Hacker News new | ask | show | jobs
by locusofself 1107 days ago
Fair enough, there is a "Java Card". I'm not convinved that Java is running on any of my or your credit cards in your wallet today, though I'm not willing to bet on it.
4 comments

It's running on many e-Passports and e-ID cards, i can't find the documentation from my e-ID card which runs on Java, but the chips are quite common like in

https://www.cardlogix.com/product/cardlogix-credentsys-lite-...

And on another source:

Visa became the first large payment company to license JavaCard. Visa mandated JavaCard for all of Visa’s smartcard payment cards. Later, MasterCard acquired Mondex, and Peter Hill joined as their CTO, licensed JavaCard, and ported the Mondex payment platform to JavaCard.

Source: https://javacardforum.com/2022/07/28/the-birth-of-javacard/

This lists a few things using Java Cards (likely stuff that's in your wallet, surprisingly): https://stackoverflow.com/questions/47731005/practical-use-o...

(fwiw I have a bit of prior experience here)

That's pretty neat. It sounds like Java Card (or at least some other cards) actually "boot up" by way of inductive coupling, ie, via the "contactless" card readers where you just hold your card in proximity to the reader thing. Did not know that, I assumed it was just reading a key via NFC or something.
The whole reason there’s a thing called a chip in the card is that it actually does computing (indeed they’re called smart cards) and that it does the sort of computing (cryptographic challenge-response) that makes these cards much more secure than oldschool magnetic stripe cards.

Even fully passive NFC tags contain logic that needs power to talk NFC back to the reader, there’s no such thing as just reading data via NFC.

This is a classic defcon talk about it. They developed their own cell network with their own sim cards for an event and even built custom JavaCard applications their users could use. They have released all their information and tools used to build and compile Java Card software.

https://www.youtube.com/watch?v=_-nxemBCcmU

A lot of people assume this, but with contactless EMV there is a whole transaction flow between the card and the reader going on.

You know those 4 lights on a contactless card reader? They indicate different transaction stages between the card and the terminal. I don’t find them that useful because it’s so fast they all appear to light at the same time, but that’s what they are!

If they were just passive tags, they wouldn’t be very secure, they have cryptographic processors onboard with private keys that can sign stuff for the terminal and your bank. The specs for the interaction are all public if you’re interested (I wouldn’t be!) and lookup contactless EMV.

As far as I know even paying through Apple Pay with your credit card will run that Java Card program.

Though mind you, it is a very limited subset of Java, not the standard one.

Yep, the Secure Element runs little Java applets
Just wait until you find out about the SIM card in your phone!

It's almost bizarre what that thing does.