10 ms·

Using your Apple device as an access card in unsupported systems

237 points by ValentineC 2y ago

agos 2y ago
this is cool but the limitations make it almost unusable
- pockmarked19 2y ago
  Seriously. Better to tape something to your phone at that point!
sgt 2y ago
Would be cool to get into the office like this. We have RFID tags.
akersten 2y ago
I was really excited about the new UniFi G3 access card reader claiming support for iPhone unlock until I realized it's $5/year/device. It just seems like a slow boil into subscriptions for a company whose entire value prop is prosumer networking without the contracts. I don't know if it's Apple or UniFi to blame for this fee, but it turned me off entirely of what would have been a day 1 purchase. Other, cheaper junky IoT home locks support Apple HomeKit for unlocking for free, why can't UniFi figure it out? Really glad to see hacking in this space.
- ShakataGaNai 2y ago
  It's SSO tax applied to hardware devices. But at the same time, it's clearly a more premium feature and if you're a business you've got the $5000/year to pay for 1000 devices. $5/device/year is not exactly expensive. Heck, I'd pay Ubiquiti $15/year for my family to be able to use it at home. That's less than I pay for almost any subscription for anything.
  - eastbound 2y ago
    $5/year… this year. They will add a “No SOC2 compliance, please upgrade to our $19pm solution and benefit from 10% if you subscribe annually”.
    - WanderPanda 2y ago
      It’s sad that we have to assume this is the agenda for all offerings that don’t allow paying current price x years in advance (possibly including adjustion for expected inflation). Leaves a very sour taste, especially in the case of hardware devices
    - dymk 2y ago
      Then you can stop using it, and you're no worse off than before when the choice wasn't even available.
- kormax 2y ago
  Hi, I'm the author behind the article referenced in this post. As far as I know, Ubiquiti is not responsible for this 5$ per year "tax". Apple takes about 3$ per user per year for usage of "Apple Access Platform", and the rest is spent for licensing the credential technology, like to NXP for Mifare DESFire in this case.
  - kormax 2y ago
    They could not implement "Home Key", because Apple requires that compatible devices are implemented as a single unit, containing reader + lock. This limitation was added precisely as to prevent HomeKey from cannibalizing that sweet recurring revenue from "Apple Access Platform" targeted at business customers, as companies want detached readers which can be hooked into existing PACS architectures. There was a device which did not follow that rule - the Aqara U200 but it seems like they had spent a lot of time arguing with Apple to get approval, as there were multiple occasions where they promised HomeKey (thus generating lots of hype and pressure), and then came back on that promise. Although they delivered on it in the end, good for them.
  - ValentineC 2y ago
    This is amazing. :) Small world! I was testing my new Hikvision keypad against every card I have and wondering if I could use Apple Express Transit, when I stumbled upon your writeup. Looking forward to trying out a T-Union card later!
- deleted 2y ago
  [deleted]
- jtbayly 2y ago
  What I can’t figure out is why the old readers, which clearly read NFC cards, can’t work to read iPhones, which emit NFC. I understood in the past that iPhones weren’t supported because of the limitations described in the article. I figured once Apple opened up the system and Ubiquiti actually implemented it (both of which have now happened) that the old readers would work. Although irritating, I’d consider paying $5/user/year, but I’m not about to rip out 6 card readers that I just installed.
  - kormax 2y ago
    The reason why only the G3 supports Apple Wallet is exactly because of the NFC chip. Otherwise, they are completely the same hardware, and mostly the same software. Thing is, the PN7160 chip used in G2 does not support Apple's proprietary extension to the NFC standard, called Apple Enhanced Contactless Polling [1], so they had to replace it with the PN7161 version, which is a special SKU created by NXP in collaboration with Apple. ECP modifies the lower levels of the NFC stack, which "NFC Controller" chips do not always give the host full control over, as they abstract away the protocol implementation for use in non realtime systems. Hence the need to replace the chip. Funnily enough, PN7160 and PN7161 is exactly the same hardware with exactly the same firmware. NXP just 'fused' some extra data into *1 model so that it does not ignore the special configuration command to enable ECP. The extra SKU exists only because of licensing, and could have been a firmware update instead. Theoretically, as ECP is really only needed for the automatic selection & use of a card, and it does not affect the upper protocol layers, UI could have brought support for Wallet credentials to older readers, just without the "express mode", but Apple specifically prohibits the use of their cards with any non-certified and non-ecp readers. [1] https://github.com/kormax/apple-enhanced-contactless-polling https://github.com/kormax/apple-enhanced-contactless-polling
    - jtbayly 2y ago
      Thank you for the detailed answer!
- mschuster91 2y ago
  > It just seems like a slow boil into subscriptions for a company whose entire value prop is prosumer networking without the contracts. On the other side... look at the status quo in access control systems. If you never did, be happy you never had to because the status quo is shit because the entire ecosystem is suffering from a severe lack of money - for physical locks, most people buy the cheapest shit they can get at Home Depot or whatnot, and for "fancy" stuff involving smartphones they do just the same, or order right from Alibaba. And that is a damn horror show. Ubiquiti, for all I dislike the trend for recurring revenue everywhere, at least makes high quality and secure stuff - but with anything interconnected, keeping updates available costs recurring expenses. So it's either "the product is cheap ass and will likely have multiple bypasses in a year or two", "the product is extremely expensive but you will get updates for a reasonable time" or "the product is affordable, but costs recurring money".
  - lxgr 2y ago
    Definitely, but it really irks me that part of that money goes to Apple for... what exactly? I already paid for my iPhone! Why should my apartment building/employer/... have to pay a yearly fee to allow me to enter a building using it?
    - mschuster91 2y ago
      For Apple, the same thing applies. Keeping an entire zoo of operating systems safe from malicious entities requires serious work that needs to be funded somehow.
ShakataGaNai 2y ago
This is cool, do love the hacking ingenuity. And not that I want to give Apple extra credit, but they are slowly opening up NFC: https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ - Is is very restrictive (probably) and very late - most certainly. But at least it's slowly coming.
- talldayo 2y ago
  The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. You'd think that it was common sense to avoid that, but we are talking about the company that invented DRM for the USB protocol...
  - moritzwarhier 2y ago
    It's understandable in the context of Apple Pay I think.
    - int0x29 2y ago
      Google pay coexists with an open NFC API on the same devices and has since before IOS had NFC support
      - moritzwarhier 2y ago
        Point taken
      - ValentineC 2y ago
        Google's implementation is also more janky, with phones needing a data connection and having to go online to download new tokens(?) every 3 transactions or so.
        lxgr 2y ago
        Nothing prevents Apple from running HCE (which is what Android offers all app developers) in parallel with SE-based cards (which are generally more offline-capable). In fact, Android has supported just that for years.
withinboredom 2y ago
Does this work with ANY card set as the transit card in iOS? Or just this one type of transit card?
- noja 2y ago
  Your question is answered in the article.
  - withinboredom 2y ago
    I'm not sure that it is. It goes to great lengths to explain how to get this particular card + says 'any transit card' in so many words. It doesn't seem explicit.
    - mbilker 2y ago
      Yes, it does explain it. What makes this card powerful, lies in the way it changes how NFC behaves on your device when it's set as a default transit card: Your device stops randomizing the UID on each tap; Your device begins responding to all NFC readers as if they were express-transit enabled, just like on Android; Also this card does not change its serial number and UID when moving to other devices, unlike most other ones. https://github.com/kormax/apple-device-as-access-card?tab=readme-ov-file#the-solution https://github.com/kormax/apple-device-as-access-card?tab=re...
      - dymk 2y ago
        That's explaining some specific technical properties of how this particular NFC card works, it not explaining what the implications of that are.
        mbilker 2y ago
        It's explaining what sets this NFC card applet apart from others on iOS and why it is ideal for use in a UID-based access control system.
rubatuga 2y ago
Or ... maybe we should take a step back and stop trying to shove everything into phones - like drivers license or all forms of payment.
- deleted 2y ago
  [deleted]
- CrimsonRain 2y ago
  Just because you like you walk with 1000 things in your pocket doesn't mean everyone else likes it too. Stop being a luddite.
  - rubatuga 2y ago
    Can't tell if this is sarcasm or not.
  - throwaway290 2y ago
    Unless you are homeless why you need so many things on you all the time? But even if yes, it's much less dangerous to lose 1 out of 1000 instead of losing one phone and poof all 1000 are gone and you are stuck asking random people a phone to call your relatives for help
jtbayly 2y ago
I’m curious what the security of these NFC lock systems looks like. (I’m talking about the commercial building systems mentioned like Brivo and Unifi, not home systems.) In particular, I know unifi cards rotate keys. So you can’t simply clone them with a Flipper, and this also means third party cards don’t work. By default, this is true, but you can’t simply clone turn it off, as mentioned in the article. Does this mean that the other systems’ cards are easily cloned? This seems very insecure, if so.
- hmottestad 2y ago
  They specifically write that this only supports UID based authentication. So, the card answers with the same unique ID every time. UniFi has support for this, but seemingly not by default. This solution also doesn’t allow you to clone an existing card. You actually need the admins to add the UID of your Chinese transport card to their system.
- avianlyric 2y ago
  > Does this mean that the other systems’ cards are easily cloned? This seems very insecure, if so. Broadly, yes, almost all NFC based access systems are insecure and pretty broken. They mostly operate via security via obscurity, and the fact that anyone serious about security that deploys these systems will put a huge amount of effort into identifying one of an actually secure systems. More likely they will pair the NFC element with multiple other secure elements, such as photo badges, big security humans that demand people keep their badges visible, and card + pin entry on all important access points. A big part of the reason why these Apple Wallet systems have taken so long to appear is because Apple seems to refuse to integrate with any system that isn’t built using secure cryptography. Turns out there aren’t many systems out there that use strong cryptography, rather than cryptographic systems that have been broken for decades. Actually getting information on how any particular system actually provides its “security” is extremely difficult. Mostly you have to figure it out by being familiar with the different systems out there, and different NFC systems. Then it’s possible to parse the marketing terms into actual technical specifications that might give a hint at how a system works. The only sure fire way to find out, is to buy parts of the system (such as access tokens or readers), and evaluate the hardware using various NFC and RFID hacking tools to figure what manner of awful design this particular system uses.
data_ders 2y ago
Love seeing the Xiamen City Metro card! Would recognize the scenery from anywhere
Havoc 2y ago
I wonder why the Chinese transit card uses an unsecure method. Sounds like that is a lone outlier case so presumably intentional for some reason?
- atonse 2y ago
  Given the UID is the same every time, I can assume it’s to make surveillance easier?
  - simondotau 2y ago
    A more secure card doesn't make surveillance any harder. If anything, it's the opposite. An easily copyable UID makes bad data more plausible. Bad data makes surveillance harder.
    - lxgr 2y ago
      The fact that license plates can quite easily be forged by anyone willing to put some effort into it doesn't make them not uniquely capable of tracking where you go in your car.
      - simondotau 2y ago
        I don't disagree with that at all. I never said that insecure unique identifiers weren't useful for tracking. What I said is that a cryptographically system is superior to an insecure system for the purposes of surveillance, because the ability to track is the same, and the quality of data is higher. From this I concluded that surveillance doesn't make sense as a motive for this particular transit market sticking with an older, insecure system. Your analogy is poor for at least two reasons: 1. Transit cards are generally hidden inside a pocket and can only be read when read by specific machines in close proximity. Whereas number plates are designed to be on display and readable by human eyes from medium distances, or from publicly (or privately) owned cameras over long distances. 2. Your unspoken but implied alternative to the highly trackable number plate is no number plate. Whereas this discussion is discussing a cryptographically insecure transit card as an alternative to a cryptographically secure transit card.
amyames 2y ago
Oh and I only have to give my identity to Alipay and Chinese transit? And modify my phone so it consistently beacons out a trackable ID?
- londons_explore 2y ago
  It isn't beaconing out a trackable ID unless one manages to get into NFC range, which isn't gonna be read from miles away
  - yencabulator 2y ago
    10 meters is plenty to covertly track you entering/leaving a building. > The distance from which an attacker is able to eavesdrop the RF signal depends on multiple parameters, but is typically less than 10 meters. https://en.wikipedia.org/wiki/Near-field_communication https://en.wikipedia.org/wiki/Near-field_communication
    - lxgr 2y ago
      Eavesdrop, but not initiate a transaction. I definitely wouldn't want to be in the same room as an active ISO 14443 antenna capable of powering up even low-powered tags/cards from 10 meters. That would be a lot of power! That said, Apple devices use an active amplifier even in card emulation mode (which is why Apple Pay works considerably more reliably at awkward angles than Google Pay does on most Android phones).
- lxgr 2y ago
  Yes, but let's be clear: You have Apple to thank for it. Android has supported HCE-based card emulation and provided access to any app developer out there for a decade now. No special entitlement, certification, or licensing fee required.
  - behnamoh 2y ago
    > Android has supported HCE-based card emulation and provided access to any app developer out there for a decade now. No special entitlement, certification, or licensing fee required. but Apple doesn't do it for "privacy and security" reasons (read: they want iron grip on their closed ecosystem).
cluckindan 2y ago
> 1. Install the AliPay app > 2. Register inside the AliPay app How about no.
- lxgr 2y ago
  That's obviously your choice, but if that frustrates you, make sure to ask Apple why they're making anything else so complicated.
  - sureIy 2y ago
    Luckily the EU and Apple already reached an agreement for this, however it seems to be limited to payments only: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3706 https://ec.europa.eu/commission/presscorner/detail/en/ip_24_... > To address the Commission's competition concerns, Apple initially offered the following commitments: > - To allow third-party wallet providers access to the NFC input on iOS devices free of charge EU only of course. I'd be interested in seeing the EU overstep a bit and force Apple to apply EU rules worldwide, either "on all devices" or "on all devices sold in the EU, even while traveling."
chuanliang 2y ago
there's not technology problem, just because Apple grant NFC privilege to Alipay and local partner in China
- lxgr 2y ago
  I don't think Alipay actually has any direct NFC access, does it? They can provision these transit cards into Apple Wallet, but that's not the same thing as NFC access at all. The transit provider would have had to integrate with Apple, though, to get their card application loaded onto the iPhone's secure element.
dcrazy 2y ago
Note that this article is 2 years old, and therefore predates iOS 18.1, which allows applications to directly access the NFC hardware: https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/
- bluemoola 2y ago
  Has there been an emulation solution made for Mifare Classic since this direct access?
- solarkraft 2y ago
  > developers who want to build secure contactless experiences into their iOS apps using these APIs will need to enter into an agreement with Apple and request the NFC & SE Platform Entitlement Classic Apple.
rsanek 2y ago
should have a (2023) tag based on commits
jonasmalaco 2y ago
That information could come in handy, cool. A complementary method is to attach a writable NFC sticker tag to the phone. Though it has to be placed far enough from the phone's NFC antenna in order for both/either to work. The upside is that you get a second tag of your choice (physically) on your phone. There are even UID-writable sticker tags out there (even if they can be a tiny bit harder to find). You also don't need to replace your default transit card, which could be inconvenient depending on where you live.

237 points by ValentineC 2y ago

agos 2y ago

this is cool but the limitations make it almost unusable

pockmarked19 2y ago
Seriously. Better to tape something to your phone at that point!

sgt 2y ago

Would be cool to get into the office like this. We have RFID tags.

akersten 2y ago

I was really excited about the new UniFi G3 access card reader claiming support for iPhone unlock until I realized it's $5/year/device. It just seems like a slow boil into subscriptions for a company whose entire value prop is prosumer networking without the contracts. I don't know if it's Apple or UniFi to blame for this fee, but it turned me off entirely of what would have been a day 1 purchase. Other, cheaper junky IoT home locks support Apple HomeKit for unlocking for free, why can't UniFi figure it out? Really glad to see hacking in this space.

ShakataGaNai 2y ago
It's SSO tax applied to hardware devices. But at the same time, it's clearly a more premium feature and if you're a business you've got the $5000/year to pay for 1000 devices. $5/device/year is not exactly expensive. Heck, I'd pay Ubiquiti $15/year for my family to be able to use it at home. That's less than I pay for almost any subscription for anything.
- eastbound 2y ago
  $5/year… this year. They will add a “No SOC2 compliance, please upgrade to our $19pm solution and benefit from 10% if you subscribe annually”.
  - WanderPanda 2y ago
    It’s sad that we have to assume this is the agenda for all offerings that don’t allow paying current price x years in advance (possibly including adjustion for expected inflation). Leaves a very sour taste, especially in the case of hardware devices
  - dymk 2y ago
    Then you can stop using it, and you're no worse off than before when the choice wasn't even available.
kormax 2y ago
Hi, I'm the author behind the article referenced in this post. As far as I know, Ubiquiti is not responsible for this 5$ per year "tax". Apple takes about 3$ per user per year for usage of "Apple Access Platform", and the rest is spent for licensing the credential technology, like to NXP for Mifare DESFire in this case.
- kormax 2y ago
  They could not implement "Home Key", because Apple requires that compatible devices are implemented as a single unit, containing reader + lock. This limitation was added precisely as to prevent HomeKey from cannibalizing that sweet recurring revenue from "Apple Access Platform" targeted at business customers, as companies want detached readers which can be hooked into existing PACS architectures. There was a device which did not follow that rule - the Aqara U200 but it seems like they had spent a lot of time arguing with Apple to get approval, as there were multiple occasions where they promised HomeKey (thus generating lots of hype and pressure), and then came back on that promise. Although they delivered on it in the end, good for them.
- ValentineC 2y ago
  This is amazing. :) Small world! I was testing my new Hikvision keypad against every card I have and wondering if I could use Apple Express Transit, when I stumbled upon your writeup. Looking forward to trying out a T-Union card later!
deleted 2y ago
[deleted]
jtbayly 2y ago
What I can’t figure out is why the old readers, which clearly read NFC cards, can’t work to read iPhones, which emit NFC. I understood in the past that iPhones weren’t supported because of the limitations described in the article. I figured once Apple opened up the system and Ubiquiti actually implemented it (both of which have now happened) that the old readers would work. Although irritating, I’d consider paying $5/user/year, but I’m not about to rip out 6 card readers that I just installed.
- kormax 2y ago
  The reason why only the G3 supports Apple Wallet is exactly because of the NFC chip. Otherwise, they are completely the same hardware, and mostly the same software. Thing is, the PN7160 chip used in G2 does not support Apple's proprietary extension to the NFC standard, called Apple Enhanced Contactless Polling [1], so they had to replace it with the PN7161 version, which is a special SKU created by NXP in collaboration with Apple. ECP modifies the lower levels of the NFC stack, which "NFC Controller" chips do not always give the host full control over, as they abstract away the protocol implementation for use in non realtime systems. Hence the need to replace the chip. Funnily enough, PN7160 and PN7161 is exactly the same hardware with exactly the same firmware. NXP just 'fused' some extra data into *1 model so that it does not ignore the special configuration command to enable ECP. The extra SKU exists only because of licensing, and could have been a firmware update instead. Theoretically, as ECP is really only needed for the automatic selection & use of a card, and it does not affect the upper protocol layers, UI could have brought support for Wallet credentials to older readers, just without the "express mode", but Apple specifically prohibits the use of their cards with any non-certified and non-ecp readers. [1] https://github.com/kormax/apple-enhanced-contactless-polling https://github.com/kormax/apple-enhanced-contactless-polling
  - jtbayly 2y ago
    Thank you for the detailed answer!
mschuster91 2y ago
> It just seems like a slow boil into subscriptions for a company whose entire value prop is prosumer networking without the contracts. On the other side... look at the status quo in access control systems. If you never did, be happy you never had to because the status quo is shit because the entire ecosystem is suffering from a severe lack of money - for physical locks, most people buy the cheapest shit they can get at Home Depot or whatnot, and for "fancy" stuff involving smartphones they do just the same, or order right from Alibaba. And that is a damn horror show. Ubiquiti, for all I dislike the trend for recurring revenue everywhere, at least makes high quality and secure stuff - but with anything interconnected, keeping updates available costs recurring expenses. So it's either "the product is cheap ass and will likely have multiple bypasses in a year or two", "the product is extremely expensive but you will get updates for a reasonable time" or "the product is affordable, but costs recurring money".
- lxgr 2y ago
  Definitely, but it really irks me that part of that money goes to Apple for... what exactly? I already paid for my iPhone! Why should my apartment building/employer/... have to pay a yearly fee to allow me to enter a building using it?
  - mschuster91 2y ago
    For Apple, the same thing applies. Keeping an entire zoo of operating systems safe from malicious entities requires serious work that needs to be funded somehow.

ShakataGaNai 2y ago

This is cool, do love the hacking ingenuity. And not that I want to give Apple extra credit, but they are slowly opening up NFC: https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ - Is is very restrictive (probably) and very late - most certainly. But at least it's slowly coming.

talldayo 2y ago
The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. You'd think that it was common sense to avoid that, but we are talking about the company that invented DRM for the USB protocol...
- moritzwarhier 2y ago
  It's understandable in the context of Apple Pay I think.
  - int0x29 2y ago
    Google pay coexists with an open NFC API on the same devices and has since before IOS had NFC support
    - moritzwarhier 2y ago
      Point taken
    - ValentineC 2y ago
      Google's implementation is also more janky, with phones needing a data connection and having to go online to download new tokens(?) every 3 transactions or so.
      - lxgr 2y ago
        Nothing prevents Apple from running HCE (which is what Android offers all app developers) in parallel with SE-based cards (which are generally more offline-capable). In fact, Android has supported just that for years.

withinboredom 2y ago

Does this work with ANY card set as the transit card in iOS? Or just this one type of transit card?

noja 2y ago
Your question is answered in the article.
- withinboredom 2y ago
  I'm not sure that it is. It goes to great lengths to explain how to get this particular card + says 'any transit card' in so many words. It doesn't seem explicit.
  - mbilker 2y ago
    Yes, it does explain it. What makes this card powerful, lies in the way it changes how NFC behaves on your device when it's set as a default transit card: Your device stops randomizing the UID on each tap; Your device begins responding to all NFC readers as if they were express-transit enabled, just like on Android; Also this card does not change its serial number and UID when moving to other devices, unlike most other ones. https://github.com/kormax/apple-device-as-access-card?tab=readme-ov-file#the-solution https://github.com/kormax/apple-device-as-access-card?tab=re...
    - dymk 2y ago
      That's explaining some specific technical properties of how this particular NFC card works, it not explaining what the implications of that are.
      - mbilker 2y ago
        It's explaining what sets this NFC card applet apart from others on iOS and why it is ideal for use in a UID-based access control system.

rubatuga 2y ago

Or ... maybe we should take a step back and stop trying to shove everything into phones - like drivers license or all forms of payment.

deleted 2y ago
[deleted]
CrimsonRain 2y ago
Just because you like you walk with 1000 things in your pocket doesn't mean everyone else likes it too. Stop being a luddite.
- rubatuga 2y ago
  Can't tell if this is sarcasm or not.
- throwaway290 2y ago
  Unless you are homeless why you need so many things on you all the time? But even if yes, it's much less dangerous to lose 1 out of 1000 instead of losing one phone and poof all 1000 are gone and you are stuck asking random people a phone to call your relatives for help

jtbayly 2y ago

I’m curious what the security of these NFC lock systems looks like. (I’m talking about the commercial building systems mentioned like Brivo and Unifi, not home systems.) In particular, I know unifi cards rotate keys. So you can’t simply clone them with a Flipper, and this also means third party cards don’t work. By default, this is true, but you can’t simply clone turn it off, as mentioned in the article. Does this mean that the other systems’ cards are easily cloned? This seems very insecure, if so.

hmottestad 2y ago
They specifically write that this only supports UID based authentication. So, the card answers with the same unique ID every time. UniFi has support for this, but seemingly not by default. This solution also doesn’t allow you to clone an existing card. You actually need the admins to add the UID of your Chinese transport card to their system.
avianlyric 2y ago
> Does this mean that the other systems’ cards are easily cloned? This seems very insecure, if so. Broadly, yes, almost all NFC based access systems are insecure and pretty broken. They mostly operate via security via obscurity, and the fact that anyone serious about security that deploys these systems will put a huge amount of effort into identifying one of an actually secure systems. More likely they will pair the NFC element with multiple other secure elements, such as photo badges, big security humans that demand people keep their badges visible, and card + pin entry on all important access points. A big part of the reason why these Apple Wallet systems have taken so long to appear is because Apple seems to refuse to integrate with any system that isn’t built using secure cryptography. Turns out there aren’t many systems out there that use strong cryptography, rather than cryptographic systems that have been broken for decades. Actually getting information on how any particular system actually provides its “security” is extremely difficult. Mostly you have to figure it out by being familiar with the different systems out there, and different NFC systems. Then it’s possible to parse the marketing terms into actual technical specifications that might give a hint at how a system works. The only sure fire way to find out, is to buy parts of the system (such as access tokens or readers), and evaluate the hardware using various NFC and RFID hacking tools to figure what manner of awful design this particular system uses.

data_ders 2y ago

Love seeing the Xiamen City Metro card! Would recognize the scenery from anywhere

Havoc 2y ago

I wonder why the Chinese transit card uses an unsecure method. Sounds like that is a lone outlier case so presumably intentional for some reason?

atonse 2y ago
Given the UID is the same every time, I can assume it’s to make surveillance easier?
- simondotau 2y ago
  A more secure card doesn't make surveillance any harder. If anything, it's the opposite. An easily copyable UID makes bad data more plausible. Bad data makes surveillance harder.
  - lxgr 2y ago
    The fact that license plates can quite easily be forged by anyone willing to put some effort into it doesn't make them not uniquely capable of tracking where you go in your car.
    - simondotau 2y ago
      I don't disagree with that at all. I never said that insecure unique identifiers weren't useful for tracking. What I said is that a cryptographically system is superior to an insecure system for the purposes of surveillance, because the ability to track is the same, and the quality of data is higher. From this I concluded that surveillance doesn't make sense as a motive for this particular transit market sticking with an older, insecure system. Your analogy is poor for at least two reasons: 1. Transit cards are generally hidden inside a pocket and can only be read when read by specific machines in close proximity. Whereas number plates are designed to be on display and readable by human eyes from medium distances, or from publicly (or privately) owned cameras over long distances. 2. Your unspoken but implied alternative to the highly trackable number plate is no number plate. Whereas this discussion is discussing a cryptographically insecure transit card as an alternative to a cryptographically secure transit card.

amyames 2y ago

Oh and I only have to give my identity to Alipay and Chinese transit? And modify my phone so it consistently beacons out a trackable ID?

londons_explore 2y ago
It isn't beaconing out a trackable ID unless one manages to get into NFC range, which isn't gonna be read from miles away
- yencabulator 2y ago
  10 meters is plenty to covertly track you entering/leaving a building. > The distance from which an attacker is able to eavesdrop the RF signal depends on multiple parameters, but is typically less than 10 meters. https://en.wikipedia.org/wiki/Near-field_communication https://en.wikipedia.org/wiki/Near-field_communication
  - lxgr 2y ago
    Eavesdrop, but not initiate a transaction. I definitely wouldn't want to be in the same room as an active ISO 14443 antenna capable of powering up even low-powered tags/cards from 10 meters. That would be a lot of power! That said, Apple devices use an active amplifier even in card emulation mode (which is why Apple Pay works considerably more reliably at awkward angles than Google Pay does on most Android phones).
lxgr 2y ago
Yes, but let's be clear: You have Apple to thank for it. Android has supported HCE-based card emulation and provided access to any app developer out there for a decade now. No special entitlement, certification, or licensing fee required.
- behnamoh 2y ago
  > Android has supported HCE-based card emulation and provided access to any app developer out there for a decade now. No special entitlement, certification, or licensing fee required. but Apple doesn't do it for "privacy and security" reasons (read: they want iron grip on their closed ecosystem).

cluckindan 2y ago

> 1. Install the AliPay app > 2. Register inside the AliPay app How about no.

lxgr 2y ago
That's obviously your choice, but if that frustrates you, make sure to ask Apple why they're making anything else so complicated.
- sureIy 2y ago
  Luckily the EU and Apple already reached an agreement for this, however it seems to be limited to payments only: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3706 https://ec.europa.eu/commission/presscorner/detail/en/ip_24_... > To address the Commission's competition concerns, Apple initially offered the following commitments: > - To allow third-party wallet providers access to the NFC input on iOS devices free of charge EU only of course. I'd be interested in seeing the EU overstep a bit and force Apple to apply EU rules worldwide, either "on all devices" or "on all devices sold in the EU, even while traveling."

chuanliang 2y ago

there's not technology problem, just because Apple grant NFC privilege to Alipay and local partner in China

lxgr 2y ago
I don't think Alipay actually has any direct NFC access, does it? They can provision these transit cards into Apple Wallet, but that's not the same thing as NFC access at all. The transit provider would have had to integrate with Apple, though, to get their card application loaded onto the iPhone's secure element.

dcrazy 2y ago

Note that this article is 2 years old, and therefore predates iOS 18.1, which allows applications to directly access the NFC hardware: https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/

bluemoola 2y ago
Has there been an emulation solution made for Mifare Classic since this direct access?
solarkraft 2y ago
> developers who want to build secure contactless experiences into their iOS apps using these APIs will need to enter into an agreement with Apple and request the NFC & SE Platform Entitlement Classic Apple.

rsanek 2y ago

should have a (2023) tag based on commits

jonasmalaco 2y ago

That information could come in handy, cool. A complementary method is to attach a writable NFC sticker tag to the phone. Though it has to be placed far enough from the phone's NFC antenna in order for both/either to work. The upside is that you get a second tag of your choice (physically) on your phone. There are even UID-writable sticker tags out there (even if they can be a tiny bit harder to find). You also don't need to replace your default transit card, which could be inconvenient depending on where you live.