zlacker

>>moelf+(OP)
I love GrapheneOS. The biggest downside is that Google integrity API block wireless payments in Google Pay. All Dutch banks now advertise to install Google pay for wireless payments. I've tried asking Google to support GrapheneOS but they told me to do a feature request. Which I did and got no reply to. I've contacted the consumer market authority and made a formal complaint since Google and Apple share effectively a contactless payments duopoly and decide which OS distributions get access. Those are closed source and usually bundled with a lot of spyware. I also explained how the Google integrity API might affect banking availability in the future (and already does for some banking apps). They took it very seriously and I hope to hear from them in the future.

>>verslu+1B
> All Dutch banks now advertise to install Google pay for wireless payments.

That sounds like a very big mistake to me. And a missed opportunity: in some countries, banked work together to develop their own systems. People can send money to each other and pay everywhere with a small app that is not BigTech from the US.

I think there should be such an app in every country; you don't want your payment system to fully depend on US companies.

>>palata+YG
Banks do that for p2p payments and e-commerce (like iDeal mentioned by sibling comment or BLIK in Poland).

For physical transactions there's barrier of hardware and network effect - everybody has card terminal. Users expect near 100% acceptance for them to use payment method daily.

If you consider creating own NFC payment app instead of Google/Apple Pay - that's actually possible, but more expensive and often disliked by the users due to inability to easily switch between cards issued by different apps.

>>dzikim+eL
> If you consider creating own NFC payment app instead of Google/Apple Pay - that's actually possible

Is it? Last time I checked, Apple & Google were also interfacing with banks on the server side, i.e. banks had to integrate with Apple/Google specifically. I'd love to be wrong, though.

>>codeth+3O
I believe that for a long time, Apple was preventing the use of NFC (or was it just for payments?). The EU Digital Markets Act is supposed to prevent them from doing that, as part of the "interoperability" part. And I think the DMA is great in that sense.

>>palata+pW
True, on iOS access to the NFC chip has been a additional blocker. But on Android apps have been able to use the NFC chip just fine and it's still not that easy to write a generic "wallet" app (that's compatible with all banks & cards), see my previous comment.

>>codeth+Uc1
>But on Android apps have been able to use the NFC chip just fine

The last time I looked at it, it was not possible because Android doesn't let apps control the uid that gets used for NFC.

>>charci+Ck1
Ah right, good point. I did forget about that.

Either way, even if apps had full control over the chip, my understanding is that building a wallet app would still amount to much more than just interfacing with the NFC chip.

>>codeth+pv1
You need connection to card scheme, which means you need ton of paperwork, which means you need ton of money. That's biggest issue :-)

For technical side - there are companies selling complete SDKs.

>>dzikim+6U1
Could you elaborate? You seem like you know quite a bit about this topic.

While I've known that building a wallet is not as simple as configuring the NFC chip and one would have to interface with banks on the backend etc., I've failed to understand exactly why. What prevents a phone from emulating a regular physical credit card?

>>codeth+XY2
>What prevents a phone from emulating a regular physical credit card?

If this were possible fraudsters would be easily be able to clone people's cards by getting close to them. The protocol was explicitly designed for this to not be possible. There are secrets that live on the card itself and are not exposed

>>charci+4D3
So a phone can totally emulate a regular physical credit card, if it has the private key.

Behaving like a credit card does not mean that the credit card is clonable.

>>palata+Sl5
Yes, if you want to write an app, that will generate transaction conforming to the protocol & will use your card number it's actually very short programy.

With some luck it will be even routed to your bank. Then it will fail due to invalid authentication. I think there's a defcon talk on YouTube that details the exchange.