• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Please include NFC in Evo 3D

lordofthereef said:
AFAIK they already started with the Thunderbolt.
Click to expand...

There are a bunch of noob bloggers going around announcing that the Tbolt bootloader is locked as if that's a new trend. All of HTC's phones have always shipped with a locked bootloader. That's what S-ON (NAND locked) refers to. Full root was out before the device was released (toast's method) although unrEVOked had trouble unlocking the bootloader for a good 3 months after.

Motorola is the only one that released an encrypted bootloader armed with e-fuse making it tamper-resistant. Try to change/replace the bootloader, and the fuse trips and bricks the phone.
 
NFC = near field communication. For once I think wiki has a good article on something :) We've debated somewhat on the security of these. I for one don't think it is something I would use personally. I've used the mobile boarding pass (where you show the barcode) and it was a major PITA at the airport. Won't do that again. I know people have mentioned what's the difference when you have this info in your wallet. IDK about the rest of you, but I make damn sure my wallet is with me at all times. My phone on the other hand, meh. Friends use for pictures, I leave it sitting somewhere. I don't go to class and pull my wallet out and set it on the table.


NFC technology is intended mainly for use in mobile phones. There are currently three specific uses for NFC:

  • Card emulation: the NFC device behaves like an existing contactless card
  • Reader mode: the NFC device is active and reads a passive RFID tag, for example for interactive advertising
  • P2P mode: two NFC devices communicating together and exchanging information.
Plenty of applications are possible, such as:

  • Mobile ticketing in public transport: an extension of the existing contactless infrastructure, such as Mobile Phone Boarding Pass.
  • Mobile payment: the device acts as a debit/credit payment card.
  • Smart poster: the mobile phone is used to read RFID tags on outdoor billboards.
  • Bluetooth pairing: in the future, pairing of Bluetooth 2.1 devices with NFC support will be as easy as bringing them close together and accepting the pairing. The process of activating Bluetooth on both sides, searching, waiting, pairing and authorization will be replaced by simply bringing the mobile phones close to each other.
Other applications in the future could include:

  • Electronic ticketing: airline tickets, concert/event tickets, and others
  • Electronic money
  • Travel cards
  • Identity documents
  • Mobile commerce
  • Electronic keys: replacements for physical car keys, house/office keys, hotel room keys, etc.
  • NFC can be used to configure and initiate other wireless network connections such as Bluetooth, Wi-Fi or Ultra-wideband.
 
jdsingle said:
NFC = near field communication. For once I think wiki has a good article on something :) We've debated somewhat on the security of these. I for one don't think it is something I would use personally. I've used the mobile boarding pass (where you show the barcode) and it was a major PITA at the airport. Won't do that again. I know people have mentioned what's the difference when you have this info in your wallet. IDK about the rest of you, but I make damn sure my wallet is with me at all times. My phone on the other hand, meh. Friends use for pictures, I leave it sitting somewhere. I don't go to class and pull my wallet out and set it on the table.


NFC technology is intended mainly for use in mobile phones. There are currently three specific uses for NFC:

  • Card emulation: the NFC device behaves like an existing contactless card
  • Reader mode: the NFC device is active and reads a passive RFID tag, for example for interactive advertising
  • P2P mode: two NFC devices communicating together and exchanging information.
Plenty of applications are possible, such as:

  • Mobile ticketing in public transport: an extension of the existing contactless infrastructure, such as Mobile Phone Boarding Pass.
  • Mobile payment: the device acts as a debit/credit payment card.
  • Smart poster: the mobile phone is used to read RFID tags on outdoor billboards.
  • Bluetooth pairing: in the future, pairing of Bluetooth 2.1 devices with NFC support will be as easy as bringing them close together and accepting the pairing. The process of activating Bluetooth on both sides, searching, waiting, pairing and authorization will be replaced by simply bringing the mobile phones close to each other.
Other applications in the future could include:

  • Electronic ticketing: airline tickets, concert/event tickets, and others
  • Electronic money
  • Travel cards
  • Identity documents
  • Mobile commerce
  • Electronic keys: replacements for physical car keys, house/office keys, hotel room keys, etc.
  • NFC can be used to configure and initiate other wireless network connections such as Bluetooth, Wi-Fi or Ultra-wideband.
Click to expand...

Oh, I see. Thanks for the 411, jd! I'm in for "please add NFC" too then...LOL.
 
novox77 said:
There are a bunch of noob bloggers going around announcing that the Tbolt bootloader is locked as if that's a new trend. All of HTC's phones have always shipped with a locked bootloader. That's what S-ON (NAND locked) refers to. Full root was out before the device was released (toast's method) although unrEVOked had trouble unlocking the bootloader for a good 3 months after.

Motorola is the only one that released an encrypted bootloader armed with e-fuse making it tamper-resistant. Try to change/replace the bootloader, and the fuse trips and bricks the phone.
Click to expand...

Well if that's the case, my bad! I should have looked into that further. Guess you can;t trust everything you read on the interwebs! :D
 
I know most of the people on these forums are much, much more knowledgeable about this sort of thing, and so I'm trying to figure out where I should stand on this whole issue..

What are your ideas about this capability? Is it worth it? You think it's secure enough to be viable? I'm aware that it's not a new thing, but rather another attempt in a long line of tries to get a standard working but I also know that I, like many other consumers, am def a little skeptical about storing such sensitive information all together like that.. However, it's also exceptionally convenient if it is a viable option.

So.. Thoughts?
 
I'm just as careful about where I put my phone as where I put my wallet and keys, so I'm not worried about it getting into the wrong hands or anything. I hope they put it on the 3D, but I haven't heard anything about that yet, yes or no.
 
There is a discussion in another thread somewhere Iperhaps I will come back and link it if I can find it).

I personally don't think it is as insecure as some people tend to say. It's not like it is actively sending your data constantly to be retrieved by someone. I imagine (but could be wrong here) that one would need to be VERY near the item transmitting the signal to be able to pick up some data from it. I have heard some people provide a scenario where someone sits in a gas stating scanning all NFS chips from afar as payments are made. I just don't imagine this technology would be designed in such a way. I picture it more like the tech in cards that one can simply wave in from of the credit card machine rather than pull the mag strip through.

The most frequent argument I hear is people worried they will lose their phone. Personally, I don't see this as any different from losing your wallet with all of your cards (and possibly even cash) inside. I know where my phone is 100% of the time. Not the case with my wallet or keys! Plus, your phone is probably going to be password protected, at the very least. If a person finds your credit card, he/she can run it immediately. If your phone is found, hopefully you alert the proper credit companies before any real damage can be done.
 
I would think you'd be able to turn NFC on and off, that way you just turn it on and use it and then turn it off. Otherwise it's kind of a waste of energy.
 
The non-secure stuff might be very useful in their own right.

HTC is making no indication that NFC hardware is included here - very odd to me. Seems if they had it inside, they'd already have said so. In every other way, this beast seems very future-proof. :confused:
 
I -think- so... I've found the cards, they've been out for a while - but haven't found requirements for retro-use -- even though that's exactly what they seem to be for.

So long as the plug-in follows the SD standard, then it comes down to software, is my guess.

No idea if there are hidden requirements - I keep checking...
 
My working idea was they couldn't expect NFC adoption if it's available only on elite phones, so an SD card path makes sense. But not finding more info lately has left me wondering.
 
Regarding security concerns:

NFC is a type (subset) of RFID (radio frequency identification) that's limited to a range of about 4 inches. In other RFID applications, the range can be a lot longer.

Some credit cards already support RFID/NFC, although I've yet to come across a merchant that allowed me to wave my card near some machine to make a payment.

The security concern is that for very cheap (around $10) on ebay, you can get an RFID/NFC scanner that can retrieve the info from your credit card (or future smartphone) by bumping your wallet pocket or purse. As long as the scanner is within 4 inches for NFC protocol, it can get your data.

What data is available? Traditionally on a magnetic stripe card, there's three tracks of data:

Track 1 typically contains the cardholder's name as well as account number and other discretionary data. This track is used by the airlines when securing reservations with a credit card, like at the kiosks where you check in.

Track 2 typically contains the cardholder's account, encrypted PIN, plus other discretionary data. This is the track that most ATMs and payment processing verification scanners use.

Track 3 is typically not used, but the partition is there for non-standard use.

Current RFID chips in credit cards store both Track 1 and Track 2 data. With a scanner, you can get this information and then use a magnetic stripe WRITER (about $300) to put the info on a formatted magnetic stripe card. Thieves typically format a stolen card and write info to it so that what's shown on the card doesn't necessarily match what's on the stripe. But it's what's on the stripe that counts at the point of sale.

So, instead of having to physically take your wallet via pickpocketing, a thief now just needs a $10 scanner and get kinda close to you - perform the bump without actually taking anything, and they will have your CC info. They then write the info to a blank magnetic stripe and will have a clone of your card. If the person at the point-of-sale terminal doesn't check the card for name, signature, etc, the thief gets away with a transaction.

Here's a good video explaining how your info could be taken without your knowledge (start the video at around 0:19):

YouTube - How to hack RFID-enabled Credit Cards for $8 (BBtv)

Note that the video mentions that you can shield your signal by lining your wallet/purse with stainless steel.

In another video I watched (possibly on TV, like Dateline or something), there was a similar setup where the hacker was able to conceal everything under his clothes and just walk near people. Then under hidden camera, he would approach his victims and read out all their CC numbers, names, expiration dates, and the people were just shocked.
 
Forgot to mention online transactions:

The information obtained from RFID/NFC can also be utilized in online transactions, even if the storefront requests the CVV code, a number that's typically printed on the card somewhere. CVV data is part of Track 2, so the thief is not deterred by this security measure. Online storefronts often request billing address, which is not stored in Track 1 or Track 2, but sometimes the payment processor does not use the billing info to further validate the transaction.
 
novox77 said:
Some credit cards already support RFID/NFC, although I've yet to come across a merchant that allowed me to wave my card near some machine to make a payment.
Click to expand...

Gas stations in Cali are chock full of them (assuming it is what I am thinking of... it's that "wavepass" technology or whatever it's called, right? - sort of looks like a sideways wifi symbol?)
 
lordofthereef said:
So, I don't have access to watching videos atm, but can this technique be used on a cell phone?
Click to expand...

You're right. The Mobil stations here have that. Might not be NFC, but definitely an application of RFID. You also see this tech used in building security... wave your ID card at a sensor next to the door, and the door unlocks.

Yeah it would work on a phone. It doesn't matter whether the chip is placed in a credit card, a phone, or a football. If it's speaking the protocol, it's going to work.

NFC can be compared to Bluetooth in many ways: small connection range, low power, one or two way communication. But pairing is much quicker with NFC by design.
 
See.. That's what has me a little on edge about the whole system. That's some scary stuff he's demonstrating in the video. Of course, it's all optional-- for now.

I thought it was exceptionally poignant when he stated something along the lines of "CC companies realize it doesn't have to BE secure-- it just has to seem secure to the consumer'. Which is absolutely true with just about anything. I hate that. haha

You seem to know a lot about this nov, so here's another question-- It seems like this tech is, eventually at least, going to be the future for better or worse. Do you see this current iteration as the tech still being in it's 'infancy', or do you think this is about as secure as the companies can make the RFID tech without issuing out stainless steel wallets/sleeves with every card? I noticed he mentioned how it would be more secure if the decryption was done at a distant secure area, but it seems to me like that would kill some of the 'convenience' factor they're going for with this?

I only ask all of this due to a couple posts I've read on here about the possibility of NFC being included on the E3D. Granted, most if not all of the threads it's mentioned were started by BSoD. Even I, in my AF forum infancy, am aware of his.. less than stellar rep so... grain of salt, as always. =P
 
One way to combat this is to force the user to enter some data that is NOT on the RF chip but IS registered with the credit card company. Like a pin number. More secure but a bit more cumbersome for the consumer.

The hacker in the vid makes reference to this in another way: the decryption of the info needs to happen on the server where the payment is accepted, not at the point-of-sale. This means that the RFID data is encrypted. Someone with a scanner could get the encrypted data but it would be meaningless. But if the encrypted string is sent to the payment processor's server where it's decrypted, your info stays secure.

To address the card cloning problem without entering a PIN, this is a bit more tricky. There needs to be some unique identifier on the card/phone that is NOT available on the RF chip. Perhaps that ID is used to generate the encryption key, so even if a thief copies the encrypted data to a blank card, it wouldn't decrypt properly because the unique id/key doesn't match.

So... these are things that need to be worked out before this goes mainstream. But you're right. It definitely is going to go mainstream.
 
You must log in or register to reply here.
Back
Top Bottom