The key to access the Secure Element is not stored on the phone’s memory. Nor can any Android application read or write credit card credentials from the Secure Element. I want to clarify some of these points here so I am not spreading any misinformation about these issues.įirst, Google claims that no Android application–including Google Wallet itself–has access to the credit card credentials stored in the Secure Element. Update: I spoke with Google about some of the issues I mention in this article related to the security of Google Wallet. Jimmy Shah, mobile security researcher at McAfee Labs, points out in a blog post that the secure chip that stores the credit card information uses assymetric encryption for authentication–implying that the Google Wallet app contains the key necessary to authenticate and access the data, and that attackers can hack or reverse-engineer the Wallet app to extract that key.
Have you seen the kinds of passwords people use because they can’t be bothered to remember something more complex? How many Google Wallet PINs will end up being “1111”, or “1234”, or something equally trivial to guess?īut, even with a strong PIN in place, if there is one Android app that can access the encrypted credit card data and process payments, then it is possible for malicious developers to create other apps, or spoof the Google Wallet app somehow to access that sensitive data as well. That alone represents one weak point in the Google Wallet security. Here too, Google has done its part and developed a system that relies on a PIN from the user to open the app or initiate a transaction using Google Wallet. Then comes the weak link–the Android app. Seems secure enough, even if a thief has physical possession of the smartphone. The credit card information is encrypted and the chip itself is tamper proof. But, Android smartphones equipped for NFC mobile payments have a separate chip to store the sensitive credit card data. That credit card data is also stored on the Android smartphone.
0 kommentar(er)
