42
NFC payments on GrapheneOS
(monero.town)
Carry your card or some cash. Google Pay will never certify GOS.
Unfortunately no. The best option, unfortunately, its to have a second device, sadly.
My second device is a bank card. Easy.
I've heard some banking apps having their own NFC payments, but I know PayPal and google pay don't work from my own experience.
AFAIK there are alternatives no that work.
it's a very closed system with Google , banks and OEMs working together. I doubt it'll work properly on anything outside stock OEM ROMs.
I use Curve Pay to do that, but it might only be available in some countries.
Also the NFC payment feature isn't in the version that's on Google Play.
I believe there's another app called iCard which supports it but I've never used that.
I use iCard. It works fine. You do need to open an iCard account though. I've had mine for years without any issues.
Why hasn't someone made a FOSS NFC payments app yet? Any bored Android FOSS developers, please make this your next project.
If it was as simple as writing an app it would be done by now. The problem is authorisation, the bank isn’t going to action the transfer request just because Bob’s Banking app says so. The request either needs to come from their own app or from one of their partners (Apple).
Those aren't just payment apps, they're a payment service. Google, Apple and Samsung are "trusted" providers to process payments.
Some FOSS developer could theoretically make an app to process Google Pay but they'd need Google's authentication, which is never going to happen, for a variety of reasons.
I'd be interested to know what happens if you use one of the official apps on a rooted phone.
If you hide root, you're fine.
That suggests you can get credentials out of the phone, at least for non-google phones. I doubt that the Moto G that I just got has a security chip like the one in the Pixels and Iphones. It's possible though. I do want to start messing with the phone's NFC reader, though more as a general security thing than for payments in particular. Maybe I'll get to understand it better.
Probably the issue lies somewhere else, like legal, infrastructure or sm.
It's more down to trust and attestation than a technical implementation. Whoever makes an NFC payment system needs to prove to payment processors that the chain of software and hardware from the payment terminal to whatever proves you're the account holder (a card or a phone) can be identified. And, separately, the implementation needs to be audited.
This may sound like they're trying to make this horrible walled garden on the surface, but bank users expect their money to not get stolen. And if it is, they expect the bank to make that problem disappear. The bank can only provide these assurances if they control everything.
This is why they use hardware attestation and a chain of trust all the way through to the OS to identify the specific implementation of an NFC payment system. They want to know they can go after whoever created the buggy NFC payment implementation to recover the money or to least stop partnering with them.
Not a lot of FOSS developers would go through the trouble.
this post was submitted on 23 Nov 2023
42 points (95.7% liked)
Android
26800 readers
170 users here now
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
founded 1 year ago
MODERATORS