Tell me more ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.
up vote 11 down vote favorite
3

Can an android app read my credit card's NFC data, store it and then send this data to a contactless pay point (PayPass)? Thus I would use my Nexus to pay for my coffee, conveniently.

If yes, is there an app for this? If not, why not?

share|improve this question
1  
Interesting question.. :) – Sachin Shekhar Apr 18 '12 at 19:15
Never thought of that question. What happens, if say, the data that "represents" the nfc data gets duplicated, or is that tied to the device id to generate an encryption key? (Have no idea as a lot of my handsets do not have NFC built in),Nonetheless, that's a good question :) +1 from me :) – t0mm13b Jun 28 '12 at 23:51

2 Answers

up vote 9 down vote

No, you can't. To oversimplify - wireless payments (NFC, RFID chips on cards, etc) aren't a simple 'what's your card number' transaction (because that would be insecure beyond belief), they are more of a 'here, encrypt this block of data with your secret numbers and return it' type of thing.

The block of data to be encrypted changes for each transaction, and there's (supposed to be) no way to get the device to spit out it's secret numbers.

So you can't EASILY clone your cards onto your phone (if you could, then so could anyone else who walked near you).

That's not to say it can't be done at all (if, perhaps, you found a flaw in the way the crypto works, you could perhaps deduce the secret numbers of a device), but it's not something you're going be buying an app for.

share|improve this answer
Just on a side note up until 2008(ish, in the UK) transactions did used be a 'what's your card number' type and it was possible to clone chip cards. The clones only worked when the point of sale terminal didn't contact the bank to authenticate the card though. – Peanut May 4 '12 at 9:21
I'm not fully up to date, but the last I heard (last year sometime) there are still issues with chip-and-pin due to the specified fallback behavior of the terminals - if they can't talk to the chip, they fall back to older behaviors, which some attackers may have exploited. That's a rather nasty spec-level bug, unfortunately. – Michael Kohne May 4 '12 at 12:33
Yeah if the chip is damaged then the terminal will ask for a mag stripe transaction still, even in the UK where we haven't had them for years. It could be got rid of completely but the banks don't seem to mind the small levels of fraud this could cause. – Peanut May 4 '12 at 14:52
But What about normal RFID/NFC cards, like keys for doors? can they be copied and used from the phone? – Midhat Dec 1 '12 at 17:46
@Midhat - if it's intended for security, then you aren't going to be able to easily clone it (unless the vendor was a complete bunch of morons). Normally devices that are used for security are NOT just 'here's my number' kinds of things - they have some info internally, and when the reader asks, they do something and return an answer, so as to avoid just this problem. That's not to say that it's 100% foolproof, but you're not going to just sit it near your phone and clone it. – Michael Kohne Dec 1 '12 at 19:35
up vote 2 down vote

The NFC hardware in the Nexus S and the Galaxy Nexus is technically capable of emulating an NFC tag such as a contactless credit card. This is exactly how Google Wallet works. However, cloning an existing card is not possible, due to how the authentication process between card and payment terminal works (based on secret cryptographic keys). So the simplest way to accomplish what you want is to install Google Wallet on the phone (it comes pre-installed on the Nexus S 4G, there are various tutorials available on the web for plain Nexus S and Galaxy Nexus) and load up some money in a Google prepaid card and off you go to have a coffee.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.