5 ms·

This is cool, do love the hacking ingenuity. And not that I want to give Apple extra credit, but they are slowly opening up NFC: https://www.macrumors.com/guide

This is cool, do love the hacking ingenuity. And not that I want to give Apple extra credit, but they are slowly opening up NFC: https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ https://www.macrumors.com/guide/apple-nfc-chip-ios-18-1/ - Is is very restrictive (probably) and very late - most certainly. But at least it's slowly coming.

talldayo 2y ago
The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. You'd think that it was common sense to avoid that, but we are talking about the company that invented DRM for the USB protocol...
- moritzwarhier 2y ago
  It's understandable in the context of Apple Pay I think.
  - int0x29 2y ago
    Google pay coexists with an open NFC API on the same devices and has since before IOS had NFC support
    - moritzwarhier 2y ago
      Point taken
    - ValentineC 2y ago
      Google's implementation is also more janky, with phones needing a data connection and having to go online to download new tokens(?) every 3 transactions or so.
      - lxgr 2y ago
        Nothing prevents Apple from running HCE (which is what Android offers all app developers) in parallel with SE-based cards (which are generally more offline-capable). In fact, Android has supported just that for years.
- dijit 2y ago
  This is a common trope, and given that they don't speak about these things publicly people will take whatever negative opinion they think up and consider them completely valid. I'm aware of this myself, because I work in games, and sometimes we literally can't comment on things; which leads to the speculation being very often the absolute most negative possible interpretation of what is happening, and completely invalid. To take another more obvious example; imagine OpenBSD was, well, not open. Yet they didn't support Bluetooth. (they don't). From and outside perspective, is this: because they don't consider it open source? Because they're not capable? Because they hate bluetooth headphones or interfacing with audio devices? Is it due to security- maybe related to file sharing or something... it could be privacy. And if we thought they were just pure-through-and-through bastards, we'd think up more. There's another perspective, ironically that covers your point as well as OpenBSD's lack of bluetooth support: What if; it's actually much harder than we realise to make it easy to use and secure? It's totally possible that a standardised format has only hacky, rushed and dangerous implementations. It's not uncommon at all, actually.
  - hmottestad 2y ago
    Well, it’s not like anyone sued a Dutch university for finding security vulnerabilities in their NFC transport card solution…NXP would never rush their implementation to market and then try to sue their way out of any vulnerabilities. https://freedom-to-tinker.com/2008/07/15/transit-card-maker-sues-dutch-university-block-paper/ https://freedom-to-tinker.com/2008/07/15/transit-card-maker-...
  - jclulow 2y ago
    They're an absolutely staggeringly immense company and they fight tooth and nail to preserve their rent seeking and premium margins. Nobody owes them a positive interpretation of apparently poor behaviour, especially not when discoverable materials often show the principals are absolutely doing the wrong thing (e.g., Jobs and the anti-labour wage fixing racket). If the company wants people to have positive thoughts, they should do positive things! If indeed there are positive reasons for an apparently negative thing, they should explain them. If they can't or won't explain them, then people absolutely should assume if they feel like they're getting screwed, that they probably are.
- avianlyric 2y ago
  Eh, the NFC chips in Apple devices are very capable. If Apple opened them up to everyone, you would see half a dozen “clone your access card” app a day later. It’s easy to say that it’s not Apple’s problem if people use horrifically insecure RFID and NFC access systems. But I doubt the media, or the lawyers for any office block, would see it that way. The headlines basically write themselves “iPhone used to hack into secure government facilities” or something silly like that. Just look at the uproar the Flipper Zero created in Canada[1]. Now imagine if you could do that with an iPhone (which has most of the hardware needed) by simply downloading an app. Not a chance in hell Apple is gonna let their products be used like that (heck the AirTag stalking debacle demonstrates how silly the reaction can be when there’s an opportunity to roast Apple over an open flame). It would be great if all this stuff was open but the reality of the situation is that RFID and NFC standards are trash, and even when there is a secure “standard” (I’ve yet to see any evidence that manufacturers actually aim for any kind of cross compatibility, even when following a standard), access control manufacturers haven’t bothered using them. [1] https://arstechnica.com/security/2024/02/canada-vows-to-ban-flipper-zero-device-in-crackdown-on-car-theft/ https://arstechnica.com/security/2024/02/canada-vows-to-ban-...
  - talldayo 2y ago
    > Just look at the uproar the Flipper Zero created in Canada[1]. Now imagine if you could do that with an iPhone (which has most of the hardware needed) by simply downloading an app. iPhone users should be able to do that if they have any semblance of control over the hardware they bought. If MacOS supports SDR without any issues, and Apple's own implementation of NFC is good enough, I think this is a silly argument. Enabling NFC access does not turn an iPhone into a Flipper Zero any more than it does with Android, the argument is moot. If the best reason we can muster is "it would make Apple look bad" then we might as well have put the Magic Keyboard and USB-A/HDMI ports in the garbage and withdraw Apple from the EU economic zone. Apple is perfectly capable of adapting to changes that do not align with their insular and stubborn worldview. Some would even say these changes improve their products.
  - lxgr 2y ago
    > If Apple opened them up to everyone, you would see half a dozen “clone your access card” app a day later. Android devices use the same chips, and any access card that can be trivially cloned by any device, consumer or otherwise, doesn't deserve to be called that. > It would be great if all this stuff was open but the reality of the situation is that RFID and NFC standards are trash You clearly have no idea what you are talking about. What's broken isn't the entire ISO 14443 stack, but rather some legacy implementations. This is like saying "TLS is trash", because some old versions supported RC4 and DES 56 bit at some point. > Just look at the uproar the Flipper Zero created in Canada People create uproars about things they don't understand every day.
- diggan 2y ago
  > The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. They didn't just consider it, that's what happened and was their plan. Not until EU regulations were on their radar did they actually start considering opening up the NFC APIs for others to implement.
lxgr 2y ago
The only thing that's been opening up so far is Apple's cash register. From the article: > those official solutions require manual approval, incur additional (in some cases absolutely cuckoo $$$) fees In the EU, there is HCE, under less restrictive terms but geographically isolated. Imagine a world in which Apple would let people just... use the expensive devices they already paid good money for! (Yeah, I can't either.)
- dcrazy 2y ago
  The article is 2 years old, and predates any of the iOS 18.1 changes.
  - lxgr 2y ago
    iOS 18.1 has enabled more and deeper integrations: You can now essentially write your own, custom-logic SE applications, and more use cases are available than before. But all of that is still gated behind a ton of requirements, most importantly a required third-party lab certification [1]. I haven't found anything regarding pricing (but I'd be willing to bet it still doesn't come cheap), but even just the public requirements make this a no-go for hobbyist projects, unlike Android's HCE. [1] https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/
diggan 2y ago
> And not that I want to give Apple extra credit No need, since they're only doing this after (again) being forced by EU regulations, https://9to5mac.com/2024/01/25/apple-pay-nfc-europe-alternative/ https://9to5mac.com/2024/01/25/apple-pay-nfc-europe-alternat..., so no extra credit handed out :) Curious to hear what people who usually think EU regulations hinders innovation thinks of this move, since it seems like regulation actually promoted innovation in this case. Just a edge-case or perhaps something more?
- thibaut_barrere 2y ago
  A bit less innovation-ish but with large concrete impacts https://commission.europa.eu/news/eu-common-charger-rules-power-all-your-devices-single-charger-2024-12-28_en https://commission.europa.eu/news/eu-common-charger-rules-po...
  - diggan 2y ago
    Another move that seems at a glance to foster innovation, not remove it. Just like having a common standard like PCI helped innovation in desktop computers, making sure companies use a standard charging connection could have the same effect.

talldayo 2y ago

The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. You'd think that it was common sense to avoid that, but we are talking about the company that invented DRM for the USB protocol...

moritzwarhier 2y ago
It's understandable in the context of Apple Pay I think.
- int0x29 2y ago
  Google pay coexists with an open NFC API on the same devices and has since before IOS had NFC support
  - moritzwarhier 2y ago
    Point taken
  - ValentineC 2y ago
    Google's implementation is also more janky, with phones needing a data connection and having to go online to download new tokens(?) every 3 transactions or so.
    - lxgr 2y ago
      Nothing prevents Apple from running HCE (which is what Android offers all app developers) in parallel with SE-based cards (which are generally more offline-capable). In fact, Android has supported just that for years.
dijit 2y ago
This is a common trope, and given that they don't speak about these things publicly people will take whatever negative opinion they think up and consider them completely valid. I'm aware of this myself, because I work in games, and sometimes we literally can't comment on things; which leads to the speculation being very often the absolute most negative possible interpretation of what is happening, and completely invalid. To take another more obvious example; imagine OpenBSD was, well, not open. Yet they didn't support Bluetooth. (they don't). From and outside perspective, is this: because they don't consider it open source? Because they're not capable? Because they hate bluetooth headphones or interfacing with audio devices? Is it due to security- maybe related to file sharing or something... it could be privacy. And if we thought they were just pure-through-and-through bastards, we'd think up more. There's another perspective, ironically that covers your point as well as OpenBSD's lack of bluetooth support: What if; it's actually much harder than we realise to make it easy to use and secure? It's totally possible that a standardised format has only hacky, rushed and dangerous implementations. It's not uncommon at all, actually.
- hmottestad 2y ago
  Well, it’s not like anyone sued a Dutch university for finding security vulnerabilities in their NFC transport card solution…NXP would never rush their implementation to market and then try to sue their way out of any vulnerabilities. https://freedom-to-tinker.com/2008/07/15/transit-card-maker-sues-dutch-university-block-paper/ https://freedom-to-tinker.com/2008/07/15/transit-card-maker-...
- jclulow 2y ago
  They're an absolutely staggeringly immense company and they fight tooth and nail to preserve their rent seeking and premium margins. Nobody owes them a positive interpretation of apparently poor behaviour, especially not when discoverable materials often show the principals are absolutely doing the wrong thing (e.g., Jobs and the anti-labour wage fixing racket). If the company wants people to have positive thoughts, they should do positive things! If indeed there are positive reasons for an apparently negative thing, they should explain them. If they can't or won't explain them, then people absolutely should assume if they feel like they're getting screwed, that they probably are.
avianlyric 2y ago
Eh, the NFC chips in Apple devices are very capable. If Apple opened them up to everyone, you would see half a dozen “clone your access card” app a day later. It’s easy to say that it’s not Apple’s problem if people use horrifically insecure RFID and NFC access systems. But I doubt the media, or the lawyers for any office block, would see it that way. The headlines basically write themselves “iPhone used to hack into secure government facilities” or something silly like that. Just look at the uproar the Flipper Zero created in Canada[1]. Now imagine if you could do that with an iPhone (which has most of the hardware needed) by simply downloading an app. Not a chance in hell Apple is gonna let their products be used like that (heck the AirTag stalking debacle demonstrates how silly the reaction can be when there’s an opportunity to roast Apple over an open flame). It would be great if all this stuff was open but the reality of the situation is that RFID and NFC standards are trash, and even when there is a secure “standard” (I’ve yet to see any evidence that manufacturers actually aim for any kind of cross compatibility, even when following a standard), access control manufacturers haven’t bothered using them. [1] https://arstechnica.com/security/2024/02/canada-vows-to-ban-flipper-zero-device-in-crackdown-on-car-theft/ https://arstechnica.com/security/2024/02/canada-vows-to-ban-...
- talldayo 2y ago
  > Just look at the uproar the Flipper Zero created in Canada[1]. Now imagine if you could do that with an iPhone (which has most of the hardware needed) by simply downloading an app. iPhone users should be able to do that if they have any semblance of control over the hardware they bought. If MacOS supports SDR without any issues, and Apple's own implementation of NFC is good enough, I think this is a silly argument. Enabling NFC access does not turn an iPhone into a Flipper Zero any more than it does with Android, the argument is moot. If the best reason we can muster is "it would make Apple look bad" then we might as well have put the Magic Keyboard and USB-A/HDMI ports in the garbage and withdraw Apple from the EU economic zone. Apple is perfectly capable of adapting to changes that do not align with their insular and stubborn worldview. Some would even say these changes improve their products.
- lxgr 2y ago
  > If Apple opened them up to everyone, you would see half a dozen “clone your access card” app a day later. Android devices use the same chips, and any access card that can be trivially cloned by any device, consumer or otherwise, doesn't deserve to be called that. > It would be great if all this stuff was open but the reality of the situation is that RFID and NFC standards are trash You clearly have no idea what you are talking about. What's broken isn't the entire ISO 14443 stack, but rather some legacy implementations. This is like saying "TLS is trash", because some old versions supported RC4 and DES 56 bit at some point. > Just look at the uproar the Flipper Zero created in Canada People create uproars about things they don't understand every day.
diggan 2y ago
> The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features. They didn't just consider it, that's what happened and was their plan. Not until EU regulations were on their radar did they actually start considering opening up the NFC APIs for others to implement.

lxgr 2y ago

The only thing that's been opening up so far is Apple's cash register. From the article: > those official solutions require manual approval, incur additional (in some cases absolutely cuckoo $$$) fees In the EU, there is HCE, under less restrictive terms but geographically isolated. Imagine a world in which Apple would let people just... use the expensive devices they already paid good money for! (Yeah, I can't either.)

dcrazy 2y ago
The article is 2 years old, and predates any of the iOS 18.1 changes.
- lxgr 2y ago
  iOS 18.1 has enabled more and deeper integrations: You can now essentially write your own, custom-logic SE applications, and more use cases are available than before. But all of that is still gated behind a ton of requirements, most importantly a required third-party lab certification [1]. I haven't found anything regarding pricing (but I'd be willing to bet it still doesn't come cheap), but even just the public requirements make this a no-go for hobbyist projects, unlike Android's HCE. [1] https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/

diggan 2y ago

> And not that I want to give Apple extra credit No need, since they're only doing this after (again) being forced by EU regulations, https://9to5mac.com/2024/01/25/apple-pay-nfc-europe-alternative/ https://9to5mac.com/2024/01/25/apple-pay-nfc-europe-alternat..., so no extra credit handed out :) Curious to hear what people who usually think EU regulations hinders innovation thinks of this move, since it seems like regulation actually promoted innovation in this case. Just a edge-case or perhaps something more?

thibaut_barrere 2y ago
A bit less innovation-ish but with large concrete impacts https://commission.europa.eu/news/eu-common-charger-rules-power-all-your-devices-single-charger-2024-12-28_en https://commission.europa.eu/news/eu-common-charger-rules-po...
- diggan 2y ago
  Another move that seems at a glance to foster innovation, not remove it. Just like having a common standard like PCI helped innovation in desktop computers, making sure companies use a standard charging connection could have the same effect.