Develop Bugs

Significant security flaw in Google wallet

There's quite a significant security flaw in Google wallet at the moment.
Going into application settings and then clearing data for wallet is the same as resetting wallet from within the application, without having to enter a pin. Know what that means? You're able to set up a new password and have access to your prepaid card.
That's right. If a tech-savvy thief has your phone and you don't have a passcode on the lockscreen (possibly because Google's implementation of passcode stuff sucks) or the screen hasn't timed out yet, the thief will have access to whatever funds remain on your Google prepaid card, regardless of the pin you set in the application.
This is yet another reason why Google needs to add the ability to lock out INDIVIDUAL applications with a code or face recognition, not just the friggin' lockscreen. If someone gets your phone after you've entered your lockscreen code/pattern, they have free reign over the device as long as the screen is on. Third party software for this purpose just doesn't work very well at this stage. This functionality needs to be integrated into the OS. Sorry for going off on a tangent.
Basically:
1) Go into application settings
2) Clear data for Google wallet
3) Open wallet and set it back up
4) Everything remaining on your Google prepaid card can now be used.

That's a good point I don't know if Google wallet is supposed to more secure than a credit card.
If some one steals your wallet, what do you do? Suspend any transactions for that stolen card. Just do the same with the cards you have on Google wallet.
Or I'd just remotely wipe the phone , so they have none of your information on your phone .
Sent from my Galaxy Nexus using XDA App

bigmike2424 said:
That's a good point I don't know if Google wallet is supposed to more secure than a credit card.
If some one steals your wallet, what do you do? Suspend any transactions for that stolen card. Just do the same with the cards you have on Google wallet.
Or I'd just remotely wipe the phone , so they have none of your information on your phone .
Sent from my Galaxy Nexus using XDA App
Click to expand...
Click to collapse
Any actual cards that you add to Wallet will of course be removed, but the Prepaid card will still work. How easy would it be to suspend transactions with Google?

Ouch... report it!
Greets
____________
mDroid - Tapatalk
Phone: LG-P500
ROM: Nitrogen - Beta-V1b
Kernel: custom .35
Theme: ICS (Z25 - paid. ported by me )
Tweaks: ALL
Wishlist: Galaxy Nexus

You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.
Click to expand...
Click to collapse
You can reset the application without the passcode. Once that's done, simply open it up, set it up with a new passcode and you have access to the prepaid card immediately.

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.
Click to expand...
Click to collapse
try this:
open clear google wallet data, run google wallet again.
it will prompt you for new passcode and link it to the google account on your device.
of course, all the credit card info is wiped, but your google prepaid card can still be added without passcode, so whatever remaining balance you have on it will be usable by whoever activate it

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
Click to expand...
Click to collapse
The OP explains it perfectly.
Evangelion01 said:
1) Go into application settings
2) Clear data for Google wallet
3) Open wallet and set it back up
4) Everything remaining on your Google prepaid card can now be used.
Click to expand...
Click to collapse
That means anyone who gets your phone, even while it's turned off, can follow these steps to remove whatever pin you have set. They can then set up Google Wallet with their own pin and add your prepaid card with all its funds back onto the app and start using it.
To be safe, you'll need to set your lockscreen to use one of the other security types such as pin, pattern, or password, and then hope nobody gets ahold of your phone while the phone itself is unlocked. I don't find face unlock to be very safe at all so I won't even recommend it for protecting Google Wallet funds.

to add some other failure of google wallet...somehow ur wallet gets registered w/ ur device...or that's how it looks like...i had a nexus s w/ wallet fully functional and about $12 left on the prepaid card...bought the GN and gave the NS to my wife...fully wiped the device, reinstalled the wallet and activated w/ my wife's account...guess what she got my remaining balance and when i activated mine on the GN i only got the $10...but to be 100% fair it could be something related with the fact that we're not really supposed to have this running on our phone...so might be something related to that, since my NS was on t-mobile and not sprint...hence i was running a "not approved" app...

Evangelion01 said:
You can reset the application without the passcode. Once that's done, simply open it up, set it up with a new passcode and you have access to the prepaid card immediately.
Click to expand...
Click to collapse
I was having a hard time understanding too until you pointed this out (again?) ... thanks for the heads up.
did you submit this issue to google?

Elganja said:
I was having a hard time understanding too until you pointed this out (again?) ... thanks for the heads up.
did you submit this issue to google?
Click to expand...
Click to collapse
Nope. How would I go about doing that? Knowing Google, even if we were to inform them today there wouldn't be a fix for at least a month.
Still can't believe that after three years they haven't got a solution allowing you to passcode protect individual applications in the OS. Dumbphones could do that back in 2004!

Evangelion01 said:
Nope. How would I go about doing that? Knowing Google, even if we were to inform them today there wouldn't be a fix for at least a month.
Still can't believe that after three years they haven't got a solution allowing you to passcode protect individual applications in the OS. Dumbphones could do that back in 2004!
Click to expand...
Click to collapse
should be here: http://support.google.com/wallet/bin/static.py?hl=en&page=known_issues.cs (click on "let us know") but it isn't working for me atm

Elganja said:
should be here: http://support.google.com/wallet/bin/static.py?hl=en&page=known_issues.cs (click on "let us know") but it isn't working for me atm
Click to expand...
Click to collapse
No surprise there, then. Thanks for the link. Hopefully they'll fix it by Q2.

MIUI had a sweet security app based on individual apps. I would lock down my games cause my boy liked to get in there and press buttons aka delete my saves.
I don't know what process it would involve to port this over. But it would be a welcome one.
Galaxy Nexus - 4.0.3 CM9
Asus Transformer - 3.2 Revolver

I went ahead and emailed the relevant Google deparment about the issue. I'll keep you all updated if I get a response, but bear in mind that this is Google's rubbish customer service that we're talking about... I'm not getting my hopes up.

If you lose your phone just log into your Gmail and change the password. Problem solved.

bp328i said:
If you lose your phone just log into your Gmail and change the password. Problem solved.
Click to expand...
Click to collapse
Yes, problem solved if you can get access to an internet-connected device quickly enough.

Evangelion01 said:
Yes, problem solved if you can get access to an internet-connected device quickly enough.
Click to expand...
Click to collapse
I guess I just don't see it as big of an issue as you do.
I mean if you lose your real wallet you have to track down the phone numbers to your credit card companies and call then all one by one. It would be easier and quicker in this day and age to find an internet-connected device.
All my friends and family have internet-connected devices (smart phones) so I could change my Gmail password faster than I could call one credit card company, get through their phone system, get a live person on the phone and cancel the card.
When it comes to money, credit cards or any thing being use as either of the two there will always be flaws that someone will try to exploit. And with this flaw it can be correct/stopped by the end user within 5 - 10 minutes.
But seriously good find on this!

bp328i said:
I guess I just don't see it as big of an issue as you do.
I mean if you lose your real wallet you have to track down the phone numbers to your credit card companies and call then all one by one. It would be easier and quicker in this day and age to find an internet-connected device.
All my friends and family have internet-connected devices (smart phones) so I could change my Gmail password faster than I could call one credit card company, get through their phone system, get a live person on the phone and cancel the card.
When it comes to money, credit cards or any thing being use as either of the two there will always be flaws that someone will try to exploit. And with this flaw it can be correct/stopped by the end user within 5 - 10 minutes.
But seriously good find on this!
Click to expand...
Click to collapse
That's true, I was trying to look at the worst case scenario. The flaw itself is pretty serious, but the consequences wouldn't be that great yet. I've only heard of one person who had over $100 on their prepaid card, and I think there are extra measures in place when purchasing larger items? Not sure.
But something as simple as this certainly needs to be fixed before NFC payments go mainstream.

Evangelion01 said:
That's true, I was trying to look at the worst case scenario. The flaw itself is pretty serious, but the consequences wouldn't be that great yet. I've only heard of one person who had over $100 on their prepaid card, and I think there are extra measures in place when purchasing larger items? Not sure.
But something as simple as this certainly needs to be fixed before NFC payments go mainstream.
Click to expand...
Click to collapse
I agree it is simple and does need to be fixed. They could make a quick fix by having each app that is based off our Gmail accounts require the Gmail password re-entered when an app is setup and not just ask permission.

[Q] Marketplace - can't buy apps any longer

I purchased 3 or 4 apps yesterday when I got my L900. Now, it won't let me buy. Says to check Zoon. Even ATT doesn't work.
Suggestions greatly appreciated!! Thanks

sloosley said:
I purchased 3 or 4 apps yesterday when I got my L900. Now, it won't let me buy. Says to check Zoon. Even ATT doesn't work.
Suggestions greatly appreciated!! Thanks
Click to expand...
Click to collapse
If you log into Zune, you should be able to go to purchase history and see if the download occured. Also, you can go to Windowsphone.com, click on your account and see the same downloads.
What you say about the AT&T section though indicates a potential problem. If the AT&T section and/or the Nokia section is missing from the marketplace, it indicates you may not be provisioned correctly. All Windows Phone users get Marketplace. Those special sections, called Storefronts, are available only to validated customers of that carrier, hardware or OEM. It may take a few hours for them to actually show up. If yours is not showing up, then it indicates a connection is not being correctly made. I'd call AT&T and validate your data connection is correctly set up. Been alot of that going on the last 4 days, but now that the phone is released to the public, we should see less of it occuring.
Good Luck

Ive got a problem with a CC that expired. They let me update my expiration date but not the stupid CCV code... DUH. So I ended up adding a different card.
Check https://billing.microsoft.com

hx4700 Killer said:
Ive got a problem with a CC that expired. They let me update my expiration date but not the stupid CCV code... DUH. So I ended up adding a different card.
Check https://billing.microsoft.com
Click to expand...
Click to collapse
Did you call billing...you should have been able to edit the credit card and validate it online.

I logged in to Zune and found my purchase history. However there aren't any registered devices. Do I need to sync the L900 with Zune on a computer? Could that be why I can't download/purchase new apps?
Thanks!

sloosley said:
I logged in to Zune and found my purchase history. However there aren't any registered devices. Do I need to sync the L900 with Zune on a computer? Could that be why I can't download/purchase new apps?
Thanks!
Click to expand...
Click to collapse
YOu don't need to sync, though it makes it easier to see. The results you're looking for are pulled off of your account with Microsoft. As long as your zune account and microsoft account are the same ID, there's no worries.
However, if you go to WindowsPhone.com and log in, this is the uber site. You will see your information here, and be able to see your device, and potentially reinstall most apps from this site.
Go to Microsoft.com/windowsphone. log in with your Windows Live ID on the right side. You'll see your registered name appear. Click here and choose account. You'll see lots of stuff.

Problem solved: As you suspected, the phone was not correctly commissioned. Called AT&T and worked through it. We're good now! Thanks again.

sloosley said:
Problem solved: As you suspected, the phone was not correctly commissioned. Called AT&T and worked through it. We're good now! Thanks again.
Click to expand...
Click to collapse
What are the odds NONE of the blog sites pick up this provisioning thing as a resolution? Apparently little bandito's are a better story.

I suffer the same'ish issue. I'm not able to purchase apps via Windowsphone.com but I can buy apps via Market Place on my phone.
Unfortunately the 1-800 number for Zune support has been disconnected. I have not been successful finding a way to call Microsoft billing support to update my ccv#.

Seed 2.0 said:
I suffer the same'ish issue. I'm not able to purchase apps via Windowsphone.com but I can buy apps via Market Place on my phone.
Unfortunately the 1-800 number for Zune support has been disconnected. I have not been successful finding a way to call Microsoft billing support to update my ccv#.
Click to expand...
Click to collapse
The 1-800 number was only for WP7 support....not mango and above..they've moved on.
I see your problem...the billing site for MS has removed the call options.
Try this.....chat support. I'm told they will call you back with billing issues.
https://support.live.com/default.aspx?productkey=oepwp7cf&brand=oepwp7&mkt=en-ww&
Let me know if this works or not...I have some friends in support....

I clicked a big THaNKs to you alodar1!!! Support cleared it up. If you go to xbox.com and visit your account there you can edit the CCV # of you credit card, or any other part of your card.

Seed 2.0 said:
I clicked a big THaNKs to you alodar1!!! Support cleared it up. If you go to xbox.com and visit your account there you can edit the CCV # of you credit card, or any other part of your card.
Click to expand...
Click to collapse
Using my best George Lopez voice..."..and that's how you learn!!"
---------- Post added at 02:22 PM ---------- Previous post was at 02:19 PM ----------
Seed 2.0 said:
I clicked a big THaNKs to you alodar1!!! Support cleared it up. If you go to xbox.com and visit your account there you can edit the CCV # of you credit card, or any other part of your card.
Click to expand...
Click to collapse
A side note though....this only works if you are also an xboxlive customer. If you are not, then this does not always work.
Apparently, Microsoft is still bringing all the variations of the Windows Live ID together....still not there yet.

Emails secure element

ive decided i would keep emailing the Google Wallet Support Team until they decide to fix the problem they have cause with are phones. the way i see it "Google Wallet" app has broken my phone(Secure Element) and i feel they should be fixing this problem.
From Google
Hi Luke,
Thank you for calling Google Wallet. It appears that your phone has experienced a rare hardware error with the Secure Element that makes it incompatible with the Google Wallet mobile app. We are currently working with our hardware partner to address this particular error and we apologize for the inconvenience this has caused you. If you wish to continue using Google Wallet, we recommend contacting your phone carrier or the retailer from whom you purchased your phone to learn more about your options to remedy the issue with your device’s Secure Element.
For more information about the Secure Element and security with the Google Wallet mobile app, please visit our help center at http://support.google.com/wallet/bin/answer.py?hl=en&topic=1350361&ctx=topic&answer=1350362
Thank you for your patience with this issue. We appreciate your help as we work to improve Google Wallet.
The Google Wallet mobile app requires an NFC-enabled Android phone and Secure Element chip. The phone must have an operating system of Gingerbread Android 2.3.7 at a minimum. To check if your Android phone is compatible with Google Wallet, please visit https://support.google.com/wallet/bin/answer.py?hl=en&answer=1347934&topic=1347912&ctx=topic
Currently, Google Wallet is only available in the United States.
We're continually working to expand Google Wallet to more devices, carriers and locations. If you’d like to be notified when Google Wallet is available on more devices, please visit http://www.google.com/wallet/get.html and click "Sign up for email updates" at the bottom of the page.
It was a pleasure assisting you today. Feel free to contact us again if you have any additional questions regarding Google Wallet or visit our Help Center at http://www.google.com/support/wallet
Sincerely,
Mark
The Google Wallet Team
Click to expand...
Click to collapse
From me
This is not a rare hardware issue as a lot of the android community have this problem. A factory reset or clearing the apps data in the setting app also causes this issue. This leads me to suspect that the app changes the files in the phone or lock your google account from using it with the phone. Not making it a hardware issue at all.
Like google music which wasn't released to out side of the US for a wile, but worked fine in the UK, this is the same with Google Wallet. When I buy a £500 phone that I am told I can use as a credit card I expect it to be enabled. I understand that only few places in the UK support this option, but I still don't want Google to limit this.
Please get back to us with a fix to this issue because a large amount of android community are very disappoint in Samsung and google due to this problem. Some first, and last, time android users.
when the error message appeared on the app I was told to contact google wallet support. One of your advisers then told me to contact the manufacture. Personally I agree with the apps advise about contacting your selfs as it was your app that broke my phone.
I went to your support forum and no contact number, help files to anything else was available to help me. Please change this as I had to spend time then searching through different forums on the subject for the contact number.
Sincerely
Luke Pring, LukeMovement Android (Market) App Developer
Click to expand...
Click to collapse
^^^Ended it like that so that he doesnt continue to talk down to me like im an idiot, with the adviser on the phone did so i hung up on him XD

lukemovement1 said:
^^^Ended it like that so that he doesnt continue to talk down to me like im an idiot, with the adviser on the phone did so i hung up on him XD
Click to expand...
Click to collapse
Haha clever, though you have some grammar mistakes which you should have probably addressed before sending thee message
Sent from my Galaxy Nexus using Tapatalk 2

Google Pay in-store payments not working with Mate 20 X Chinese version

Using the Chinese version in the USA generally with no problems. However, I'm trying to set-up in-store payments with Google Pay and I get a message that says "Added features couldn't be set up. To resolve this, you'll need to contact your bank. You can still pay with this card on Google and across other apps and sites, just like before."
- Contacted Google first. They said my bank needs to restore or reset token.
- Call the card (Chase). They have no idea what tokens are and tell me I need to set the card up with Google.
- Call Google. The lady tells me I need to reset other devices that have Google Pay. I reset both of them. No luck.
- Call the bank again. They tell me the same story.
I'm basically going in circles.
Has anyone experienced this? I also tried another card. My guess is there's some problem with this phone and Google Pay. I searched the internet but haven't really found anything. Can I get Google Pay in-store working on a Chinese Mate 20 X?

SmartPhonesFan said:
Unfortunately it won't work .. it doesn't work for us with Honor Note10 you need to have global version to get it working.. it will work only within ASIA-Pacific worlds region
Click to expand...
Click to collapse
Having this issue with my Chinese version Mate 20 Pro. Do you have a link to the source of this information?

ozv101 said:
Using the Chinese version in the USA generally with no problems. However, I'm trying to set-up in-store payments with Google Pay and I get a message that says "Added features couldn't be set up. To resolve this, you'll need to contact your bank. You can still pay with this card on Google and across other apps and sites, just like before."
- Contacted Google first. They said my bank needs to restore or reset token.
- Call the card (Chase). They have no idea what tokens are and tell me I need to set the card up with Google.
- Call Google. The lady tells me I need to reset other devices that have Google Pay. I reset both of them. No luck.
- Call the bank again. They tell me the same story.
I'm basically going in circles.
Has anyone experienced this? I also tried another card. My guess is there's some problem with this phone and Google Pay. I searched the internet but haven't really found anything. Can I get Google Pay in-store working on a Chinese Mate 20 X?
Click to expand...
Click to collapse
Check out the posts made by stestesteste on this subject. He reported using Google pay on his AL00 in the UK with Barclays debit card.

Bypassing Pixel 2 XL lock screen for deceased family member.

So as the title says, I have a family member who recently passed away over the weekend. The family is trying to access his phone for any pictures and videos of him with everyone. As of right now, we don't have any info about his Google account info. We're afraid to keep trying passwords in case it ends up wiping the data after a certain number of tries. I tried using Dr. Fone but the unlock software doesn't support this phone. Not sure what to do from here but I thought you guys might be able to help. Thanks, guys.

perhaps contact the local police to inquire if they have the capability to unlock the phone? They will probably require that you prove your relationship to the deceased which I don't think anyone on this forum could do. It's not that I don't believe you, but any creeper/theif/etc could say the same thing.
GL and sorry for your loss.

Sorry for your loss. If he had 2 step verification where you can send a text message to his cell phone #, you could do a Sim swap, pop the Sim in a phone that you have access to. Trigger the 2 step verification for forgot password and it might work.
Sent from my Pixel 2 XL using Tapatalk

I'm so sorry for your loss, and Hope you'd recover the content without much of a hassle.
Good Luck!

You can force a factory reset...that will delete apps and texts and any unsaved pics from texts will be deleted....BUT....it will not delete any pics taken by the cam and saved to the phone.
Good luck and sorry for your lost.

Was he logged into Gmail on a computer? Could possibly go to Google Photos and check for backed up photos and videos.
Sent from my Pixel 2 XL using Tapatalk

sorry for your loss, I hope you can recover the photos.
1st: was already mentioned. sim swap
2nd: Try to sign into their google account. If you know their gmail (you should be able to figure this out pretty easily) and know them pretty well you can probably guess their password especially if you can remember an "old" password they've used because people are creatures of habit and reuse the same or variations of the same passwords for years. Or you can do the "forgot password" option
3rd have the legal rep ask google.
Google lets third parties request the content from a deceased user's account, but this must be requested by the deceased person's legal representative. The legal representative must upload a copy of their government-issued ID and a copy of the death certificate. Even then, there's no guarantee the legal representative will gain access.
If this works, the legal representative would be able to access data from the deceased user's Drive, Gmail, Blogger, Google+, Google Photos, YouTube and other services. But again, if the deceased user didn't back up any photos in the first place, getting into the cloud backup won't do any good.
https://support.google.com/accounts/troubleshooter/6357590?hl=en#ts=6357650
4th: okay, this one is a little macabre and you said password but I have 2 methods to get into mine so I figure I'd say it......sigh.............somehow before the funeral 1) find a way to be alone with your relative and see if either of their index fingerprints will work to unlock the phone OR 2) I GUESS you COULD ask the funeral director to unlock their phone using their fingerprints but I'm not sure how agreeable they'd be on that one.. Look, I know it's creepy but if the photos/vids are important then......sigh.....damn it sounds even more eff'd up reading it than it did in my head. Okay, sorry, I'll stop now....
good luck

First of all, I'm sorry for your loss...
I have some inquiries, and then a suggestion...
First, do you know if the former owner had "unlocked" or "rooted" the phone/device? When you turn the device on, is there a warning in the powering up process that "warns" about having an "unlocked bootloader"?
If it is unlocked and/or rooted, there are more/further options that can be done, but only if it is in this "state"...
And as for my suggestion...
You might be aware of how Apple and iPhones/iPads have a sort of "find my iphone" or "find my device" type of connection and protocol on their devices... I've personally used the "Android"/Google version (called Android Device Manager [or ADM for short]) of this to find the last location of my phone and to also ring it. But I have also noticed that they (Google) are constantly evolving it and later added a "lock" option. So, taking it a step further, I checked if there was possibly an "unlock" option; and there is! Again, I personally have never used it and do not know much about it. After some cursory reading, there are certain criteria that has to have been met while the original owner was using the phone; but if, by some amazing circumstance or miracle, things have been set up properly (and you know the deceased google account information/login), there's a good chance you might be able to get the phone unlocked. You can find the information all about this here: https://one.comodo.com/blog/itsm/unlock-your-android-device-using-android-device-manager.php
One additional thought I just thought of while writing this, along the lines of talking to Google and explaining the situation, even if you don't have the google account information/login, you might be able to obtain that information from them if the situation is explained and they have protocols for this type of situation.
Again, I'm sorry for your loss, and I hope this helps. Good luck to you...