Any idea why Apple doesn't allow use of NFC? It's been in devices for ages, I'm surprise to hear it's not available to developers. Given Apple reviews all apps anyway, and can restrict what it's used for any way they like, I can't imagine why they wouldn't allow apps to use it.
The problem could be that they require a different data format then the NFC Data Exchange Format (NDEF) as that is the only format that CoreNFC supports.
Maybe they don't want NFC payment alternatives that would rival Apple Pay. And they don't want to restrict it for that use-case because it makes them look weak for artificially blocking out the competition so they just restrict the feature entirely.
Or the security/PR nightmare that would happen when someone used one of those that was poorly implemented and said “I paid with Apple Pay and all my money was stolen!”
It's really silly – but Apple keep the NFC functionality exclusively for use by Apple Pay. Whilst it is NFC, Apple have never marketed it as such. Presumably they want people to think that it's just Apple Pay 'magic'.
Not just Apple Pay anymore, they also use it for certain transit cards and student ID cards. New phones can read tags and launch the appropriate app (via notification like Camera gives you for QR code reading): https://www.macrumors.com/2018/09/12/2018-iphones-background...
iOS apps can access NFC capablities on devices with that have appropriate hardware support, but from what I understand the CoreNFC API has some limitations.
For example, it doesn't provide a way to read an RFID'c unique ID without using a private API that would disqualify an app from being published on the app store. There's some information about this at [1] and [2]. CoreAPI can read NDEF tags, but they don't expose the UID.
Perhaps the Home Office's app needs the UID of the passport's embedded RFID? I don't know why they might want this, or why Apple restricts the ability to read it. Privacy concerns?
You don’t just need the UID (and by the way, passports don’t have one).
You need to do a proper cryptographic handshake with the passport, something impossible with the current SDK. You need to be able to send raw “APDUs” (commands) to the smart card/passport.
Not available as far as I know; I looked into it as I needed it as well.
Seems like there are some classes in the SDK that hint at that but so far they don’t work (presumably they require an entitlement that only Apple can provide).
> The Home Office has also [planned] to set up computer terminals at 56 local libraries around the UK to help those without smartphones, or without the necessary digital skills, to apply to stay in the UK.
I does seem crazy, but apparently it includes the application process as well. In general not a lot of people tend to care about this kind of thing. Governments often aren't empowered to do it, the large tech companies don't care, the idealist are busy copying the large tech companies and the hobbyist are busy with their own hobbies. Left are large consulting companies that can provide custom solutions and will charge as such.
So this is a smartphone app because they want to use the NFC in the smartphone to scan the passport.
Does anyone know how the NFC in a passport works? If it just communicates the passport number, then it seems like they could allow a fallback where the user types in the passport number, without any loss of security.
(Because if that is how it works, all you're really proving is knowledge of the passport number, not possession of the passport)
EDIT: According to this StackOverflow post[0] the NFC reader needs to supply the passport number, date of birth, and expiry date before it can retrieve whatever data is on the passport, so it can't work the way I described.
The passport is a standard NFC smart card, just like your credit card. Internally it can do crypto, which means it’s not just about a passport number but cryptographically proving the person is in possession of their passport.
Considering what's a stake for citizens and the govt, one wonders would it make sense to partner with a commodity hardware manufacturer and split the cost of the device? Use recyclable parts and encourage people to return them for a fee?
"The most difficult part of the process - confirmation of ID - was not being done through an automated process: applicants didn't have to use the controversial app to scan their passports. Of those who voluntarily decided to use it 30% FAILED."
And as various people have pointed out, unless a deal appears in a really short timeframe, all 3m EU nationals living in the UK will have to go through this process in order to continue working or renting in the UK. https://www.bbc.co.uk/news/uk-politics-46035919
Well, the Minister for Immigration said that "new immigration controls - including employer checks of immigration status - will apply to EU citizens next year" to the Select Committee, but it's routine for ministerial statements to be countermanded the next week, so who knows? It's not as if there are penalties for error or incompetence.
This strikes me as an extreme form of premature optimization.
This seems like the sort of thing that should be rolled out to council offices, the Post Office, somewhere like that (libraries, as stated in the post).
Or (and!) airports (they already have the infrastructure!).
Let's maybe not spend 1.5 million per device though. That's something like 10-30 software dev salaries, per location. Graft?
The Home Office has also signed a £91m contract with French company Sopra Steria to set up computer terminals at 56 local libraries around the UK to help those without smartphones, or without the necessary digital skills, to apply to stay in the UK.
How about - user completes everything else on their iPhone, app generates a code, user asks Android owning friend to download companion app: SaveMyIPhoneOwningEuroFriendsBacon.apk, friend enters code and scans passport?
Same reason why Apple isn't compatible with my bank. Apple wants to lock their NFC chip. And make lots of money with their ridiculous transaction fees in the process obviously.
Dont blame them, but people will choose Android over it.
47 comments
[ 1.8 ms ] story [ 78.7 ms ] threadThe problem could be that they require a different data format then the NFC Data Exchange Format (NDEF) as that is the only format that CoreNFC supports.
iOS apps can access NFC capablities on devices with that have appropriate hardware support, but from what I understand the CoreNFC API has some limitations.
For example, it doesn't provide a way to read an RFID'c unique ID without using a private API that would disqualify an app from being published on the app store. There's some information about this at [1] and [2]. CoreAPI can read NDEF tags, but they don't expose the UID.
Perhaps the Home Office's app needs the UID of the passport's embedded RFID? I don't know why they might want this, or why Apple restricts the ability to read it. Privacy concerns?
[1] https://www.taptrack.com/article/blog/core-nfc-2/
[2] https://stackoverflow.com/questions/51822226/corenfc-not-rea...
You need to do a proper cryptographic handshake with the passport, something impossible with the current SDK. You need to be able to send raw “APDUs” (commands) to the smart card/passport.
Is this available via a private API in CoreNFC? Is that what they're asking for?
Edit:
> and by the way, passports don’t have one
Thanks - I didn't know that. Now reading about Pseudo-Unique IDs.
Seems like there are some classes in the SDK that hint at that but so far they don’t work (presumably they require an entitlement that only Apple can provide).
I am sure you can see the advantages?
> The Home Office has also [planned] to set up computer terminals at 56 local libraries around the UK to help those without smartphones, or without the necessary digital skills, to apply to stay in the UK.
Just £1.625 million per library? Does that seem a crazy amount to anyone else?
Its astounding you didn't infer that.
> libraries.org includes 4982 public libraries in the United Kingdom
Does anyone know how the NFC in a passport works? If it just communicates the passport number, then it seems like they could allow a fallback where the user types in the passport number, without any loss of security.
(Because if that is how it works, all you're really proving is knowledge of the passport number, not possession of the passport)
EDIT: According to this StackOverflow post[0] the NFC reader needs to supply the passport number, date of birth, and expiry date before it can retrieve whatever data is on the passport, so it can't work the way I described.
[0] https://security.stackexchange.com/questions/30772/what-nfc-...
Furthermore, not everyone thinks the Home Office or the government in general is making a good faith effort to do this competently.
This goes double for anything involving IT or negotiating with other countries.
Government: 'Great let's base our whole system on this'
:|
https://developer.apple.com/documentation/corenfc
I just played with the Yubico iOS SDK just the other day and it supports my Yubikey 5 flawlessly.
Wrong. The Home Office should have checked with Apple before developing the app.
"The most difficult part of the process - confirmation of ID - was not being done through an automated process: applicants didn't have to use the controversial app to scan their passports. Of those who voluntarily decided to use it 30% FAILED."
And as various people have pointed out, unless a deal appears in a really short timeframe, all 3m EU nationals living in the UK will have to go through this process in order to continue working or renting in the UK. https://www.bbc.co.uk/news/uk-politics-46035919
Well, the Minister for Immigration said that "new immigration controls - including employer checks of immigration status - will apply to EU citizens next year" to the Select Committee, but it's routine for ministerial statements to be countermanded the next week, so who knows? It's not as if there are penalties for error or incompetence.
This seems like the sort of thing that should be rolled out to council offices, the Post Office, somewhere like that (libraries, as stated in the post).
Or (and!) airports (they already have the infrastructure!).
Let's maybe not spend 1.5 million per device though. That's something like 10-30 software dev salaries, per location. Graft?
Dont blame them, but people will choose Android over it.