4 ms·
My best guess is that the NFC chip is locked for security and that it's highly linked to the secure enclave. Maybe it's discussed in the iOS Security document?
by tjl 10y ago
My best guess is that the NFC chip is locked for security and that it's highly linked to the secure enclave. Maybe it's discussed in the iOS Security document? I haven't checked.
Apple has a habit of introducing something very locked down and slowly adding features and opening up. We've been seeing this particularly in extensions recently and we've finally got some Siri support, if only in specific domains.
- c0g 10y agoThat's what apple claims[1]: "Providing simple access to the NFC antenna by banking applications would fundamentally diminish the high level of security Apple aims to have on our devices" [1] http://fortune.com/2016/08/11/apple-pay-tech-banks-security/ http://fortune.com/2016/08/11/apple-pay-tech-banks-security/
- the_mitsuhiko 10y agoI do not understand what the attack vector here would be. Can someone elaborate?
- MBCook 10y agoYou could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID. Or (and this seems REALLY probable) people make apps to 'help' you pay or track you spending and pay/etc. But they now have very sensitive banking data so that's insecure. How about CurrenC or Walmart or some other company makes their own NFC payment thing on a different standard that isn't compatible with standard terminals. Now anyone who uses that new payment system is vulnerable to any bugs in that implementation as opposed to a very well tested system like the current NFC stuff (which I'm sure has shortcomings, but at least is well understood).
- the_mitsuhiko 10y ago> You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID. So? You can already do that. You can put an NFC shell around your phone which connects with bluetooth and that is being done already. You can touch an Android phone or anything else. Same story.
- MBCook 10y agoYou can't do that because you have to buy extra hardware. All of a sudden everything you need would be built in. That makes it WAY more practical of an attack. All of a sudden ANY phone can be used.