Hacker News Reader

Comment by Rebelgecko | Hacker News Reader

Can I clone my credit cards onto my flipper zero? Or is Amazon hallucinating features that don't exist?

The Flipper can read the PAN (card digits + expiry) that are exposed by cards that have "tap to pay".

This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...)

This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards.

The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.

I thought tap to pay used a one time code? Or are you saying tap to pay uses the PAN + a one time code?

There are two different interfaces. One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/)

The EMV / payment interface is a different interface and fully encrypted.

And all cards support both??

I used to think my RF shielded wallet is a silly gimmick, but now I'm not so sure.

Not a gimmick, but also not perfect. Probably better than nothing :) Good quick explanation by Deviant Ollam at around 7:30 in this video: https://www.youtube.com/watch?v=Qt2Gn2CoJ74

It's mind boggling how they just decided to throw basically any semblance of security completely out the window by putting NFC on credit cards for convenience.

Flipper has no mechanism to read a magstripe, so no, I don't think so. But it's possible to clone all kinds of other things. I cloned my SO's old building key (Mifare 1k classic) so she wouldn't need to "buzz" me up.

It does have enough GPIOs that you could probably hook a magstrip reader up though. But you could also do that with a $5 ESP32 dev board.

They're probably using a generous interpretation of card skimmer to ban a device that is in a category they didn't think to explicitly ban before.

Reply on news.ycombinator.com