Hacker News Reader

Comment by lxgr | Hacker News Reader

iOS is constantly scanning for NFC tags containing URLs etc., which requires emitting enough field power to allow the tag to indicate its presence.

Apple Pay itself uses card emulation mode, and as such the phone only needs to (passively) listen for a payment terminal's field; that should itself not be detectable without emitting such a field.

View on HN

Is it really true that the phone must be passively listening? The field of the payment terminal will induce current in the NFC-coil and that should be able to wake the phone as necessary.

That's a common way of doing it, but Apple devices actively amplify the signal in card emulation mode as well, which gives them longer range than physical cards or "purely passive" devices.

But it also means they can't do the neat trick of paying with a completely dead (i.e. not even reserve battery power) phone that some early Android and Windows Phone devices could do.

Maybe I’m not understanding properly, but iPhones absolutely can do NFC payments when the phone is dead. Your nominated “express” card will work for transit payments, and I believe car and house keys continue to work too.

No, that still requires some battery on iOS, i.e. it's only possible in the same "power reserve" mode that still sends the occasional "Find my iPhone" Bluetooth beacon.

Field-powered mode is possible in at least some NFC chipsets, but I suspect that Apple either values a consistent NFC range more than usability even with a completely dead battery (the amplifier that grants a significantly higher NFC range to Apple Pay obviously needs power), they see it as a security feature (reserve mode is capped to a few hours, I believe), or their NFC controller simply doesn't support it.

that's seems like an obvious security vulnerability. if the phone has no power then how does it authenticate the payment request?

It only works with approved transit providers and you have to explicitly enable it so the exposure is fairly limited.

https://www.apple.com/uk/apple-pay/transport/

If you think about it, it's still more secure than a physical card – that also doesn't have any authentication method at transit terminals, but unlike the "Express Transit" option on iOS, you can't turn that functionality off at all.

Reply on news.ycombinator.com