Hacker News Reader

Comment by _7tgr | Hacker News Reader

Google appears to be significantly more useful than GPT-4 here. [1] is the third result for me for the query "credit card jvm". [2] is the second result and gives a direct (and more importantly, actually correct) answer. That post links to the Oracle documentation for Java Cards [3] which is the fourth result.

[1] https://en.m.wikipedia.org/wiki/Java_Card

[2] https://superuser.com/questions/362567/are-there-any-credit-...

[3] https://www.oracle.com/java/java-card/

All of this is just as easy as, if not easier than, using ChatGPT. It's unclear that such a tool even serves this purpose (retrieval of basic facts) adequately, so it should probably be avoided in the future.

View on HN

Fair enough, there is a "Java Card". I'm not convinved that Java is running on any of my or your credit cards in your wallet today, though I'm not willing to bet on it.

This lists a few things using Java Cards (likely stuff that's in your wallet, surprisingly): https://stackoverflow.com/questions/47731005/practical-use-o...

(fwiw I have a bit of prior experience here)

That's pretty neat. It sounds like Java Card (or at least some other cards) actually "boot up" by way of inductive coupling, ie, via the "contactless" card readers where you just hold your card in proximity to the reader thing. Did not know that, I assumed it was just reading a key via NFC or something.

This is a classic defcon talk about it. They developed their own cell network with their own sim cards for an event and even built custom JavaCard applications their users could use. They have released all their information and tools used to build and compile Java Card software.

https://www.youtube.com/watch?v=_-nxemBCcmU

The whole reason there’s a thing called a chip in the card is that it actually does computing (indeed they’re called smart cards) and that it does the sort of computing (cryptographic challenge-response) that makes these cards much more secure than oldschool magnetic stripe cards.

Even fully passive NFC tags contain logic that needs power to talk NFC back to the reader, there’s no such thing as just reading data via NFC.

A lot of people assume this, but with contactless EMV there is a whole transaction flow between the card and the reader going on.

You know those 4 lights on a contactless card reader? They indicate different transaction stages between the card and the terminal. I don’t find them that useful because it’s so fast they all appear to light at the same time, but that’s what they are!

If they were just passive tags, they wouldn’t be very secure, they have cryptographic processors onboard with private keys that can sign stuff for the terminal and your bank. The specs for the interaction are all public if you’re interested (I wouldn’t be!) and lookup contactless EMV.

It's running on many e-Passports and e-ID cards, i can't find the documentation from my e-ID card which runs on Java, but the chips are quite common like in

https://www.cardlogix.com/product/cardlogix-credentsys-lite-...

And on another source:

Visa became the first large payment company to license JavaCard. Visa mandated JavaCard for all of Visa’s smartcard payment cards. Later, MasterCard acquired Mondex, and Peter Hill joined as their CTO, licensed JavaCard, and ported the Mondex payment platform to JavaCard.

Source: https://javacardforum.com/2022/07/28/the-birth-of-javacard/

Just wait until you find out about the SIM card in your phone!

It's almost bizarre what that thing does.

As far as I know even paying through Apple Pay with your credit card will run that Java Card program.

Though mind you, it is a very limited subset of Java, not the standard one.

Yep, the Secure Element runs little Java applets

Reply on news.ycombinator.com