NFC payments directly by the device (banking card simulation)

General topics
1

Though I’m not interested in making smartphone NFC payments, I researched a bit and it seems that all the banking apps go through Google Pay or Apple Pay.

It should be possible for the NFC to read the plastic banking card and simulate this function any time without any kind of intermediary just by simulating the card.

The only case that this can’t be done should be if the card receives information from the POS and replies with some cryptographically signed block of data with the private key not being exposed by the card-chip.

https://medium.com/@androidcrypto/how-to-emulate-a-credit-card-on-android-with-host-based-card-emulation-hce-in-java-0652342da0f1

So for the time being the task should be considered as impossible until a way is found for the extraction of the Private Key.

I imagine that the key would be sent to Google directly by the bank and maybe it’s not stored in the device at all so that you can get it through digging into the RAM or the internet packets with root access.

2

FWIW There are a few alternative wallets you don’t have to go through google/apple pay.
I have a Garmin smart watch and on my brax I have the Garmin app which has a wallet built in so I can pay with my brax3 or my watch. I believe Samsung also do a wallet although I think its only for samsung devices.

1 Like
3

How exactly are the private keys transferred to the wallet ?

In the case of Google/Apple the banking app shares the keys. Do you have a specific bank that shares to those apps ?

Also I want to go open-source, I don’t care so much for the payments themselves.

4

I am using the same setup btw.

1 Like
5

Is it a specific bank that shares the data to Garmin or you tricked it somehow ?

6

no tricks. Just garmin pay is an approved payment provider and compatible with most banks as far as I am aware. Since garmin pay doesn’t rely on google play integrity, there is no issue to use it on a degoogled device. I haven’t tried curvey pay, but I’ve read that it’s a degoogled friendly option as well.

Not sure of anything open-source out there to be honest. I know you kind of need to be “big” in order to get approved and compatible with banks. So I wouldn’t be surprised if we don’t see a new up and comer with open-source tech for a while.

7

I would try to extract the data from an approved app so it would be a mixed method

8

I’m in the UK and most big banks dont support Garmin pay so i had to open an account with Revolut bank to be able to use it but its not a big issue I dont put a lot of money in the account i use it mainly for coffee etc but at least the big G doesnt know how much im addicted to cafine LOL.
Garmin have a good help system which will tell you the baknks it works with in various countries.

1 Like
9

It says it supports the banks.

Which is the app exactly? Garmin Connect?

Should I have a smartwatch or it can be used without buying one?

10

Yes its Garmin connect and I think you do have to have a Garmin smartwatch to use it.