Hacker News Reader

Comment by locusofself | Hacker News Reader

After reading your comment I was surprised to find out that credit card chips have any processing capabilities whatsoever, which they apparently do, though at least according to gpt4, they are far too basic to run java/jvm. ?

View on HN

Google appears to be significantly more useful than GPT-4 here. [1] is the third result for me for the query "credit card jvm". [2] is the second result and gives a direct (and more importantly, actually correct) answer. That post links to the Oracle documentation for Java Cards [3] which is the fourth result.

[1] https://en.m.wikipedia.org/wiki/Java_Card

[2] https://superuser.com/questions/362567/are-there-any-credit-...

[3] https://www.oracle.com/java/java-card/

All of this is just as easy as, if not easier than, using ChatGPT. It's unclear that such a tool even serves this purpose (retrieval of basic facts) adequately, so it should probably be avoided in the future.

Fair enough, there is a "Java Card". I'm not convinved that Java is running on any of my or your credit cards in your wallet today, though I'm not willing to bet on it.

It's running on many e-Passports and e-ID cards, i can't find the documentation from my e-ID card which runs on Java, but the chips are quite common like in

https://www.cardlogix.com/product/cardlogix-credentsys-lite-...

And on another source:

Visa became the first large payment company to license JavaCard. Visa mandated JavaCard for all of Visa’s smartcard payment cards. Later, MasterCard acquired Mondex, and Peter Hill joined as their CTO, licensed JavaCard, and ported the Mondex payment platform to JavaCard.

Source: https://javacardforum.com/2022/07/28/the-birth-of-javacard/

This lists a few things using Java Cards (likely stuff that's in your wallet, surprisingly): https://stackoverflow.com/questions/47731005/practical-use-o...

(fwiw I have a bit of prior experience here)

That's pretty neat. It sounds like Java Card (or at least some other cards) actually "boot up" by way of inductive coupling, ie, via the "contactless" card readers where you just hold your card in proximity to the reader thing. Did not know that, I assumed it was just reading a key via NFC or something.

The whole reason there’s a thing called a chip in the card is that it actually does computing (indeed they’re called smart cards) and that it does the sort of computing (cryptographic challenge-response) that makes these cards much more secure than oldschool magnetic stripe cards.

Even fully passive NFC tags contain logic that needs power to talk NFC back to the reader, there’s no such thing as just reading data via NFC.

This is a classic defcon talk about it. They developed their own cell network with their own sim cards for an event and even built custom JavaCard applications their users could use. They have released all their information and tools used to build and compile Java Card software.

https://www.youtube.com/watch?v=_-nxemBCcmU

A lot of people assume this, but with contactless EMV there is a whole transaction flow between the card and the reader going on.

You know those 4 lights on a contactless card reader? They indicate different transaction stages between the card and the terminal. I don’t find them that useful because it’s so fast they all appear to light at the same time, but that’s what they are!

If they were just passive tags, they wouldn’t be very secure, they have cryptographic processors onboard with private keys that can sign stuff for the terminal and your bank. The specs for the interaction are all public if you’re interested (I wouldn’t be!) and lookup contactless EMV.

As far as I know even paying through Apple Pay with your credit card will run that Java Card program.

Though mind you, it is a very limited subset of Java, not the standard one.

Yep, the Secure Element runs little Java applets

Just wait until you find out about the SIM card in your phone!

It's almost bizarre what that thing does.

In what world did you convince yourself asking a chatbot was a source of real knowledge?

respect yourself enough to look at primary sources

How about respect other people instead of rushing to condescending judgement? the stakes are incredibly low here, I asked ChatGPT for fun, like tens of millions of others are doing every day.

For some reason you announced that you were subjecting us to a low quality information retrieval method, and after 6 months of this, people are irritable. The social norms is to do that sort of thing in private, doing it in public and seemingly proudly came across as coarse and impolite

It didn't help any that it was clear from the initial post you were questioning someone with domain knowledge, which was later gently indicated to you

It's not asking ChatGPT that is anti social but posting it, diluting the entropy of the conversation. Thousands of brains read every posted word before they can discard redundant information. Together we can keep a high quality shared medium, which benefits everyone!

It feels like that should be true, I get it. However Java Card is very real.

https://en.m.wikipedia.org/wiki/Java_Card

“According to gpt4”…. Uhhh. LLMs are text generators. Not a good source for facts or information, if accuracy is desired.

oh, yeah, they do. They often have multiple 'applications' on them, for different purposes (for example, withdrawing from an ATM with a card is a different application to making a purchase, which is different from the ill-conceved idea of using your card and PIN as a two-factor authentication token)

Why are you choosing to intentionally cripple your knowledge discovery so extremely?

Reply on news.ycombinator.com