Comment by apatheticonion | Hacker News Reader

Comment by apatheticonion | Hacker News Reader

I like the idea of living with just my phone and nothing more. No keys, just NFC and web based authentication.

I do payments via NFC and I can also use NFC to tap onto public transport.

My apartment complex lives in the 1990s still and issues key fobs for elevator access and hard keys for door access. Their fobs use some esoteric encryption method and cannot be copied so I broke open my apartment key fob, extracted the chip+coil, dremiled a housing into my phone's case and hot glue gun-ed it flush into my phone case.

My office HID card slips under my case.

Tried to extract and embed the chip/coil of my AnytimeFitness gym fob into my phone case but I broke the fob (costing $80 for a replacement - yikes). I might try to find someone that can clone it before trying that again - doesn't work with my $100 FOB scanner.

The building manager won't let me install a smart door lock on my door so I still have to carry keys.

So far, I need to carry 1 key for my door and a fob for gym - everything else I can do by just tapping my phone.

I like convenience and simplicity too, but I’m also a fan of backups. Having all of my daily routine in one device like that...no thanks.

cheap backup phone?

If your phone just holds a private/public key and your access method relies on an admin portal allowing access to nominated keys (think github) - then you could revoke access to a stolen/lost phone and add access to a new device.

The device could be a phone, it could also be a smart watch. It could be a "smart" fob designed for key exchange. It could be a smart fob surgically embedded offering key exchange.

I'm the total opposite. I'm so glad that when my phone get stolen or suddenly breaks (like my previous phone did), I can still drive my car, go home, make purchases, etc. and I'll only be locked out of services that (against my wishes) forced some phone based authentication.

There's no reason why you couldn't be offered both, access via your phone and a physical key/fob.

If access is granted digitally (rather than being statically issued via fob), then you could be able to grant people permission to enter dynamically. That way any number of devices could service the role of being a key.

You could use a phone, you could use a smart watch, you could use a QR code, you could use a smart fob or even something like a surgically embedded smart fob (into your hand).

Perhaps something as simple as SSH style private/public key exchange would suffice.

You could allow access to your apartment, car, workplace, gym through a web portal. Much like Github repository permission, match access to a person's identity. Perhaps you give some people free access while others you'd like to see a push notification for.

As far as security goes, while a fob is stealabe and cloneable, digital identities (think oauth-oidc) are significantly harder to obtain ilictly and it's also probably cheaper than the fob system.

While I appreciate your stance, I am constantly amazed at how many people are happy to use NFC. It's demonstrably insecure [0], and using it for payment at the moment is only secure through obscurity. If it becomes more-prevalent, we will see more cases of pay-info theft attacks [1].

0. https://www.makeuseof.com/tag/drive-nfc-hack-work/ 1. https://ajinabraham.com/blog/stealing-card-details-from-cont...

Re [1]: if you're using the camera to read the CVV, why not just flip the card over and capture the number?

If the card is embossed you wouldn't even need to flip it!

NFC is just a communications protocol - what you choose to send down that pipe is up to you, and we have battle-tested cryptography that provides key exchange & encryption over an insecure channel.

> using it for payment at the moment is only secure through obscurity

EMV payments over NFC are mostly secure - there might be one-off exploits here and there but I wouldn't call it insecure. There are other protocols besides EMV such as magstripe contactless which are insecure but they're intended to replicate equally-insecure magnetic stripes, but that's more down to a certain country's reluctance to adopt modern payment systems rather than a fault of NFC.

With regards to stealing card details, keep in mind that the cardholder is not liable for card-not-present fraud unless 3D-Secure authentication was used.

Is WeChat style QR code payments safer than the NFC payment method?

Given NFC payments require you to unlock your phone, does that make them secure?

Reply on news.ycombinator.com