[nippoo]

Has anyone managed the opposite feat, i.e. made a piece of hardware that can recognise an iPhone over NFC? I'm trying to design control system that relies on you touching your phone to various hardware readers (with some kind of unchanging key/identity), but off-the-shelf MFRC522 etc don't seem to work, and the 'official' Apple way requires an NDA...

[formerly_proven]

NFC has been opened up more in iOS 16 and 17.

Card emulation is a thing now: https://developer.apple.com/documentation/corenfc/cardsessio... (edit: only in the EU)

And iOS as well as iPadOS now also support USB smart card readers. iPads can actually use them to access NFC FIDO tokens. (Why iPads don't have native NFC is completely beyond me, there are so many obvious use cases for it)

[lxgr]

> And iOS as well as iPadOS now also support USB smart card readers.

Oh, that's very cool!

Apple seems to silently be implementing more and more features to make iOS/macOS a full-fledged smart card OS; I've also noticed that FIDO over CCID is now available natively on macOS, and by extension in Firefox and Safari via WebAuthN (which finally lets me use my smartcard form factor FIDO authenticator).

[auston]

Here you go: https://github.com/kormax/apple-vas

If you can send/receive APDUs you're good to go.

[lxgr]

Wow, that's neat!

Do you know if Apple requires any special permissions/entitlements to create VAT passes, or does a normal pass certificate suffice?

[numpad0]

I think you're supposed to make a "Pass", load it on Wallet app, then load the card with double press of side button. You can't just tap a blank iPhone and get its raw hardware ID.

At least Suica train cards(based on FeliCa/NFC-F) on iOS can be read from third party Android apps, and Apple do advertise iPhone feature to store corporate IDs, so the idea of using iPhone for gate tap-in card should be completely fine.

[lxgr]

None of this is accessible to hobbyists, unfortunately – you'll need a special entitlement, certification, your use case to be an approved one etc.

It's not accessible to "regular" app developers in the way it is for Android.

[lxgr]

Without getting into the weeds of programming for the secure element (some non-EEA markets only, NDAs, tons of certifications etc.) or restricting yourself to HCE (available only in the EEA), you could also "flip the model around":

ISO 14443 reader access has been available globally, so if you're fine with having to open an app before an interaction with a reader, you could have the reader perform card emulation, and the phone "read/write" it like a tag, i.e. send APDUs which the device behind it then interprets.