Make a NFC proxy

[Benjamin-Loison]

Note that Xiaomi Mi A3 does not support NFC, while Samsung Galaxy A53 supports it, it does not allow Termux install (from UI with universal APK, as the Play Store does not propose Termux on this Android version, what about adb?).

We can install Termux on A53:

adb install termux-app_v0.118.0+github-debug_universal.apk

Output:

Performing Streamed Install
Success

termux-nfc only seems to act as tag reader/writer but not the tag itself.

I tried playing termux-nfc -r full (also short but unsure) with my Navigo Easy and credit cards and another NFC enabled phone (what other NFC devices do I have? See below for at least some) without meaningful results except vibrating which is already the case without Termux when the tag is near the phone. I also tried termux-nfc -w -t test (cf Benjamin-Loison/termux-api-package#5) on one phone and termux-nfc -r full (also short but unsure) without any result except the usual vibrations.

Get for both white card and blue tag (Rc522):

Source: https://seputartekniinformatika.blogspot.com/2016/10/tutorial-rfid-reader-mifare-rc522.html

termux-nfc -r full

Output:

{
  "error": "Wrong Technology",
  "description": "termux API support only NFEF Tag"
}

"termux-nfc" on DuckDuckGo and Google interesting results were studied or written below:

• https://github.com/underwindfall/NFCAndroid (seems to have as a fork MichaelsPlayground/NfcHceNdefEmulator), see Benjamin_Loison/NFCAndroid/issues/1
• https://stackoverflow.com/q/77187707
• https://www.reddit.com/r/PleX/comments/105yxhz/nfc_tag_to_play_a_movie/
• https://www.reddit.com/r/fossdroid/comments/136gnyi/nfc/

Related to Benjamin_Loison/fdroidclient#3.

Could also consider identity card (related to Benjamin_Loison/franceidentite/issues/7), accommodation badge, school card, hotel badge and ski pass. Are all RFID NFC compatible? More details about the ski pass can be found at Improve_websites_thanks_to_open_source/issues/558. Can leverage pools of such badges? For instance Navigo yearly pass could be interesting, as can use the public transport normally and only if get caught have to pay a fine but can it be paid without consent to Navigo owner or can the Navigo card be disabled for this reason?

Sans titre de transport : 50 €

Source: https://www.transilien.com/fr/page-deplacements/voyager-en-regle

+432

Feature description

Reference implementation

Have you checked if the feature is accessible through the Android API?
Do you know of other open-source apps that has a similar feature as the one you want? (Provide links)

[Benjamin-Loison]

Similarly being able to proxy car keys would be nice.

[Benjamin-Loison]

See /home/benjamin/Desktop/bens_folder/people/family/CENSORED/wallet.txt on my Linux Mint Framework, censored being:

-----BEGIN PGP MESSAGE-----

hF4DTQa9Wom5MBgSAQdA0Rq3OBvTl9SCg5zBccu9MMsvft0Z+yBm8zjlexDBXWIw
OqDadgy9d1aLEgUsd5xfqrZNP0WcujQPfy3/IJg2/Dmxo0zY0SO6eIhLguvwbIv7
0kABit+sXgHAq3ZF3U2aOuLH4mkUfnSaHK5owHib2wxiOtiGNxGN0/NBPpRnOG92
hndkBYfMAinvfRV3yG0BtCMv
=p7x3
-----END PGP MESSAGE-----

Its content is:

• credit card
• carte vitale
• meal voucher card
• French national identity card
• driving license
• fidelity card
• health mutual card
• Navigo card

More precisely:

Without entering card in terminal:

• credit card
• meal voucher card
• Navigo card

Necessarily enter card in terminal:

• carte vitale

To view or barcode scan:

• French national identity card
• driving license
• fidelity card
• health mutual card

[Benjamin-Loison]

Maybe Kali Linux can help guess the secret of a badge as have control over it for a long period of time and it should not be strong as the device looks simple, but I may be wrong on the latter aspect. Also note that having the badge for a long is maybe worthless if do not have another device to interact with as it does usually and potentially would need to simulate interaction start and end which requires physical movement which is quite of my skills.

In theory the same argument holds for contact-less credit cards and I hope they are quite secure, so it might not work.

[Benjamin-Loison]

In theory this would maybe allow free credit card, with a single server and bank account could emulate multiple bank accounts and credit cards, if know how much the NFC transaction would be. Note that the significant physical required (or just if not NFC compatible or without Internet access) payment credit card may be an issue.

This would reduce bank account fees, the issue is like postal boxes, it is unclear if no label is provided for who the content is for.

https://www.service-public.fr/particuliers/vosdroits/F10410

Carte bancaire:

Pour des raisons de sécurité, le montant maximum d'un paiement sans contact est limité à 50 € par opération.

L’utilisation d’un étui de protection pour bloquer la capture à distance des données de la carte est recommandée.

Contrarily to a credit card a smartphone can require a tap (with screen locked or not) to authorize something, so contact less stealing attacks are less probable.

Téléphone mobile:

Pour un achat d'un faible montant (20 € ou 30 € environ), le paiement se fait sans saisie du code.

Pour un montant supérieur, il pourra vous être demandé d'effectuer l'une des 2 opérations suivantes :

• Saisir votre code confidentiel sur le clavier du terminal de paiement du commerçant
• Saisir un mot de passe sur votre téléphone (différent du code confidentiel de votre carte).

In a trusted setup, like family using a single person bank account may be possible. Are couple bank accounts more expensive? I would say that the price is twice as individuals as they are 2 credit cards etc. Maybe can just request an additional credit card for a fee less than another account.

https://mabanque.bnpparibas/fr/secure/comptes-et-contrats/mes-cartes

https://mabanque.bnpparibas/fr/gerer/cartes-moyens-paiement/cartes-bancaires

https://mabanque.bnpparibas/fr/gerer/cartes-moyens-paiement/cartes-bancaires/carte-origin

seems to be at 42 €/an with -50% sur la 2ème carte so as already have a card it is 21 €/year. In comparison my current bank account fees are about 3.14 * 12 = 37.68 €/year. So this would reduce in theory fees by 16.68 €/year.

The person:

-----BEGIN PGP MESSAGE-----

hF4DTQa9Wom5MBgSAQdANo17RYUnKOLhMVOcgjdZoAvI+kSjxpp9fOq2rZWVcQQw
uPK77mH6rYoNEBdQ26zGNH8kqxf+NQonxsH2C1836H77H49B+m5r9py0rra8NoR2
0kABSHuVzQ+otzl0e0nd5v8N7my8KxbuGkSLONkxcb2XBkELwyp3/bxlxZNHVMfV
/cF9iDOTRmkccs39+A9/2OS6
=sfDL
-----END PGP MESSAGE-----

pays 0.99 €/month for his bank account.

Paying by the phone could automatically mark given transaction performed by given person, so without manual process.

[Benjamin-Loison]

Related to the issue:

-----BEGIN PGP MESSAGE-----

hF4DTQa9Wom5MBgSAQdAF1twU7JzNrrS2i/SrDZxNjnHb8/NwTKKgg7QJzEPx38w
NeRkvZsyS7aBTtifbgLXtNpMany0QYrYQLO7sH48Z3OXUdyr77JVeblkftKXl10Z
1HwBCQIQCO3qKrw1fc1nGXYJ8o45Fj8dGPGaX7gUZdsGzSSm0KNjDl4yiAsoBRIa
Z0Mv0ngjJRSGI9kIJfs0GbGO7quGgdjG9Y4LjmDaep77T8ZUkUU5G3r6fXo+vO38
BmCZTAnVstVDNYJN2f/iO2ALvoSUPgDJk7fDZ7i7
=etIJ
-----END PGP MESSAGE-----

[Benjamin-Loison]

Would help Benjamin_Loison/franceidentite/issues/19.

[Benjamin-Loison]

For Transilien can test with another phone with Bonjour RATP Android app or/and a fixed recharging terminal.

[Benjamin-Loison]

In case of payment check, should first ensure that an identifier of the payment method is enough like Navigo easy back identifier, in case of proxy failure. Can actually first only present below scan during a control to actually ensure that it is enough and only present card if they are about to fine me, as otherwise they may quickly answer an incorrect statement.
Maybe a scan of both faces of the card can be useful. I took such photos with my phone.

Note that even if have a named card have to put it on the terminal when get into the public transport, so in theory what I present them is the edge case of having lost transportation card.
If the proxy does not work when getting inside can immediately or wait next stop to get out or rely on another fallback physical card.

[Benjamin-Loison]

I talked on 11/12/24 around 11:15 to 12:00 with my school DSI and they told me that:

Wikipedia: MIFARE
ID crypté and random.
Not copiable.
When scan wirh NFC notice different IDs.

[Benjamin-Loison]

Wikipedia: MIFARE#Application_references (1255850497) seems to mention Wikipedia: Carte Vitale. Found by searching France.