Using your Apple device as an access card in unsupported systems

The fact that Apple even considered "closing" a general purpose standard like NFC is a testament to how much they are willing to drag their feet on any innovative customer-facing features.

You'd think that it was common sense to avoid that, but we are talking about the company that invented DRM for the USB protocol...

My guess is that there's some city or transit system which needs the UID to be static for one reason or another, like in order to avoid double charging the same user if they accidentally scan their card multiple times.

The T-Union card definitely has other means of doing that, like by checking the card serial, which is stored in one of the files, or by getting the same static UID value as it is also reported in RATS.

But in the end, seems like one of the important transit partners did not want to even bother fixing it, so Apple was forced to allow the static UID.

It really shows how big companies like Apple, who like to talk about "privacy" and "security", are willing to bend over backwards, if this means getting access to the revenue stream. AFAIK they get a percentage cut of transit card top ups, and Chinese market is obviously massive.

For comparison, from what I've heard, when it comes to implementing the same transit feature in the US or in the EU, Apple is extremely strict with their partners. They may even tell their partners that they're unwilling to work with them unless they fully re-implement their transit card standard stack using other technology, or to format their cards differently, even if they are fully secure. The reasoning is, depending on how big the project is, is that Apple may not want to bother with porting the Applet implementation (in case of niche card standards), or writing a new card state parser (for existing card types like Mifare, which can be 'formatted' and store data differently, even if they use the same protocol).

Given the UID is the same every time, I can assume it’s to make surveillance easier?

> Does this mean that the other systems’ cards are easily cloned? This seems very insecure, if so.

Broadly, yes, almost all NFC based access systems are insecure and pretty broken. They mostly operate via security via obscurity, and the fact that anyone serious about security that deploys these systems will put a huge amount of effort into identifying one of an actually secure systems. More likely they will pair the NFC element with multiple other secure elements, such as photo badges, big security humans that demand people keep their badges visible, and card + pin entry on all important access points.

A big part of the reason why these Apple Wallet systems have taken so long to appear is because Apple seems to refuse to integrate with any system that isn’t built using secure cryptography. Turns out there aren’t many systems out there that use strong cryptography, rather than cryptographic systems that have been broken for decades.

Actually getting information on how any particular system actually provides its “security” is extremely difficult. Mostly you have to figure it out by being familiar with the different systems out there, and different NFC systems. Then it’s possible to parse the marketing terms into actual technical specifications that might give a hint at how a system works. The only sure fire way to find out, is to buy parts of the system (such as access tokens or readers), and evaluate the hardware using various NFC and RFID hacking tools to figure what manner of awful design this particular system uses.

They specifically write that this only supports UID based authentication. So, the card answers with the same unique ID every time.

UniFi has support for this, but seemingly not by default.

This solution also doesn’t allow you to clone an existing card. You actually need the admins to add the UID of your Chinese transport card to their system.

Your question is answered in the article.

Hi, I'm the author behind the article referenced in this post.

As far as I know, Ubiquiti is not responsible for this 5$ per year "tax".

Apple takes about 3$ per user per year for usage of "Apple Access Platform", and the rest is spent for licensing the credential technology, like to NXP for Mifare DESFire in this case.

It's SSO tax applied to hardware devices. But at the same time, it's clearly a more premium feature and if you're a business you've got the $5000/year to pay for 1000 devices. $5/device/year is not exactly expensive. Heck, I'd pay Ubiquiti $15/year for my family to be able to use it at home. That's less than I pay for almost any subscription for anything.

What I can’t figure out is why the old readers, which clearly read NFC cards, can’t work to read iPhones, which emit NFC.

I understood in the past that iPhones weren’t supported because of the limitations described in the article. I figured once Apple opened up the system and Ubiquiti actually implemented it (both of which have now happened) that the old readers would work.

Although irritating, I’d consider paying $5/user/year, but I’m not about to rip out 6 card readers that I just installed.

> It just seems like a slow boil into subscriptions for a company whose entire value prop is prosumer networking without the contracts.

On the other side... look at the status quo in access control systems. If you never did, be happy you never had to because the status quo is shit because the entire ecosystem is suffering from a severe lack of money - for physical locks, most people buy the cheapest shit they can get at Home Depot or whatnot, and for "fancy" stuff involving smartphones they do just the same, or order right from Alibaba. And that is a damn horror show.

Ubiquiti, for all I dislike the trend for recurring revenue everywhere, at least makes high quality and secure stuff - but with anything interconnected, keeping updates available costs recurring expenses. So it's either "the product is cheap ass and will likely have multiple bypasses in a year or two", "the product is extremely expensive but you will get updates for a reasonable time" or "the product is affordable, but costs recurring money".

Just because you like you walk with 1000 things in your pocket doesn't mean everyone else likes it too. Stop being a luddite.