This reminds me of crypto wallets. I also dispute mike_hearn 's:

> Smartphone HW attestation is better in every way

They're still prone to side-channel attacks like SPECTRE. Crypto wallets are practically immune because they're air-gapped.

[edit] I just realised that's Mike Hearn of early BTC fame. I suppose he would know what a crypto wallet is.

Spectre doesn't work across process boundaries, so I don't think they are. You can't Spectre your way into a banking app on an iPhone. Or if you can I'd like to see it in action.

I believe "Spectre" is an ever-growing series of ways to read the memory contents of another process by abusing a CPU's ability to do speculative execution. It's unlikely that a CPU will be available in the near-term that's immune to it, so the only sure fix is to use air-gapping. So in principle, your suggestion is vulnerable. Alternatively, the problem may be academic. There is a still-growing class of Spectre attacks, so it's hard to know how flawed your comment was.

The only similar bug I'm aware of was Meltdown, an Intel only bug that was immediately patched with a microcode update. But Meltdown was a different bug to Spectre. Spectre is a class of attacks that's hard to solve by design, Meltdown was a specific bug that was easy to solve.

You could also open your front door with your smart phone. It would look high tech until your battery is empty.

Sometimes I see people captured by the train station unable to check out. They usually find someone with a charger but technically the formula is to fine them for not having a ticket. Then one might still need to buy a ticket to continue the journey. (bring cash)

Phones are usually empty when things [already] aren't going as planned.

Back in my iPhone days, I once got bitten by a bug where the app developer failed to raise that flag "dear OS, I'm in the middle of presenting a ticket for optical scanning, and it would be really amazing if you could just, you know, not disturb the screen with random shit for a couple seconds."

Unfortunately for me though, the turnstile that I was about to pass to exit the train station had both an optical scanner and some NFC thing lumped into the same physical module, and every time I tried to scan my ticket, the phone would raise its NFC screen and hide the 2D matrix code.

So yes, you can have a fully charged phone and a perfectly valid ticket with the latest software and still get stuck in a train station.