News for hackers. Stuff that matters.
Re:Coercing a Magic MIFARE credential into being an iPhone-c... by privacyking on Monday December 16, 2024 @08:59AM (#42430993)
Didn't apple announce earlier this year they were going to open NFC up more? What ever happened to that?
Re:Coercing a Magic MIFARE credential into being an iPhone-c... by Daneel_ on Monday December 16, 2024 @10:03AM (#42431616)
It’s open to developers as of iOS 18.1:

https://developer.apple.com/support/nfc-se-platform/

Re:Coercing a Magic MIFARE credential into being an iPhone-c... by lxgr on Monday December 16, 2024 @01:39PM (#42433885)
That's for card emulation. This article is about using iOS devices as readers.

ISO 14443 card reader functionality has been made available some iOS versions before, but it's still restricted (e.g. you can't select any "payment" ISO 7816 applications, you have to predefine the list of AIDs you want to be able to select, and you don't have lower layer access to ISO 14443).

I'm not aware of any announcements to further open up "reader" mode.

Re:Coercing a Magic MIFARE credential into being an iPhone-c... by Daneel_ on Monday December 16, 2024 @04:50PM (#42435848)
Agreed, but it’s certainly more open than it used to be. At least now you can emulate a variety of cards directly in an app.
Re:Coercing a Magic MIFARE credential into being an iPhone-c... by lxgr on Monday December 16, 2024 @05:06PM (#42435985)
Big companies that can afford to pay the certification fees maybe can; I definitely can’t. The entitlement is not available to regular app developers, unfortunately.
Re:Coercing a Magic MIFARE credential into being an iPhone-c... by noprocrasted on Monday December 16, 2024 @10:48AM (#42432110)
In the EU, maybe. And even then you will most likely need to beg for an "entitlement" to use it which may have requirements around being a registered business, etc so hobby apps are still excluded.
Re:Coercing a Magic MIFARE credential into being an iPhone-c... by lxgr on Monday December 16, 2024 @02:08PM (#42434194)
There's two versions of access to "card emulation" mode:

- The EEA-only HCE (which lets you emulate the card in your app in software, for a limited list of use cases, which makes it a non-starter for fully offline systems unfortunately, as there's no protection against exfiltrating any keys from the app), and

- The some-non-EEA-countries-only "full smartcard access" solution, which requires you to pay Apple and do a ton of (presumably also very expensive) certification.

So for different reasons, neither is something in scope for hobbyists at the moment, unfortunately.