The border guards are usually polite and tell me there's nothing wrong with my passport (not that they would tell me if I were on a watchlist). This only happens at Heathrow, all other machines read my passport fine. I can even read my passport's NFC chip on Linux.

I was following the instructions to use the gates - specifically this one:

After 3 failed attempts, it told me to seek assistance. As there were lots of free gates, I decided to test a theory.

I went to a different gate, inserted my passport, and held it down with my left hand. The gate successfully read my passport and let me through.

What's the difference between my left and right hand? On my left, I wear my wedding ring, on my right, I wear an NFC ring!

As far as I can tell, the ePassport Gate is only expecting one NFC response to its query. That's pretty reasonable. I suspect it prevents people holding two different passports in the reader. Most other eGates that I've used don't require the passport to be held down; they pull it in.

So, there you have it. If you wear an NFC ring, or have an NFC implant, be aware that it can cause "card clash" which could confuse passport readers.

First of all, Google is lying. It does meet security standards and it is not rooted. I get that I have no right to run someone else's software in an environment they don't like, but this is just misinformation. 3rd party OSes are often more secure that a stock OS which has been left to rot by an unresponsive manufacturer.

Anyway, here's how you can use contactless payments on Graphene.

Prerequisites

I'm going to tell you what I did. If you found another way, leave a comment or write your own blog post.

I'm using the latest version of Graphene (2025062000) with Play Services installed. The app is running in my main profile. None of the advanced app protection has been toggled for the app. NFC is on.

You will have to agree to Curve's privacy policy. And the privacy policy of your credit card. Look, if you're using Graphene, you're probably overly privacy sensitive. If you're concerned about The Man™ knowing that you used your card to buy a breakfast beer and then sharing that with 958 trusted partners, just use cash instead.

Install Curve

Here's a referral link to install Curve - join and you get £10. Or, you can install directly from the Play Store.

You'll need to create an account and pass KYC / AML checks. Curve are regulated by the FCA so you should feel safe giving your details to them.

Add a card

Curve is a virtual card provider. So add your existing Visa or MasterCard to the app (no Amex). When you spend on Curve, you're actually spending on the underlying card you've added. Curve promise cheaper foreign exchange fees and a few other perks. But what we're really interested in is NFC payments.

Set up Curve Pay

On your app's dashboard, you should see a banner saying "Curve Pay is good to go!". If not, head into your account and set it up there.

If it has all set up, you should see a welcome tutorial explaining how contactless works.

Set your default wallet

On your phone, go to Settings → Connected devices → Connection Preferences → NFC → Contactless Payments.

Or, search your settings for Pay.

Select your default wallet app - in this case, Curve.

Pay for something

You need to make sure NFC is turned on before you can use NFC payments. I know that sounds obvious, but I forgot to do it the first time and got very confused.

Go to a local shop, pick up something, hand it to the merchant, wave your phone over the payment terminal like you are a technowizard from the future.

Enjoy eating whatever you paid for!

That's it!

Once you're done, you can turn of NFC if you're paranoid.

Apparently, Curve also works with Garmin Smart Watches - but I don't have one to test out.

If you've found this blog post useful, I'd be grateful if you signed up with my referral link for Curve.

I can now read all the passport information, including biometrics.

Background

The NFC chip in a passport is protected by a password. The password is printed on the inside of the physical passport. As well as needing to be physically close to the passport for NFC to work⁰, you also need to be able to see the password. The password is printed in the "Machine Readable Zone" (MRZ) - which is why some border guards will swipe your passport through a reader before scanning the chip; they need the password and don't want to type it in.

I had a small problem though. I'm using my old passport¹ which has been cancelled. Cancelling isn't just about revoking the document. It is also physically altered:

Cut off the bottom left hand corner of the personal details page, making sure you cut the MRZ on the corner opposite the photo.

So a chunk of the MRZ is missing! Oh no! Whatever can we do!?

Recreating the MRZ

The password is made up of three pieces of data:

1. Passport Number (Letters and Numbers)
2. Date of Birth (YYMMDD)
3. Expiry Date (YYMMDD)

Each piece also has a checksum. This calculation is defined in Appendix A to Part 3 of Document 9303.

Oh, and there's a checksum for the entire string. It's this final checksum which is cut off when the passport cover is snipped.

The final password is: Number Number-checksum DOB DOB-checksum Expiry Expiry-checkum checksum-of-previous-digits

Python code to generate an MRZ

If you know the passport number, date of birth, and expiry date, you can generate your own Machine Readable Zone - this acts as the password for the NFC chip.

def calculateChecksum( value ):
    weighting = [7,3,1]
    characterWeight = {
        '0': 0, '1': 1, '2': 2, '3': 3, '4': 4, '5': 5, '6': 6, '7': 7,  
        '8': 8, '9': 9, '<': 0, 'A':10, 'B':11, 'C':12, 'D':13, 'E':14, 
        'F':15, 'G':16, 'H':17, 'I':18, 'J':19, 'K':20, 'L':21, 'M':22, 
        'N':23, 'O':24, 'P':25, 'Q':26, 'R':27, 'S':28, 'T':29, 'U':30, 
        'V':31, 'W':32, 'X':33, 'Y':34, 'Z':35
    }
    counter = 0
    result = 0
    for x in value:
        result += characterWeight[str(x)] * weighting[counter%3]
        counter += 1
    return str(result%10)

def calculateMRZ( passportNumber, DOB, expiry ):
    """
    DOB and expiry are formatted as YYMMDD
    """
    passportCheck = calculateChecksum( passportNumber )
    DOBCheck      = calculateChecksum( DOB )
    expiryCheck   = calculateChecksum( expiry )
    mrzNumber  = passportNumber + passportCheck + DOB + DOBCheck + expiry + expiryCheck
    mrzCheck = calculateChecksum( mrzNumber ).zfill(2)
    mrz =  passportNumber + passportCheck + "XXX" + DOB + DOBCheck + "X" + expiry + expiryCheck + "<<<<<<<<<<<<<<" + mrzCheck
    return mrz

print( calculateMRZ("123456789", "841213", "220229") )

Can you read a cancelled passport?

I would have thought that cutting the cover of the passport would destroy the antenna inside it. But, going back to the UK guidance:

You must not cut the back cover on the ePassport

Ah! That's where the NFC chip is. I presume this is so that cancelled passports can still be verified for authenticity.

Cryptography and other security

The security is, thankfully, all fairly standard Public Key Cryptography - 9303 part 11 explains it in excruciating levels of detail.

One thing I found curious - because the chip has no timer, it cannot know how often it is being read. You could bombard it with thousands of password attempts and not get locked out. Indeed, the specification says:

the success probability of the attacker is given by the time the attacker has access to the IC, the duration of a single attempt to guess the password, and the entropy of the passport.

Can you brute-force a passport?

Wellllll… maybeeeee…?

Passports are generally valid for only 10 years. So that's 36,525 possible expiry dates.

Passport holders are generally under 100 years old. So that's 3,652,500 possible dates of birth.

That's already 133,407,562,500 attempts - and we haven't even got on to the 1E24 possible passport numbers!

In my experiments, sending an incorrect but valid MRZ results in the chip returning "Security status not satisfied (0x6982)" in a very short space of time. Usually less than a second.

But sending that incorrect attempt seemed to introduce a delay in the next response - by a few seconds. Sending the correct MRZ seemed to reset this and let the chip be read instantly.

So, if you knew the target's passport number and birthday, brute forcing the expiry date would take a couple of days. Not instant, but not impossible.

Most commercial NFC chips support 100,000 writes with no limit for the number of reads. Some also have a 24 bit read counter which increments after every read attempt. After 16 million reads, the counter doesn't increment. It could be possible for a chip to self-destruct after a specific number of reads - but I've no evidence that passport chips do that.

Is it worth brute-forcing a password?

If you were to brute-force the MRZ, you would discover the passport-holder's date of birth. You would also get:

• A digital copy of their photo,
• Their full name,
• Their sex²,
• The country which issued their passport, and
• Their nationality.

All of that is something which you can see from looking at the passport. So there's little value in attempting to read it electronically.

Installing

As mentioned, I'm using https://github.com/roeften/pypassport

The only library I needed to install was pyasn1 using pip3 install pyasn1 - your setup may vary.

Download PyPassport. In the same directory, you can create a test Python file to see if the passport can be read. Here's what it needs to contain:

from pypassport import epassport, reader

#   Replace this MRZ with the one from your passport
MRZ = "1234567897XXX8412139X2202299<<<<<<<<<<<<<<04"

def trace(name, msg):
    if name == "EPassport":
        print(name + ": " + msg)

r = reader.ReaderManager().waitForCard()

ep = epassport.EPassport(r, MRZ)
ep.register(trace)
ep.readPassport()

Plug in your NFC reader, place your passport on it, run the above code. If it works, it will spit out a lot of debug information, including all the data it can find on the passport.

Getting structured data

The structure of the passport data is a little convoluted. The specification puts data into different "Data Groups" - each with its own ID.

By running:

ep.keys()

You can see which Data Groups are available. In my case, ['60', '61', '75', '77']

• 60 is the common area which contains some metadata. Nothing interesting there.
• 61 is DG1 - the full MRZ. This contains the holder's name, sex, nationality, etc.
• 77 is the Document Security Object - this was empty for me.
• 75 is DG2 to DG4 Biometric Templates - this contains the image and other metadata.

Dumping the biometrics - print( ep["75"] ) - gives these interesting pieces of metadata:

'83': '20190311201345',
'meta': {   'Expression': 'Unspecified',
            'EyeColour' : 'Unspecified',
            'FaceImageBlockLength': 19286,
            'FaceImageType': 'Basic',
            'FeatureMask': '000000',
            'FeaturePoint': {0: {'FeaturePointCode': 'C1',
                                'FeatureType': '01',
                                'HorizontalPosition': 249,
                                'Reserved': '0000',
                                'VerticalPosition': 216},
                            1: {'FeaturePointCode': 'C2',
                                'FeatureType': '01',
                                'HorizontalPosition': 141,
                                'Reserved': '0000',
                                'VerticalPosition': 214}},
            'Features': {},
            'Gender': 'Unspecified',
            'HairColour': 'Unspecified',
            'ImageColourSpace': 'RGB24',
            'ImageDataType': 'JPEG',
            'ImageDeviceType': 0,
            'ImageHeight': 481,
            'ImageQuality': 'Unspecified',
            'ImageSourceType': 'Static Scan',
            'ImageWidth': 385,
            'LengthOfRecord': 19300,
            'NumberOfFacialImages': 1,
            'NumberOfFeaturePoint': 2,
            'PoseAngle': '0600B5',
            'PoseAngleUncertainty': '000000',
            'VersionNumber': b'010'
        }

If I understand the testing document - the "Feature Points" are the middle of the eyes. Interesting to see that gender (not sex!) and hair colour are also able to be recorded. The "PoseAngle" represents the pitch, yaw, and roll of the face.

Saving the image

Passport images are saved either with JPEG or with JPEG2000 encoding. Given the extremely limited memory available photos are small and highly compressed. Mine was a mere 19KB.

To save the image, grab the bytes and plonk them onto disk:

photo = ep["75"]["A1"]["5F2E"]
with open( "photo.jpg", "wb" ) as f:
   f.write( photo )

As expected, the "FeaturePoints" co-ordinates corresponded roughly to the centre of my eyes. Nifty!

What didn't work

I tried a few different tools. Listed here so you don't make the same mistakes as me!

mrtdreader

The venerable mrtdreader. My NFC device beeped, then mrtdreader said "No NFC device found."

I think this is because NFC Tools haven't been updated in ages.

Jean-Francois Houzard's and Olivier Roger's pyPassport

I looked at pyPassport but it is only available for Python 2.

beaujean's pyPassport

This pypassport only checks if a passport is resistant to specific security vulnerabilities.

d-Logic

Digital Logic's ePassport software only works with their hardware readers.

Android reader

tananaev's passport-reader - works perfectly on Android. So I knew my passport chip was readable - but the app won't run on Linux.

Is it worth it?

Yeah, I reckon so! Realistically, you aren't going to be able to crack the MRZ to read someone's passport. But if you need to gather personal information³, it's perfectly possible to do so quickly from a passport.

The MRZ is a Machine Readable Zone - so it is fairly simple to OCR the text and then pass that to your NFC reader.

And even if the MRZ is gone, you can reconstruct it from the data printed on the passport.

Of course, this won't be able to detect fraudulent passports. It doesn't check against a database to see if it has been revoked⁴. I don't think it will detect any cryptographic anomalies.

But if you just want to see what's on your travel documents, it works perfectly.

I want to add an NFC reader to it.

So, step one was to find an NFC circuit board which worked with the hardware and was relatively small.

Enter the ACM1252U-Z2. It works perfectly with Linux. It has a USB-Micro socket - but a USB-C OTG cable allowed it to work with the Framework.

It is about as small as they come - but will it fit?

Thanks to Alexey for sending me some 3D printed samples of the Framework expansion plugs, I was able to make a bit of progress.

The board is slim enough in height and width to fit into to the casing:

But it will stick out rather alarmingly:

It's useful to have the antenna that far out - but I'm worried about bumping it.

What about under the casing of the main laptop? There are two spacer units which can be removed, and there is access to the internal USB connectors under the numpad.

Will it fit? The answer, again, is… oooh! Just about!

If the trackpad was moved left, there'd be plenty of room horizontally.

It will still need something sturdy covering it - and that will need to be transparent to RF.

So here are my next thoughts:

1. Can I (or someone else) desolder the USB-Micro plug and solder on a USB-C OTG plug?
2. Is having a protruding expansion going to be annoying or dangerous?
3. How hard would it be to replace the spacer and wire directly into the vacant USB pins under the numpad?

If you have answers to these questions - please drop a comment in the box.

This is the ACR1251T-E2 - it's a USB pen-drive sized NFC reader with a side-out USB-A plug. Costs about £40.

There's a recessed green LED which flashes to let you know that it is working. It doesn't beep or vibrate when it detects an NFC token. It is a little bit tricky finding the antenna as the internal circuitry slides down the plastic housing - as can be seen in these internal photos

There's a lanyard hole at the end, and a plastic clip so you can attach it to things.

Linux support is flawless. Running lsusb shows 072f:224f Advanced Card Systems, Ltd ACR1251 CL Reader PICC

And running pcsc_scan gives the same information: 0: ACS ACR1251 CL Reader [ACR1251 CL Reader PICC] 00 00

Sadly, it wasn't detected by libnfc 1.8.0 ☹

Using the FIDO2 HID Bridge I was able to use my NFC Ring to log in to various websites.

It's a solid enough unit. The plastic housing is sturdy and not easily damaged. You can't get in to the shell without a spludger.

The only downsides are that it uses USB-A - we're in the C era now! - and that the sliding mechanism obscures the antenna position. But, if you want to carry a discreet USB stick with you for NFC purposes, there's nothing better.

This is the ACM1252U-Z2 and Oh! It is a dinky little component!

The only sign that it is working is a flashing green LED. There's no buzzer on the board. It really is a tiny thing. Side on it is almost invisible.

Does it work with Linux? Oh yes! It has a Micro-USB port, so I got a USB-C OTG cable. I plugged it into my laptop and ran lsusb - which shows it as 072f:223e Advanced Card Systems, Ltd ACR1252 Reader

Running pcsc_scan gives pretty much the same information 0: ACS ACR1252 CL Reader [ACR1252 Reader PICC] 00 00

It wasn't detected by libnfc 1.8.0 ☹

Using the FIDO2 HID Bridge I was able to use my NFC Ring to log in to various websites.

The antenna seems pretty sensitive. It read my ring from about a centimetre away though a cardboard sleeve. I think the debug port is the "J3 nRF USB" - but I can't find many details about wiring it up.

So, will it fit in the Framework laptop? Perhaps. If I could solder on a USB-C jack, it would still stick out 2.5cm - so a 3D printed protector would still be needed.

Alternatively, as suggested by Stephen Early it might be possible to hook it in to the spare USB 2.0 ports. And, if the size is right, stowing it beside the touchpad.

But, first, I need to wait for my laptop to ship 😂

The board costs about £35

For example, Framework sells an official HDMI card and Ethernet card:

But the community have built their own SD card expansion pack as well as 3D printed snack drawers:

Brilliant!

I have an NFC-only authentication token which I want to use when I log in with my laptop. I currently have a USB-C NFC reader which I could use, but it is a bit big and bulky.

Is it possible to fit an U2F capable NFC reader into a FrameWork expansion slot?

Size of expansion cards

This was a bit tricky to find. Based on this GitHub page, I think the maximum internal dimensions of a circuit board are about 26mm x 29.7mm. Tight!

According to this video from Framework about the cards shows the maximum size of the physical cards.

All the cards use a USB-C connector which sits proud of the card itself.

Potential Hardware

First up is this tiny NFC reader. It is designed for phones, and costs about a fiver. The dimensions look like it would might fit if the plastic shell were removed. But the description says:

Output 4/7 bytes of chip serial number, UID only

So no good for doing U2F. But it does at least show that reading an NFC card ought to be possible in a small form factor.

There are component USB-C readers

That one would easily fit - but the description says it is for reading only. So I don't think it can send the cryptographic challenges necessary.

Then there's the ACM1252U-Z2 - Small NFC Reader Module which costs about £60.

It is a much more capable reader. It uses micro-USB rather than USB-C, which isn't insurmountable using a flexible male-male cable. What about the dimensions?

Certainly thin enough! But about twice as long as we need. Could we chop off the end? What's on the other side of that empty space?

Ah! A honking great antenna. If it could be bent at 90°, it would "only" stick up 2.5cm. Which would be ugly, but not disastrous.

Then there is the ACR122T which is in thumb-drive format.

That might work. The antenna is probably in the bulbous end. The official schematics don't give much clue.

But if we look in the FCC Database there are some internal photos!

Ignoring the USB jack, the board is about 50mm long. That would leave about 2cm sticking out of the side of the laptop. Which isn't too bad. The width is within what we need. There's even an updated version with a slightly different spec.

I could buy an A-to-C converter which would add unwanted extra length. I wonder how hard it is to unsolder the connector and mount a USB-C one?

This video makes it look relatively simple.

But, given the weirdness with resistors, it might be easier to use an OTG Shim.

I could rip that apart and solder it on to the board. Or perhaps just solder on a USB-C OTG board. Maybe?

I guess it is time to buy some components and try not to break them! If you have any advice or suggestions, please let me know!

It's a cheap and light plastic box with a short USB cord. When you plug it in, there's a flashing light which can't be disabled. When it is powered up, or it detects and NFC chip, it makes this weird and scratchy beep:

On Linux, it shows up as: 072f:223b Advanced Card Systems, Ltd ACR1252 Dual Reader

To get it working, install PCSC Tools and the PCSC Daemon:

sudo apt install pcsc-tools pcscd

To start the daemon:

service pcscd start

Running pcsc_scan detected the reader as two readers - PICC and SAM

Using reader plug'n play mechanism
Scanning present readers...
0: ACS ACR1252 1S CL Reader [ACR1252 Dual Reader PICC] 00 00
1: ACS ACR1252 1S CL Reader [ACR1252 Dual Reader SAM] 01 00

Putting tokens on and off the reader showed them being detected and removed.

Despite my best efforts, I was unable to get this working with libnfc.

nfc-list uses libnfc 1.8.0
No NFC device found.

For reading and writing basic NDEF tags, I used Wakdev's NFC tools, I was also able to use various Python scripts like PCSC NDEF

It also worked with a FIDO2 / HID Bridge so I could use an MFA token.

There's lots of documentation about the reader and its API as well as some official ACS Linux tools. In theory it supports firmware update - although none have been released.

It's a cheap and cheerful device. It would be nice if there were a way to stop the flashing LED and crappy buzzer.

I'm also not a fan of PassKeys⁰. It feels weird to me that my computer is the password. I get the theoretical way it works - but it rubs me up the wrong way.

So, Yubikeys? I find them an annoyance. I never have my keys to hand - which sort of defeats the purpose of them.

A little while ago, I wondered "Where are the U2F Rings?" If I could have a wearable MFA token, that would solve many of my issues¹.

Enter the Cybernetic Z1 Encrypter Ring. It is a US$300 zirconia ring with a built-in range of JavaCard-based NFC apps - including the ability to unlock your Tesla². It is powered by the VivoKey Apex chip (NXP JCOP 4 P71) which provides all the security and functionality. Your money also gets you an NFC reader/writer which connects to your computer via USB. The team have sent me a demo version of the ring to review on the proviso that I give them feedback.

Demo

Here's a quick video showing how it works:

The Good

It works! Seriously, in a world of vapourware and vaguely-worded Kickstarters, it is refreshing to have a product which actually delivers. I was able to enrol it on my BitWarden account and then use it to log in - all via my Android phone. Similarly, I tested it working with Amazon, BitWarden, CodeBerg, Discord, Gandi, GitLab, GoDaddy, Google, PorkBun, Proton, WordPress and a few others.

It's a good looking, plainly designed, unibody ring. It is waterproof and survived the daily abuse I give my hands. It was washed with soap and blasted with a hand-dryer and it kept on chugging. No need to recharge it either - NFC runs off the power of radio waves like magic.

It is completely smooth, no built in scanners or LEDs or power-ports. The antenna appears to be all the way around the ring - so you can use either side of your finger on a scanner.

There is an Android app which you can use to send information to the ring. That's designed for being able to share contact details and has a generous 4KB of storage³.

But, the nice thing is, you don't need the app! By default the ring will work as a FIDO2 token suitable for logging in to a variety of services.

The code on the Ring is (somewhat) Open Source. You can write your own JavaCard applets and load them on to the ring.

The Bad

It works well... until it doesn't. Mostly this is a criticism of FIDO2. I initially was unable to use the ring with GitHub: I tried both Firefox and Chrome but got the same error. Similarly, CoinBase wouldn't register the key and didn't tell me why.

I contacted the Ring's manufacturer and they sent me details of a firmware update which claimed to fixed the issue.

Google worked - but gave me this rather weird default name and icon: I was able to rename it, but the icon can't be changed.

Amazon had the same issue, but with no way to rename.

Both LinkedIn and WhatsApp would only let me create a phone-based PassKey. They didn't give me a prompt to scan my NFC ring.

NFC only is also a bit of a limitation. Until every laptop comes with built-in NFC, you'll need to use a dongle / reader if you want to use the ring. For a phone or tablet with NFC, you're fine. Well, as long as you know where your phone's NFC reader is!

The Android app isn't open source, which feels like a bit of a missed opportunity. It is pretty bare-bones, only providing the ability to add contact details and see how much free storage and RAM there is. In the future, the app promises to offer "Smart PGP" and a few other services.

The contact card stuff is a bit underwhelming. Rather than embed a VCARD, it takes users to a separate website which has your contact details on it.

Weirdly, it zips the content of your contact details and uses them to populate the website with data. Because there's only a limited amount of space available, contact images end up very pixellated. The website also uses external JavaScript without using SRI - which isn't what I'd expect from a security focussed company.

If you use a 3rd party NFC app, you can change the NDEF share to be any URl you want. I think that's probably a sensible thing to do.

Obviously, $300 is a chunk of change. You can buy a basic U2F USB/NFC key for £20 - £50. So, with this, you're paying a higher price for a small-run product with a niche form-factor.

The Ugly?

Do you want to wear jewellery? The Z1 is plain black and unobtrusive - unlike the garish designs of some fashion rings - but perhaps a few different styles and colours would be nice?

I already wear a wedding ring, so having another to wear wasn't too much of an adjustment. The ring comes in a number of US ring sizes, so you may need to compensate if you're used to a different sizing system. However, it is a bit of a chunky beast. You will certainly notice it while wearing it.

Would an attacker rip it off your finger or even chop your finger off? It is a niche risk - but if you're using this to digitally safeguard your billions of crypto-riches, worth thinking about.

Updates

The Z1 Encrypter runs JavaCard applets so, in theory, you can load any compatible app onto it. By default, it runs Bryan Jacobs' FIDO2Applet. It recently received an update which should make it work with GitHub.

To install or update apps, you'll need the Fidesmo Android app or iOS app.

WARNING! Before installing a new app, you have to destroy the old one. This will wipe all your previous registrations.

However, I just couldn't get this to work. I tried using the Fidesmo app to uninstall the Tesla applet - but it failed.

Despite it asking me to uninstall again, there was no option to do so.

I find it a bit weird that the Ring relies on a 3rd party app to do this. I'd much rather see it built into the same app which controls the ring.

Security

By default, the ring has no password set on its internal memory. That means you can write whatever content you want to the NDEF share. Of course, this means someone sat next to you can also change your saved URl! If you use the Fidesmo app, you can lock the contents of the share. Once locked it cannot be overwritten unless you destroy the applet.

So I was able to change the default URl to one I controlled, and I was able to lock it.

But anyone with the Fidesmo app can delete any applet on your ring. Simply open the app, tap the phone against the ring to read the data, select the app you want to delete, and hold the phone against the ring for a few seconds.

It isn't unobtrusive. You'd probably notice someone clutching your hand for a several seconds. But you probably wouldn't notice if you were asleep.

The only damage is rendering your PassKey inoperable. So you would have to revert back to using a different 2FA method. An attacker couldn't steal your data, but they could provide a denial of service attack on you.

It would be great if the ring came with a password. However, there is the risk that if you lost your own password, you'd be unable to write data to it.

I am unqualified to audit the hardware security. If an attacker had physical access to the Ring, could they crack it open and extract the keys from hardware? I don't know.

Linux Support & Open Source

The Cybernetic website says the Z1 supports "iOS, Android, Windows. MacOS coming June 2024." But how well does it work with Linux?

There are several open source tools repositories available from VivoKey - although none specifically related to the ring.

I took a look at a bunch of compatible readers and got the ACR1252u-MF (full review later). There are a couple of Linux utilities which claim to work as NFC U2F readers - but the only one I could get working was Bryan Jacob's FIDO2 HID Bridge. Installing was a bit of a faff (yay various Python incompatibilities) and using it means invoking an obscure command on the terminal. But... it worked!

I registered the ring on a service using my Android device, then I was able to sign in to the same service using Firefox on Linux!

Even better - I was finally able to register the ring with GitHub! And, once I'd registered it using Linux, I could sign on with Android. HASHTAG INTEROPERABILITY!

The Broken

And then I kinda broke it. Somehow, the Fidesmo app ended up locking the entire card. Everything still worked - both NDEF and WebAuthN - but I couldn't update the firmware or applets. On the one hand, no one can wipe my OS! But on the other, I can't load new software or fix any bugs.

NFC is fragile technology. Send the wrong obscure command to the device and it will behave unpredictably.

Final Verdict

For a certain type of nerd, this is awesome. It doesn't have aggressive "geek-chic" branding - it just quietly lets you augment your body with a useful bit of tech. Now I don't need to search for my key-ring every time I want to log into a secure service.

The flaws with this product are mostly to do with the ecosystem. Mostly.

U2F / FIDO2 / Whatever is pretty nifty technology. When it works, it is just like magic. Wave your hand near your phone and you are authenticated.

When it doesn't work, you might get stuck in a loop trying to work out why things are going wrong. It's terrifyingly easy to accidentally break something.

FIDO2 is still a pain. Do you know the difference between CTAP1 and U2F, or how they relate to WebAuthn? Does your favourite service support 2FA at all? Are you happy running a Python script on the CLI if you want to log in?

But that's not the ring's fault. It is early days for the tech and there are teething troubles.

The built-in contact-card portion of the ring is a bit daft. Pointing users to a 3rd party site doesn't seem like the right call for the type of people who'll buy this. I'm glad it could be pointed to a site that I control - albeit by using a different app to write the data.

I got used to wearing the ring after a few days, and it was the exact size that I requested. Although it is chunky, it is a subtle piece of jewellery and unlikely to draw unwanted attention. There are no LEDs or batteries to worry about.

Despite the teething issues and the price, I'm rather keen on this. Waving my hand next to my phone to exchange cryptographic information makes me feel part-way to being a cyborg-wizard. Is this the future of wearable technology? I don't know - but it is rather fun. I'm happy to be an early-adopter and to bash out the bugs in the tech.

If you want, VivoKey will also sell you an NFC Implant which you can inject under your skin and use as an MFA token. Personally, I think I'll stick with the ring!

You can buy the ring directly from Cybernetic.

I use a USB thumb-drive sized hardware token and they're nifty - but a little impractical.

Since the great working from home experiment, I don't have my keys on me at all times. This means my Yubico Neo sits on a keychain, in a pocket of a coat which is rarely worn. So every time I need to use U2F to authenticate with a service, I have to trek around the house trying to remember where I last saw my keyring.

Wouldn't it be great if I could wear my Yubikey? Some high-tech jewellery would be fab!

To be clear, this isn't an original idea:

Joanna Rutkowska

@rootkovska

Anyone could recommend a U2F-compatible NFC ring (as in: jewellery)?

(Additional requirements: not bulky, women sizes; silver, not gold pls :)

---

And some people do wear their keys as pendants.

There are also Yubikey earrings:

*:･ﾟ✧ Samantha ✧･ﾟ:*

@samantha_gold

Working late in the labs on these yubikey earrings! eeee! pic.x.com/fdto5ksdwz

---

So why not a ring? A ring doesn't take up much space on the body, they're rarely taken off, and they're socially acceptable jewellery for most people.

A basic NFC ring costs less than two pounds! But it doesn't have the necessary processing power for U2F.

The OMNI ring is £70 and looks like it has the right hardware. But, sadly, they appear to be incompatible with the FIDO specification.

The cheapest FIDO2 U2F NFC key is about £30. So it shouldn't be impossible to put the hardware into a more aesthetically pleasing form factor.

Token were planning to release a WebAuthn ring "soon" - but with no price nor predicted availability. Their social media hasn't been updated in two years. Similarly, Motiv were planing on releasing a WebAuthn ring - but they got bought by a company called Proxy - who have since fallen into a Web3 hole never to be heard of again.

So - this is my version of Cunningham's Law. If I blog saying something doesn't exist - some smartarse will immediately post a link to some Shenzhen store selling them for a quid each!

There are no WebAuthn rings - or other jewellery-like form factors. And that sucks.

I want to tap my phone against an NFC tag hidden in LP sleeve. Then I want my phone to automatically launch the Spotify app and for the app to display that album.

This should be simple, but I can't get it to work.

Get the album link

Spotify gives me an option to copy the album link, or Spotify URI.

Either:

• https://open.spotify.com/album/6QaVfG1pHYl1z15ZxkvVDW
• spotify:album:6QaVfG1pHYl1z15ZxkvVDW

So, I should be able to launch either of those and get my album, right? Wrong!

Thinking of linking

If I write the https link to an NFC chip, my Android phone opens it in the default browser. There is no option to launch the app from the browser. I've told Android that it should associate open.spotify.com links with the Spotify app, and to use the app to open them by default.

URIah Heap

If I write the spotify: link to an NFC chip, my Android phone opens the Spotify app! To the default Spotify page. It doesn't open the album.

Other things I've tried

• spotify://6QaVfG1pHYl1z15ZxkvVDW opens default app page
• Plain text records - displays the text, but no way to click on it.

And every other bloody combination I can think of!

I've asked in the Spotify community but no one has answered. I also tried asking on StackOverflow but no one knew the answer.

There is an Instructables project which gives some help but concludes that you need a separate app to manage the task flow. Similarly, there are tutorials for adding Spotify NDEF parsing to your own app. But both of these assume I want to install something else onto my phone. I don't. I just want Android to open the correct app to the correct screen.

What's causing this?

Spotify's Android manifest says it supports NDEF, but just using the Spotify scheme. The NDEF doesn't have any paths defined, whereas the http version does.

Maybe that means that Android doesn't pass the info?

If I click on an open.spotify.com link - in a browser or elsewhere - then the Spotify app opens to the correct page.

Perhaps that means that Android's NFC parser sees a URI and passes it directly to the browser, rather than via a system intent?

I dunno, I'm at the edges of my knowledge here.

Help?

Update! Spotify engineers have confirmed that the manifest is at fault. No ETA for a fix.

I had this gorgeous Barret Biggers - Link Blot poster which had lain in a drawer for far too long. So I turned it into an Amiibo.

Nestled in the corner, sandwiched between the print and the glass, is an NTAG215 chip.

Using the open source TagMo app for Android, I've written the data of one of my Nintendo amiibo to the chip. Now, in the middle of an epic battle on Breath of the Wild, I can run up to the artwork, awkwardly hold the JoyCon in just the right place, and get a much needed power up! Sweet!

What's the point?

YOU'RE NOT MY REAL DAD, JEFF! YOU CAN'T TELL ME WHAT TO DO WITH MY LIFE!

Geez sport, I was only askin'. Wanna tell me what's really on your mind?

You wouldn't understand...

Try me...

Other uses

My ridiculously talented cousin, the artist Judi Lapsley Miller creates the most brain-bending bird-based artworks.

Hidden in the corner is another NFC tag. Tap it, and it goes directly to the artwork's homepage.

Visibility

NFC suffers from several problems - most of which can be solved by using a QR code.

• The tag needs to be visible. That white circle is a little incongruous. I could have hidden it behind the paper, but then no one would know it was there, and they wouldn't know where to place their phone.
• Where is your phone's sensor? Do you know? If not, you'll be rubbing your phone all over the glass, attempting to find it.
• Physical contact is damaging to artwork. NFC is "contactless" - but if you ever watch people pay for things with their phone, they often slam it down on the reader. Not what you want on your art.
• NFC is expensive. Between 50p - £2 per chip, depending on model. QR just requires black ink and white paper.
• Limited data. The NTAG215 holds 504 bytes. QR codes can hold 8x that amount.

Basically, for anything other than an amiibo, QR codes still win.

So, there you go, I have created an impractical video game accessory. Where is my VC funding?

So, I've been sent 20 NTAG 215s to review.

First thing's first, these cost a pound each! The 215s are in a supply shortage at the moment, but even buying in bulk, you'll only get down to about 50p per tag.

A plain white sticker, printed with black ink for a QR code, is much cheaper. But there is an undeniable magic to NFC - hover your phone nearby and something happens!

Quick Review

With an Android phone, you can quickly and easily write 504 bytes of data to a tag. There's no sticker, but they're light enough to stick to just about any surface with a dab of glue. Don't put them on metal though, or you won't be able to read the tag.

The tags can be password protected, which is handy if you want to keep the contents from being overwritten from someone without the 8 character password. You can also permanently write-lock the tags - this cannot be removed.

I tried them on a couple of Android phones and they worked quickly and easily.

They're 35mm in size, which makes them easy to spot when stuck to a surface and gives you a reasonable target size if you don't know where your phone's sensor is. They are plain white. But the surface is shiny plastic - so you can write on them with a soft pencil or a felt-tip pen.

The exact model number is NT2H1511G0DUx - which is widely compatible.

They're small enough and thin enough to hide in clothes, shoes, or anything that you might need to claim ownership of. The plastic feels pretty durable and will take some effort to break.

The price is a little high but included next-day delivery.

Tech Specs

You can read the whole specification on NXP's website.

The main things you probably care about are:

• 504 bytes of data.
• Lockable.
• Password Protected.
• Read Counter.
• Compatible with Amiibo.

504 bytes is long enough for almost any URl. Obviously, you're not going to be flinging tonnes of data around with this, but it's a little disappointing that it's not long enough for, say, a PGP key.

The tags are optionally lockable. That means that once written to, they cannot be overwritten. Ever. Handy if you're going to put them out in public. You don't have to use that feature.

Password protection means that you can set a specific memory area of the chip to require a password to overwrite. You can also set an AUTHLIM number which limits the number of authentication attempts. If you go over it, the chip self-destructs. Well, it renders the memory portion unreadable. The password has a maximum length of 8 characters.

There's a 24 bit counter to tell you how often the chip has been read. This seems like overkill - 24 bits is capable of counting to ~16 million! Still, it can be helpful to see which of your tags is most popular. If you're using a URl, you can set a counter on that as well - so it automagically appends ?ctr=000001 the first time it is scanned, ?ctr=000002 the second, etc.

Finally, the main reason people seem to buy this specific model is that it is compatible with Nintendo's Amiibo platform. If you're unaware of Amiibo - they're figurines you can buy, shaped like a game character. They have an NFC tag in their base, and when you hold them against your games console, they give you an in-game upgrade.

There are a bunch of open source tools to enable you to clone an Amiibo and write it to a fresh tag. How weird that we're now able to "pirate" physical products!

Using them

According to Adam Nybäck's open source NFC reader, the chip supports the following standards:

• NfcA
• MifareUltralight C
• Ndef

Luckily, NFC is an open protocol - so you can find lots of apps which will write data to the chips.

NXP are the manufacturer of most of the world's NFC tags, their Android app is pretty good. With a couple of taps, you can set the payload and write it to the tag.

Usability

Do you know where your phone's NFC sensor is? With a bit of trial and error you can easily find it. But if you want to use your tags to share data with other people's phones, it is a bit more complicated.

You either have to slowly and sensuously stroke the back of the phone until it gives a little jolt of excitement, or laboriously hold your tag over likely spots for a few seconds.

Because the chip is small, and lots of phones have cases which attenuate the signal, placement needs to be quite precise.

iPhones

Bloody Apple! They finally have NFC in their latest models, but you need to install an app to read tags. Once done, it is quick to scan and open tags.

There is no way to write a tag using an iPhone.

Final Word

These are basically fine. It would be nice if they had a sticker on one side. But they're thin and light. I still think QR codes are faster, better, and cheaper. But the ability to write-protect information, and the built in counters, are undeniably useful.

Perhaps next year is the year of Linux on the desktop NFC on the iPhone?

Buy! Consume! Enjoy!

Buy 20 NFC tags on Amazon for £20. Or don't. I'm not in charge.

This review unit was supplied by NiceRebate.

tl;dr Overwriting a tag can leave old data intact, and still readable.

Here's the decoded memory layout of a tag with data written to it. In this case, a (failed) experiment at storing a JavaScript pop-up.

# NDEF message:
[00] D1 01 7D 55 00 64 61 74 61 3A 74 65 78 74 2F 68 |.␁}U␀data:text/h|
[10] 74 6D 6C 3B 63 68 61 72 73 65 74 3D 75 74 66 2D |tml;charset=utf-|
[20] 38 2C 25 33 43 25 32 31 44 4F 43 54 59 50 45 25 |8,%3C%21DOCTYPE%|
[30] 32 30 68 74 6D 6C 25 33 45 25 33 43 62 6F 64 79 |20html%3E%3Cbody|
[40] 25 33 45 25 33 43 73 63 72 69 70 74 25 33 45 61 |%3E%3Cscript%3Ea|
[50] 6C 65 72 74 25 32 38 25 32 32 68 69 25 32 32 25 |lert%28%22hi%22%|
[60] 32 39 25 33 42 25 33 43 25 32 46 73 63 72 69 70 |29%3B%3C%2Fscrip|
[70] 74 25 33 45 25 33 43 25 32 46 62 6F 64 79 25 33 |t%3E%3C%2Fbody%3|
[80] 45                                              |E               |

As the experiment didn't work, I decided to rewrite the tag with some much shorter data. Here's the new message.

# NDEF message:
[00] D1 02 36 53 70 91 01 12 55 00 68 74 74 70 73 3A |.␂6Sp.␁␒U␀https:|
[10] 2F 2F 65 64 65 6E 74 2E 74 65 6C 51 01 1C 54 02 |//edent.telQ␁␜T␂|
[20] 65 6E 54 65 72 65 6E 63 65 27 73 20 63 6F 6E 74 |enTerence's␠cont|
[30] 61 63 74 20 64 65 74 61 69 6C 73                |act␠details     |

But that's not the whole story! The above is the NDEF (NFC Data Exchange Format) message which has been decoded. Let's look at the full memory layout:

# Memory content:
[00] *  04:01:2A A7 (UID0-UID2, BCC0)
[01] *  62:F4:48:81 (UID3-UID6)
[02] .  5F 48 00 00 (BCC1, INT, LOCK0-LOCK1)
[03] .  E1:10:12:00 (OTP0-OTP3)
[04] .  03 3B D1 02 |␃;.␂|
[05] .  36 53 70 91 |6Sp.|
[06] .  01 12 55 00 |␁␒U␀|
[07] .  68 74 74 70 |http|
[08] .  73 3A 2F 2F |s://|
[09] .  65 64 65 6E |eden|
[0A] .  74 2E 74 65 |t.te|
[0B] .  6C 51 01 1C |lQ␁␜|
[0C] .  54 02 65 6E |T␂en|
[0D] .  54 65 72 65 |Tere|
[0E] .  6E 63 65 27 |nce'|
[0F] .  73 20 63 6F |s␠co|
[10] .  6E 74 61 63 |ntac|
[11] .  74 20 64 65 |t␠de|
[12] .  74 61 69 6C |tail|
[13] .  73 FE 00 00 |s.␀␀|
[14] .  64 79 25 33 |dy%3|
[15] .  45 25 33 43 |E%3C|
[16] .  73 63 72 69 |scri|
[17] .  70 74 25 33 |pt%3|
[18] .  45 61 6C 65 |Eale|
[19] .  72 74 25 32 |rt%2|
[1A] .  38 25 32 32 |8%22|
[1B] .  68 69 25 32 |hi%2|
[1C] .  32 25 32 39 |2%29|
[1D] .  25 33 42 25 |%3B%|
[1E] .  33 43 25 32 |3C%2|
[1F] .  46 73 63 72 |Fscr|
[20] .  69 70 74 25 |ipt%|
[21] .  33 45 25 33 |3E%3|
[22] .  43 25 32 46 |C%2F|
[23] .  62 6F 64 79 |body|
[24] .  25 33 45 FE |%3E.|
[25] .  00 00 00 00 |␀␀␀␀|
[26] .  00 00 00 00 |␀␀␀␀|
[27] .  00 00 00 00 |␀␀␀␀|
[28] .  00 00 00 BD (LOCK2-LOCK4, CHK)
[29] .  04 00 00 FF (CFG, MIRROR, AUTH0)
[2A] .  00 05 -- -- (ACCESS)
[2B] +P FF FF FF FF (PWD0-PWD3)
[2C] +P 00 00 -- -- (PACK0-PACK1)

You can see the new data is at the start, then there is a gap, and then the remainder of the old data is present!

This is due to this line:

[05] .  36 53 70 91 |6Sp.|

The 36 is the Payload Length - in this case 0x36 bytes of data. In other words, the header says "This data is 54 bytes in length".

Most phones' built-in NFC readers grab the first part and correctly interpret it and stop there.

But using a reader like NXP Tag Info will allow you to see all of the data hidden in the tag.

So, go around scanning NFC tags (if you can find any), and see what leftover data is still present.

To ensure this doesn't happen to you, make sure to erase and format any tags before rewriting them.

Terence Eden is on Mastodon

@edent

Replying to @edentMy nails contain a URl! pic.x.com/MmOvnlqt0u

---

I have a small NFC chip sandwiched between my finger and a fake nail. NFC - Near Field Communication - is the magic which makes your contactless credit card / Oyster card work. The chip contains a tiny amount of data. When it gets near an electromagnetic source - like a phone - it begins to broadcast the data. When your phone receives the data, it does something with it.

It is important to note, that there is no special app running on my Android phone. Decoding the chip's data is built-in functionality.

The chips cost between £2 - £5 on Amazon - that's a per-nail price. There are bulk discounts available on eBay. You will also need to buy nail glue, polish (if you want a different colour), and removal fluid. The things we do for fashion, eh?

Tech Specs

The chip is made by NXP and is the NTAG213 model. More specifically, the snappily named NT2H1311G0DUx.

According to Adam Nybäck's open source NFC reader, the chip supports the following standards:

• NfcA
• Ndef - NFC Data Exchange Format
• Mifare Ultralight type C

The Ultralight C gives us 106kbps transmission speed - which may seem slow, but the chip is limited to 144 bytes of memory. Better make your URls small! The chip can be written to 10,000 times and has unlimited reads. It uses 3DES for authentication - which I don't fully understand. You can also write protect the chip once you've written data to it.

Finally, each chip also has a 7 byte unique serial number - so you can tell your phone to "do something when you see chip with ID abcd567". For that, you will need a separate app on your phone.

The app

To program the nails, you'll need an app. Jakcom's nail-specific app doesn't appear on the Play Store. Based on the poor reviews for their other app, you're not missing much! You can download it directly - but it asks for ridiculous permissions, so best avoided.

Luckily, NFC is an open protocol - so you can find lots of apps which will write data to the chips.

NXP are the manufacturer of most of the world's NFC tags, their Android app is pretty good. With a couple of taps, you can set the payload and write it to the tag.

Stick 'em on!

If, like me, you're inexperienced with applying fake nails - there's a handy tutorial:

Because you're gluing the chip to the nail, and using acetone to remove it, don't expect these to be reusable. They are relatively fragile - so find a flat bit of your fingernail to stick them to.

The included fake nails were too small for my giant hands - hence why it is stuck to my little finger.

What can it do?

I've set mine to broadcast my contact website.

There are a whole lot more functions, as this video demonstrates:

Security

There is a small security risk with some of the functions. You can tell the phone to call a number, send a text, or an email - but the user has to confirm the action.

Riskier is Bluetooth and WiFi pairing. Long seen on Bluetooth headphones, you can tell a phone to connect to a specific Bluetooth or WiFi device. Again, the user should have to confirm the action - but that will depend on the phone.

Most phones only activate NFC when the screen is on and the device unlocked - so you should be aware that something is interacting with your device.

Different models

The manufactures, Jakcom, have three different models.

• N2F - carries some "information". The phone can then use that to run an app, launch a browser, or similar. That's what I'm using.
• N2L - a light-up chip. Once your finger gets close to a power source, it will light up. Cute!
• N2M - this can, theoretically, hold any data that you can copy from an existing smartcard. So you could embed your work access pass into your thumb. The legality and practicality of this is something I've not explored.

I would love a combined N2F/L chip. I like the idea of my nails flashing multiple colours as that transmit data through the æther.

Usability

Do you know where your phone's NFC sensor is? With a bit of trial and error you can easily find it. But if you want to use your nails to share data with other people's phones, it is a bit more complicated.

You either have to slowly and sensuously stroke the back of the phone until it gives a little jolt of excitement, or laboriously hold your finger over likely spots for a few seconds.

Because the chip is small, and lots of phones have cases which attenuate the signal, placement needs to be quite precise.

Many years ago I wrote about the usability of NFC compared to QR codes - nothing much has changed. At least handing over a business card is more socially acceptable than demanding someone scan my finger.

iPhones

Bloody Apple! They finally have NFC in their latest models, but you need to install an app to read tags. Once done, it is quick.

Terence Eden is on Mastodon

@edent

Replying to @edentMy NFC finger works on iPhone!
(If you install the NXP tag reader app.) pic.x.com/K6Nmcwhbol

---

There is no way to write a tag using an iPhone.

Raw Info

After scanning the chip with the NXP TagInfo app, this is the technical readout:

-- NDEF ------------------------------

# NFC data set information:
NDEF message containing 1 record
Current message size: 59 bytes
Maximum message size: 142 bytes
NFC data set access: Read & Write
Can be made Read-Only

# Record #1: Smart Poster record:
Type Name Format: NFC Forum well-known type
Short Record
type: "Sp"
    # URI record
    type: "U"
    * protocol field: [none]
    * URI field: https://edent.tel
    # Text record
    type: "T"
    * encoding: UTF-8
    * lang: "en"
    * text: "Terence's contact details"
Payload length: 54 bytes
Payload data:

[00] 91 01 12 55 00 68 74 74 70 73 3A 2F 2F 65 64 65 |...U.https://ede|
[10] 6E 74 2E 74 65 6C 51 01 1C 54 02 65 6E 54 65 72 |nt.telQ..T.enTer|
[20] 65 6E 63 65 27 73 20 63 6F 6E 74 61 63 74 20 64 |ence's contact d|
[30] 65 74 61 69 6C 73                               |etails          |

# NDEF message:
[00] D1 02 36 53 70 91 01 12 55 00 68 74 74 70 73 3A |..6Sp...U.https:|
[10] 2F 2F 65 64 65 6E 74 2E 74 65 6C 51 01 1C 54 02 |//edent.telQ..T.|
[20] 65 6E 54 65 72 65 6E 63 65 27 73 20 63 6F 6E 74 |enTerence's cont|
[30] 61 63 74 20 64 65 74 61 69 6C 73                |act details     |

# NDEF Capability Container (CC):
Mapping version: 1.0
Maximum NDEF data size: 144 bytes
NDEF access: Read & Write
 E1 10 12 00                                     |....            |

-- EXTRA ------------------------------

# Memory size:
144 bytes user memory
* 36 pages, with 4 bytes per page

# IC detailed information:
Full product name: NT2H1311G0DUx
Capacitance: 50 pF

# Version information:
Vendor ID: NXP
Type: NTAG
Subtype: 50 pF
Major version: 1
Minor version: V0
Storage size: 144 bytes
Protocol: ISO/IEC 14443-3

# Configuration information:
ASCII mirror disabled
NFC counter: disabled
No limit on wrong password attempts
Strong load modulation enabled

# Originality check:
Signature verified with NXP public key

-- FULL SCAN ------------------------------

# Technologies supported:
ISO/IEC 14443-3 (Type A) compatible
ISO/IEC 14443-2 (Type A) compatible

# Android technology information:
Tag description:
* TAG: Tech [android.nfc.tech.NfcA, android.nfc.tech.MifareUltralight, android.nfc.tech.Ndef]
* Maximum transceive length: 253 bytes
* Default maximum transceive time-out: 618 ms


# Detailed protocol information:
ID: 04:01:2A:62:F4:48:81
ATQA: 0x4400
SAK: 0x00

# Memory content:
[00] *  04:01:2A A7 (UID0-UID2, BCC0)
[01] *  62:F4:48:81 (UID3-UID6)
[02] .  5F 48 00 00 (BCC1, INT, LOCK0-LOCK1)
[03] .  E1:10:12:00 (OTP0-OTP3)
[04] .  03 3B D1 02 |.;..|
[05] .  36 53 70 91 |6Sp.|
[06] .  01 12 55 00 |..U.|
[07] .  68 74 74 70 |http|
[08] .  73 3A 2F 2F |s://|
[09] .  65 64 65 6E |eden|
[0A] .  74 2E 74 65 |t.te|
[0B] .  6C 51 01 1C |lQ..|
[0C] .  54 02 65 6E |T.en|
[0D] .  54 65 72 65 |Tere|
[0E] .  6E 63 65 27 |nce'|
[0F] .  73 20 63 6F |s co|
[10] .  6E 74 61 63 |ntac|
[11] .  74 20 64 65 |t de|
[12] .  74 61 69 6C |tail|
[13] .  73 FE 00 00 |s...|
[14] .  00 00 00 00 |....|
[15] .  00 00 00 00 |....|
[16] .  00 00 00 00 |....|
[17] .  00 00 00 00 |....|
[18] .  00 00 00 00 |....|
[19] .  00 00 00 00 |....|
[1A] .  00 00 00 00 |....|
[1B] .  00 00 00 00 |....|
[1C] .  00 00 00 00 |....|
[1D] .  00 00 00 00 |....|
[1E] .  00 00 00 00 |....|
[1F] .  00 00 00 00 |....|
[20] .  00 00 00 00 |....|
[21] .  00 00 00 00 |....|
[22] .  00 00 00 00 |....|
[23] .  00 00 00 00 |....|
[24] .  00 00 00 00 |....|
[25] .  00 00 00 00 |....|
[26] .  00 00 00 00 |....|
[27] .  00 00 00 00 |....|
[28] .  00 00 00 BD (LOCK2-LOCK4, CHK)
[29] .  04 00 00 FF (CFG, MIRROR, AUTH0)
[2A] .  00 05 -- -- (ACCESS)
[2B] +P FF FF FF FF (PWD0-PWD3)
[2C] +P 00 00 -- -- (PACK0-PACK1)

  *:locked & blocked, x:locked,
  +:blocked, .:un(b)locked, ?:unknown
  r:readable (write-protected),
  p:password protected, -:write-only
  P:password protected write-only

--------------------------------------

Buy! Consume! Enjoy!

Buy smart fingernails on Amazon. Or don't. I'm not in charge.

Further Reading

Tanya Fish on Make Magazine

@baybedoll@infosec.exchange

@Baybe_Doll

New nails for @defcon - 2x MiFare Classic 1K, 2x NTAG 210, 1x NTAG 213, 1x NTAG 215 (as Princess Peach Amiibo), 1x ICODE SL2 ICS20, and 4x NFC LED #DefconNails #DEFCON26 pic.x.com/CCmFF7n4z9

---

I notice that Moo are now selling NFC enabled business cards. As regular readers know, I'm not a great fan of NFC - mostly because it's so expensive. The NFC cards are £1.20 each - the regular cards cost just 26p each!

What if we change the idea of what a business card is? Why do I need to hand over a physical bit of dead tree in order to exchange contact information? That's dumb.

Last week I was at the Over The Air hackference. While there, I was lucky enough to grab a few "Physical Web" beacons from Ilario Gressi of Google.

Is there some way to turn them into a high-tech business card?

Yes. Yes there is.

What Is An iBeacon?

There are a lot of misconceptions around iBeacons. Bluetooth Low Energy (BLE) is a version of Bluetooth which is specifically designed to be efficient at broadcasting small amounts of data.

An iBeacon simply transmits an ID number via BLE. That's it. When your phone hears the broadcast, it looks up the ID and does something with it. The typical use case is that it alerts your Coffee Shop's app as to which branch you are in.

Google's Physical Web project does something much more interesting with iBeacon technology. Rather than just broadcasting an ID, it (ab)uses the Advertising Packets to broadcast a URl!

How It Works

I carry around a Physical Web beacon on my keyring. I've programmed it with the URl of my .tel website. It spends all day broadcasting that message via BLE.

If you have Android's Physical Web app, or iOS Chrome - your phone should display a persistent notification showing all the nearby beacons.

Or, you can open up the app and see a list of nearby beacons.

One click (either in notification or app) and it takes you directly to a website with my digital business card.

Fantastic!

Issues

The Physical Web specification is still evolving - and this BLE Business Card idea isn't without problems.

• Beacons are expensive. Around £20 each - or US$50 for 3. More expensive than NFC, but you keep the beacon rather than hand them out.
• URl length is limited to 144 bits. That's really short. I've suggested using a 7-bit alphabet, but it seems that the preferred solution is to use a URl shortener.
• Web addresses only. You can't directly embed an email address, phone number, or BitCoin link - just web.
• Limited hardware support. Just like NFC - you need a phone with the right chips in it. And you need an app. (*mutters darkly about how QR codes only need a camera lens. And an app...*)
• Battery life. BLE beacons should last 2 - 5 years on a single coin cell. NFC has no battery - it is powered by the phone - so should last forever. Similarly, QR Codes will last ask long as their ink sticks to paper.
• Size. A Physical Web beacon isn't small. Not as big a business card holder, true, but not quite small enough for a key-ring.
• Business cards, for all their faults, provide a physical memento of an interaction. A ritualised exchange takes place which, culturally, may carry more semantic weight than merely scanning the æther for nearby signals.
• Finally, I'm pretty cool being the only person in the room with a BLE Business Card - but what's it like when everyone has one? At the conference we set up loads of Physical Web beacons at once - and the app quickly became full of every beacon in a 75m radius:
  
  Theoretically, the app will sort by whichever signal is the strongest - which should mean that if I'm standing next to you, your app will pick my card first. But no guarantees.

So, not perfect - but certainly a neat way to broadcast your identity to nearby people. With BLE making its way into more and more devices, it's certainly possible that it will overtake NFC as the primary way to discover and exchange data.

I encourage you to contribute to the Physical Web spec and apps, as well as to EddyStone which is part of the underlying technology. You can buy Physical Web beacons or, if you're feeling adventurous, build your own BLE beacons.

I've been tracking the rise of QR codes in advertising for several years now. People keep asking me when NFC will take over for "boring" QR codes - based on the few live NFC examples I've seen in the UK, NFC will be trailing QR for several more years.

Let me talk you through TAP4offers' latest "effort".

The poster is fairly clear about what to expect - although I initially thought that I'd have to stretch to the top of the carriage to scan the NFC tag!

Thankfully, that's not the case. Beside every exit were these combined NFC / QR / SMS stickers. The NFC tag and QR code each had a unique tracking URL, so the owner of the service (Gunars Vucens) can see which method is being used the most. Judging from the URL and the printed information, I would guess each train carriage has a unique code.

Once the code is scanned - this happens.

What - as the kids say - The Fuck? I've no idea how much it costs to do a deal with South West Trains - but someone has wasted their money!

This is the same mistake that Clear Channel made on their QR/NFC posters.

Why bother with this? Seriously? What's the point of installing all these codes? They've been there for months - disappointing everyone who interacts with them.

Despite the advertiser's promise of a relaunch, nothing seems to be happening with these codes.

Gunars

@gunnars_v

New and upcoming #TAP4offers is due to change and expand rapidly in following weeks, keep and eye out! #nfc #tap4 #offers

---

Logo Problems

As well as the general uselessness of the destination, there is another flaw with the service.

Firstly, there's yet another NFC logo! Proxima's report to the GSMA already identified half a dozen common logos. GSMA NFC Logo, NFC Forum's N-Mark, ClearChannel's NFC Mark, etc. etc.

So, overall, a pretty pathetic effort.

If NFC is to overcome its significant obstacles - price, hardware requirements, lack of public awareness - the campaigns underpinning it must be better than this.

Spotted all over London are these bus stops with built in advertising poster. Look on the right hand side, and you'll see the interactive element.

It's pretty well designed, although the disclaimer "standard network rates apply" seems a little redundant - and weirdly placed. The QR code is oddly rotated, but that's just my personal preference.

The QR code is large enough to scan easily in broad daylight. If the code was integrated with the poster, it would also been backlit which would have been helpful when it is dark. The NFC scanned easily - once I'd flipped my phone's settings on.

Using a call to action of "Tap" and "Scan" assumes that the users will know what to do - and how to get an app if they need it.

The QR and the NFC both go to unique URLs - helpful for Clear Channel to see from where the hits are coming.

But what happens when you scan the hybrid QR/NFC?

This abomination....

What The Juddering Fuck? Why on Earth would you deploy dozens of these interactive adverts and then not point them anywhere useful? Even if the campaigns aren't ready, couldn't Clear Channel point to their YouTube Channel, or their Twitter feed, or anything!

Some people are going to interact with this poster and come to the conclusion that there's nothing worthwhile to be gained by attempting to scan again.

Clear Channel are really shooting themselves in the foot by deploying this before their technology is ready.

The Boy Whatley recently posted about his new favourite NFC toy - the Nokia MD-310 (catchy name, guys!). That reminded me - there was an interesting use of NFC which I'd seen in Las Vegas.

Las Vegas - like most of the developed word - is full of QR codes. They're on fliers, printed on t-shirts, in all the magazines, and on all the posters.

NFC - being cumbersome and expensive - is conspicuous by its absence. However, I did spot some posters up in a couple of the casinos.

Apparently, this NFC sticker would only work with Samsung Galaxy Phones! Luckily I had one on me, eh?

The posters were huge, but the target area which allows you to interact with them is tiny!

The misaligned sticker - sorry TecTile™®© - was just waiting for me! Like most people, I turned off NFC on my phone. I don't need it draining my battery on the off-chance I pass a poster at a casino... Now, what do I need to do in order to make it work?

Brilliant!

Still, I persevered, delved in to the bowels of my phone, fiddled with the settings, held my phone against the TecTile™®©, and waited. Waited a bit longer. Took my phone out of its case, aligned it better with the TecTile™®© and... Bingo!

It's actually a fairly nifty little site. But it's a bit of a palaver to get to it. You need to have one of the few phones on the market which supports NFC (I mean, surely even Samsung aren't stupid enough to make the TecTile™®© work only with Samsung phones, are they?). You need to enable NFC. Then you need to get as physically close as possible, get the exact alignment between the TecTile™®© and the NFC aerial on your phone.

Sure, with QR codes you need to have the app installed - but that's pretty low bar compared to NFC.

Still, I suppose it's nice to see a new technology out there in the wild.

If you want to buy some Samsung TecTile™®©s - they cost $15 for a pack of 5.

Your black and white printer will spit out as many QR codes as you like for a lot less than that.

I'm a long term fan of QR codes. I know some people don't like the idea of augmenting reality with specific tags for computer vision - but I do. Some people prefer RFID/NFC. Others still prefer dedicated augmented video apps.

As I've written many times before, QR codes have several substantial advantages over alternate technologies.

• QR is a free and open standard.
• Compatible with every phone with a camera.
• No need to build or use a dedicated app.
• Free to generate.

Today, in the canteen, I think I have found the quintessential example of just how radical the open simplicity of QR codes is.

Tiny sachets of salt an pepper. Created in their millions. Given away for free the world over. Each stamped with a unique ID which can be recognised easily by a computer.

For scale, this is how small they are.

Now, I'll be the first to admit that a website about salt is not the most riveting thing in the world. But that's exactly the point! The costs associated with setting this up are close to zero. Amortized over every sachet it's probably less than the cost of a grain of salt.

There's no opportunity cost lost - what else could you stick on the side of a packet that small?

I like the fact that I can instantly see nutritional information and can certainly see it being more useful on larger items. But, again, that's the point. QR codes are free - so you might as well stick them on everything.

It's this dual freedom - free to generate and free to print - which makes QR codes ubiquitous.

The main problem with NFC (aside from lack of readers, inability for a user to tell a tag is present, proximity needed, etc) is cost. Even bought in bulk, those little RFID chips have a price. Buying 20,000 of them to stick on salt packets is an extravagance an unlikely to see any ROI to offset the cost of buying the chips and changing the manufacturing process to incorporate them. Not to mention that the chips can't be recycled easily.

QR Codes? Black ink. If you're already printing onto a surface, QR codes don't require any retooling or any equipment purchases.

I know that in our modern world we often strive for technical excellence, innovation, and quality. However, where there are two relatively compatible technologies, it is usually the cheaper technology which wins.

In many of the more relaxed civilizations on the Outer Eastern Rim of the Galaxy, the Hitchhiker's Guide has already supplanted the great Encyclopaedia Galactica as the standard repository of all knowledge and wisdom, for though it has many omissions and contains much that is apocryphal, or at least wildly inaccurate, it scores over the older, more pedestrian work in two important respects. First, it is slightly cheaper; and second, it has the words "DON'T PANIC" inscribed in large friendly letters on its cover. —Hitchhiker's Guide to the Galaxy

The Internet of Things will be powered - in part - by QR codes. Try not to get too upset about it.