3 ms·

Can I clone my credit cards onto my flipper zero? Or is Amazon hallucinating features that don't exist?

lolinder 4y ago
They're probably using a generous interpretation of card skimmer to ban a device that is in a category they didn't think to explicitly ban before.
kweks 4y ago
The Flipper can read the PAN (card digits + expiry) that are exposed by cards that have "tap to pay". This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...) This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards. The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
- xur17 4y ago
  I thought tap to pay used a one time code? Or are you saying tap to pay uses the PAN + a one time code?
  - kweks 4y ago
    There are two different interfaces. One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/ https://www.apkmonk.com/app/com.github.devnied.emvnfccard/) The EMV / payment interface is a different interface and fully encrypted.
    - xur17 4y ago
      And all cards support both??
- stametseater 4y ago
  I used to think my RF shielded wallet is a silly gimmick, but now I'm not so sure.
  - kayge 4y ago
    Not a gimmick, but also not perfect. Probably better than nothing :) Good quick explanation by Deviant Ollam at around 7:30 in this video: https://www.youtube.com/watch?v=Qt2Gn2CoJ74 https://www.youtube.com/watch?v=Qt2Gn2CoJ74
- Casteil 4y ago
  It's mind boggling how they just decided to throw basically any semblance of security completely out the window by putting NFC on credit cards for convenience.
matthavener 4y ago
Flipper has no mechanism to read a magstripe, so no, I don't think so. But it's possible to clone all kinds of other things. I cloned my SO's old building key (Mifare 1k classic) so she wouldn't need to "buzz" me up.
- xxpor 4y ago
  It does have enough GPIOs that you could probably hook a magstrip reader up though. But you could also do that with a $5 ESP32 dev board.

They're probably using a generous interpretation of card skimmer to ban a device that is in a category they didn't think to explicitly ban before.

kweks 4y ago

The Flipper can read the PAN (card digits + expiry) that are exposed by cards that have "tap to pay". This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...) This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards. The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.

xur17 4y ago
I thought tap to pay used a one time code? Or are you saying tap to pay uses the PAN + a one time code?
- kweks 4y ago
  There are two different interfaces. One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/ https://www.apkmonk.com/app/com.github.devnied.emvnfccard/) The EMV / payment interface is a different interface and fully encrypted.
  - xur17 4y ago
    And all cards support both??
stametseater 4y ago
I used to think my RF shielded wallet is a silly gimmick, but now I'm not so sure.
- kayge 4y ago
  Not a gimmick, but also not perfect. Probably better than nothing :) Good quick explanation by Deviant Ollam at around 7:30 in this video: https://www.youtube.com/watch?v=Qt2Gn2CoJ74 https://www.youtube.com/watch?v=Qt2Gn2CoJ74
Casteil 4y ago
It's mind boggling how they just decided to throw basically any semblance of security completely out the window by putting NFC on credit cards for convenience.

matthavener 4y ago

Flipper has no mechanism to read a magstripe, so no, I don't think so. But it's possible to clone all kinds of other things. I cloned my SO's old building key (Mifare 1k classic) so she wouldn't need to "buzz" me up.

xxpor 4y ago
It does have enough GPIOs that you could probably hook a magstrip reader up though. But you could also do that with a $5 ESP32 dev board.