang3r said:
Remember, if a mugger marches you up to an ATM with a gun in your back, the bank isn't going to refund your withdrawal, either.
Sent from my SAMSUNG-SGH-I747 using Tapatalk 2
Click to expand...
Click to collapse
WOW that sucks. My bank would. Sucks to be you.
Sent from my squirrel.

Suggestions for a SINGLE app to handle all my wallet garbage

I want to store credit cards i rarely use, driver's license, loyalty cards, medical insurance cards, etc etc etc.
It sucks google missed the boat by not supporting stuff in wallet outside of credit cards because i would love to use that to stick all my kroger, walgreens, etc loyalty cards in and not have to install anything else.
what are other people using? lemon? i'd rather not have to install ANYTHING else, but if i do, i want it to be able to securely lock up all the stuff i dont want to carry around with me.
what are other people using who dont like carrying a wallet around with them?
nyvram1 said:
I want to store credit cards i rarely use, driver's license, loyalty cards, medical insurance cards, etc etc etc.
It sucks google missed the boat by not supporting stuff in wallet outside of credit cards because i would love to use that to stick all my kroger, walgreens, etc loyalty cards in and not have to install anything else.
what are other people using? lemon? i'd rather not have to install ANYTHING else, but if i do, i want it to be able to securely lock up all the stuff i dont want to carry around with me.
what are other people using who dont like carrying a wallet around with them?
Click to expand...
Click to collapse
I'm presently using LastPass, and ponied up for a year's subscription. You can do a two week trial to decide whether it's worth it to you or not. I dig it, and there are mobile and PC versions. That said, it's the only one I've ever used.
https://lastpass.com/
CMNein said:
I'm presently using LastPass, and ponied up for a year's subscription. You can do a two week trial to decide whether it's worth it to you or not. I dig it, and there are mobile and PC versions. That said, it's the only one I've ever used.
https://lastpass.com/
Click to expand...
Click to collapse
How are you actually using LastPass to digitize your wallet? I've been a paying LastPass member for almost two years now. I love it and all, but I don't seem to recall LastPass having features to digitize cards and stuff.
Southrop said:
How are you actually using LastPass to digitize your wallet? I've been a paying LastPass member for almost two years now. I love it and all, but I don't seem to recall LastPass having features to digitize cards and stuff.
Click to expand...
Click to collapse
It's under Secure Notes - you can choose Credit Card as an option. I believe you can also attach an image to it, if you'd like to take a picture of your physical card as well.
i like to know if i'm at the next '10 cents off' range on my kroger card.
do either of these apps accurately show you your kroger points as well? i see kroger has an app that does that..does keyring or lemon or lastpass provide this info or do they just store the loyalty id #?
bts0004 said:
It's under Secure Notes - you can choose Credit Card as an option. I believe you can also attach an image to it, if you'd like to take a picture of your physical card as well.
Click to expand...
Click to collapse
Ah I see. Come to think of it, I've never actually used the Secure Note feature. Looks like it could be useful, but I don't think I could be bothered to add all my cards lol
nyvram1 said:
i like to know if i'm at the next '10 cents off' range on my kroger card.
do either of these apps accurately show you your kroger points as well? i see kroger has an app that does that..does keyring or lemon or lastpass provide this info or do they just store the loyalty id #?
Click to expand...
Click to collapse
LastPass seems to simply store textual information and an optional image. As far as I can tell, there is no system that checks balances or point totals.
there is a kroger app that does it :banghead: but i was hoping for something to avoid that.
looks like w/ all the coupons that kroger app might be worth installing anyway in addition to giving me the monthly balance on my points (since they reset every 30 days)
nyvram1 said:
I want to store credit cards i rarely use, driver's license
Click to expand...
Click to collapse
I'll stop you RIGHT there... Yes, there are apps that will store loyalties and credit in one bundle, a couple mentioned here are quite good...
Your driver's license though?!?! Sorry man, until the government endorses an "App" that allows it, you're not giving that card up anytime soon. I don't think there's a Cop on the planet that would take your word that an image of your license on your phone couldn't be altered and is just as good as the hologram embedded copy-proof ID that the government issues to avoid fraud. haha
I'll stop you RIGHT there...
Click to expand...
Click to collapse
ok fair enough. i know the driver's license isn't kosher...but if they're just looking it up to see if its legit anyway what is the point of the little plastic thing?
ok that aside (and yeah i know its needed to get into bars)..i still want to store everything else if possible.
like my HSA debit card..i rarely if ever pull that out except to pay a bill when i'm sitting in my office and i'm just reading the stupid card anyway. rarely if ever use it in real life.
oh and 100 posts woo hoo.
nyvram1 said:
like my HSA debit card..i rarely if ever pull that out except to pay a bill when i'm sitting in my office and i'm just reading the stupid card anyway. rarely if ever use it in real life.
Click to expand...
Click to collapse
What good does storing a debit card do anyway? I mean, unless I'm seriously missing something or misunderstanding, you're basically storing the number, expiry date, security digits and possibly a photo of it in most cases. It won't store chip data (assuming chip+pin debit card) or mag stripe info (for mag stripe cards). The only way I can see it being used after digitized is online. But you most likely wouldn't pay your bill from your phone anyway, would you?
well.its a debit/credit card.
i get these little paper invoices from clincs for my kids and i just call the 800# and give them my card # over the phone to pay them.
but i never carry the HSA card with me so having it on the phone means i should have all the numbers & stuff i need to do the bill paying over the phone.
i should point out its technically a 'debit' card since the HSA is a bank account, but i don't actually use it that way with a PIN or anything.
Here's what I use... http://goo.gl/Kc2S6
The developer is constantly updating the application and he is really open to feedback. The application allows you to add anything so that you always have it with you. The only thing I'm not sure of right now is if he lets you add pictures of the card, I think he would add it though if you suggested it. The alternative is Lemon Wallet, http://goo.gl/FVv5G
This is what i use and i love it.
http://timothyjc.blogspot.com/2010/12/wallet-for-android.html
nyvram1 said:
well.its a debit/credit card.
i get these little paper invoices from clincs for my kids and i just call the 800# and give them my card # over the phone to pay them.
but i never carry the HSA card with me so having it on the phone means i should have all the numbers & stuff i need to do the bill paying over the phone.
i should point out its technically a 'debit' card since the HSA is a bank account, but i don't actually use it that way with a PIN or anything.
Click to expand...
Click to collapse
Maybe the UK does things differently. Debit cards are basically the standard way to pay by card in the UK. Most, if not all, are visa or MasterCard and all by now should have chips in them, so it's not exactly easy to digitise. Are things different wherever you are?
Sent from my Nexus 4 using xda app-developers app
Yea, with how much fraud we have here in the States and how much banks say they want to keep your money safe, implementing chip&PIN is apparently too expensive an endeavor for us.
I just memorized my card number and leave it locked up at home *shrug*
Sent from my Nexus 7 using XDA Premium HD app

FRP [Factory Reset Protect] Removal for Samsung Galaxy S7 & Edge (SM-930V & SM-935V)

FRP [Factory Reset Protect] Removal for Samsung Galaxy S7 & Edge (SM-930V & SM-935V)
I have decided to release full FRP Bypass PE1 + Software Root
I hold no responsibility on how this software is used.
This software is malware free. So just follow the instructions and if I helped hit the Thank you!
I only support and assist with this version of my software not other versions that have been decompiled and released elsewhere within this thread.
There are no revisions of version changes this is the final version and works 100% if you can follow simple instructions.
Download
Reserved
xboxexpert said:
The total has now risen to the administration having over 10K of phones locked in her drawer with no way to bypass security lock.
Click to expand...
Click to collapse
I would love to see a picture of 10,000 phones in a drawer.
I don't have a solid answer for you on the legality (and in fact I'm sure few here are experts in that regard) although you can probably safely assume the answer is no.
psouza4 said:
I would love to see a picture of 10,000 phones in a drawer.
I don't have a solid answer for you on the legality (and in fact I'm sure few here are experts in that regard) although you can probably safely assume the answer is no.
Click to expand...
Click to collapse
I figured the SGS7's are at least 400 or 500 bucks each or something I haven't paid for a phone nor service is 7 years being employees here. Don't care to research how expensive they are however I know she has over 20 of them at the moment.
#guestimate
xboxexpert said:
I figured the SGS7's are at least 400 or 500 bucks each or something I haven't paid for a phone nor service is 7 years being employees here. Don't care to research how expensive they are however I know she has over 20 of them at the moment.
#guestimate
Click to expand...
Click to collapse
Aw, you meant $10K value not 10K quantity. What a difference a character makes. I would have loved to see the ridiculous stockpile that 10,000 phones in a single drawer would look like
So are you saying you found a method or are going to try to find a method?
Any cobtribution is a good one but I am not familiar with the legality either but dont see it matter unless you are posting saying thieves can use it on a stolen device.
In all honesty, ppl legitamitely forget their passwords and lock themselves out I am sure all the time and at times if you purchase the phone from a third party theres really no way to remove or bypass it without proof of purchase or replacing the device which some might not have because of how it was purchased.
elliwigy said:
So are you saying you found a method or are going to try to find a method?
Any cobtribution is a good one but I am not familiar with the legality either but dont see it matter unless you are posting saying thieves can use it on a stolen device.
In all honesty, ppl legitamitely forget their passwords and lock themselves out I am sure all the time and at times if you purchase the phone from a third party theres really no way to remove or bypass it without proof of purchase or replacing the device which some might not have because of how it was purchased.
Click to expand...
Click to collapse
I have successfully bypassed the FRP Reset Protection no matter how much security is on the phone, passcode, pattern, fingerprint. All are bypassed for a full clean factory reset.
So short answer, yes. Also there is a high likelihood that this method works on ALL variants.
I'm going to say trolly troll troll.
'Tis all.
Sent from my SM-G930V using XDA-Developers mobile app
If what your saying is true do the right thing and contact the manufacturer and carriers with it I'm sure that they would like to know. The fact that you haven't already isn't right.
jayfried said:
If what your saying is true do the right thing and contact the manufacturer and carriers with it I'm sure that they would like to know. The fact that you haven't already isn't right.
Click to expand...
Click to collapse
I am in full agreement with this statement. However I have no idea where to start. Again this was basically proof of concept until it because a reality. Tested it at least 20 times and every time I've been able to bypass FRP 100%. Even gave it to my director and had him lock it down with fingerprint and google account and 10 minutes later he was speechless.
xboxexpert said:
I am in full agreement with this statement. However I have no idea where to start. Again this was basically proof of concept until it because a reality. Tested it at least 20 times and every time I've been able to bypass FRP 100%. Even gave it to my director and had him lock it down with fingerprint and google account and 10 minutes later he was speechless.
Click to expand...
Click to collapse
Pm me the method. I want to try on my phone
I personally would contact MikeChannon (forum admin) at http://forum.xda-developers.com/member.php?u=335322 and go from there. I'm all for public disclosure but if you are worried about legal or forum rules I think he'd be more informed.
From the Moderator
The bypass method would not violate any law per se. The only issue that would be in question is if you own the phone or lease it.
Under that specific lease agreement it probably has wording about applying custom software to the phone.
~~~ oka1
ESN lockout is what makes turning over a lost or stolen phone difficult. And yet there is a huge grey-market trade on ebay and other places. I image they are all going overseas to get the appropriate chips switched out for resale. And if they have an operation set up for that, physically removing the flash chip and reprograming it would be a breeze. IMHO the lockout is more of a money generator for samsung so they can charge you to unlock it if you lock yourself out.
Describing the process is no more illegal than rooting. And if you figured it out, someone else will too. Only they might not share in hopes of selling the service or profiting somehow.
BlueLightNight said:
ESN lockout is what makes turning over a lost or stolen phone difficult. And yet there is a huge grey-market trade on ebay and other places. I image they are all going overseas to get the appropriate chips switched out for resale. And if they have an operation set up for that, physically removing the flash chip and reprograming it would be a breeze. IMHO the lockout is more of a money generator for samsung so they can charge you to unlock it if you lock yourself out.
Describing the process is no more illegal than rooting. And if you figured it out, someone else will too. Only they might not share in hopes of selling the service or profiting somehow.
Click to expand...
Click to collapse
Meaning if I share then I'm opening up a whole new market that will explode as bad as Pokemon Go.....
or meaning someone else will release it anyways in time so whether you release it or not doesnt matter outside of you being "first" lol
xboxexpert said:
Meaning if I share then I'm opening up a whole new market that will explode as bad as Pokemon Go.....
Click to expand...
Click to collapse
Actually it would destroy or prevent a market. Markets only exist for those who know how and can do it. At the moment that is Samsung. You don't share it and Samsung makes a bit more money. Then someone else figures it out and they also don't share.... you start seeing adverts on eBay priced a bit below Samsung for the "get back into your phone!" service (or maybe it's just you trying to make a buck ;P ) If you do release it or someone else figures it out and releases it. Well,... we will still see the adverts on ebay for the techna-challenged but it will be a hell of a lot cheaper because it is a known process thus many people offering thus competition.
rootjunky has had an FRP bypass out for months.
https://www.youtube.com/watch?v=ChCvMLdyRuw
PiousInquisitor said:
rootjunky has had an FRP bypass out for months.
https://www.youtube.com/watch?v=ChCvMLdyRuw
Click to expand...
Click to collapse
Go try it on your Verizon phone with latest security update patch.
xboxexpert said:
Go try it on your Verizon phone with latest security update patch.
Click to expand...
Click to collapse
You try it. My phone is set up and running the way I want it. I'm not going wipe it for a silly reason like proving myself wrong or right. That's your job.
If it works or not isn't the whole point of posting the video. Clearly it's not illegal to expose how to get around FRP. If it were, RootJunky would have been charged and his videos pulled.
Sent from my Nexus 5X using Tapatalk

Categories

Resources