Pixel 3 Global NFC Evolution

Reader feedback and discussion from my earlier post analyzing the fuzzy state of iPhone 7 FeliCa and its possible support of Apple Pay Octopus, resulted in some interesting information about the Pixel 3 Japanese FeliCa model. From FeliCa Dude’s epic Reddit Octopus on iPhone 7 post:


<reader comment> Regarding the Pixel though, are you sure that the non-Japanese Pixel 3 models even have an eSE <embedded secure element>? I was under the impression that these were HCE <host card emulation> only.

<Felica Dude answer> All the Pixel 3 devices have an eSE, but it might not be able to be enabled by the end-user, and even if it is possible, it won’t be provisioned. A teardown of the global edition Pixel 3 XL (G013C) reveals a <NXP> PN81B.

The NXP PN81 announced in February is all-in-one off the shelf global NFC chip that includes both the frontend NFC A-B-F hardware and the necessary embedded secure element (eSE) + keys for EMV, FeliCa and MIFARE. The odd thing is that the Google Pixel 3 Japanese model apparently doesn’t use the PN81 for FeliCa, and has a separate FeliCa chip sitting in the fingerprint sensor assembly inside the back case.

Google Pixel 3 JP SKU iFixit teardowns do not exist but I did run across an interesting article from the Keitai Watch site showing a Pixel 3 JP SKU being taken apart for repair at an iCracked repair shop.

Just for kicks, I called the iCracked shop and asked about repairing a faulty FeliCa Pixel 3 device. The Pixel 3 repair technician explained that a FeliCa chip replacement was not expensive because it is not on the motherboard, “it’s attached to the fingerprint sensor assembly.” Look carefully at the picture from Keitai Watch piece and you can see the back case with fingerprint sensor assembly that the technician was referring to.

Disassembled Pixel 3 JP model from Keitai Watch

This presents a very strange situation. All Pixel 3 SKUs have the FeliCa ready PN81 chip but don’t use it, while Pixel 3 Japan SKUs apparently have another separate FeliCa chip attached to the back case finger sensor assemble. Google alludes to this on the Pixel 3 support page: If you purchased your Pixel 3 or Pixel 3a phone in Japan, a FeliCa chip is located in the same area as the NFC. There is also the recent batch of Pixel 3a Japan SKUs with bad FeliCa chips, but reports of bad NFC (EMV) Pixel 3a international SKUs have not surfaced; this also suggests a separate FeliCa chip. Why have two FeliCa chips in a device when one will do?

My take is different from FeliCa Dude: the Pixel 3 does not use the PN81 eSE or ‘pie in the sky’ HCE for anything. Instead, Google Pixel 3 uses the Titan M chip Secure Enclave as the virtual eSE for EMV and MIFARE, similar to what Apple does with the A/S Series Secure Enclave. Titan M FeliCa support was either not ready, or Google wanted to test the Japanese market before making a custom hardware commitment.

The point of all this is that Google has laid the foundation for a global NFC Pixel 4 made possible by a custom Google chip. The Titan M is Google’s answer to Apple’s A/S Series Secure Enclave that can host any kind of virtual embedded secure element for any kind of transaction technology, from EMV to PBOC.

I might be wrong, but even if my virtual eSE on Titan M take is incorrect, taken all together with the NXP PN81 development, I think Pixel 4 will finally be the global NFC Android device that many have hoped for.

Advertisements

iOS 13 and the Transition to Global NFC

Crowd Cast president Takashi Hoshikawa updated his Japan Cashless map introduced back in January, the cacophony of QR Code payment platforms continues to grow. Just like any gold rush, QR will crash and burn at some point. Big players will gobble up the smaller ones and things will settle down.

But something else is going on. There’s a small but important difference, so small that Takashi Hoshikawa is not aware of it: he labeled the FeliCa section in the upper left corner as NFC.

This is the result of using Apple Pay on a global NFC iPhone where all the necessary hardware and software is seamlessly unified. The old plastic card mentality of different walled off technologies: contactless credit card (EMV), transit card (FeliCa, MIFARE), ID card (ISO 7816), NFC A/B or F, etc. slips away and becomes one seamless NFC Wallet in the mind. This mindset is also on display in SearchMan co-founder Naoki Shibata’s recent article on Rakuten Pay Suica: no mention of FeliCa anymore, it’s just one NFC thing.

This is an important and natural, but quiet progression that will accelerate with the enhanced NFC support in iOS 13 and expansion of new services like Apple Pay Octopus. iOS 13 Apple Pay Wallet will set the standard for global NFC that just works, a standard that Google Pay will struggle to match because of Android hardware fragmentation.

Players that leverage the advantages of global NFC and offer new services based on them, like JR East (Inbound Apple Pay Suica), and Mastercard (NFC switching dual mode bank card services) will gain, while companies that stick with the old ‘one thing’ contactless plastic card mentality, like Visa, will lose. It’s that simple.

Visa Japan Finally Ready to Sign on to Apple Pay Japan?

IT journalist Junya Suzuki was answering a question of mine regarding dual mode (EMV/FeliCa) credit/debit cards which are somewhat mainstream, even on Docomo dCard, but the plastic issue Sumi Trust Visa contactless cards are EMV only.

I guess Visa Japan still wants to promote payWave (banded as Visa Touch in Japan) over better customer service. Because if Visa was promoting better customer service, they would offer dual mode for plastic cards and Apple Pay like Mastercard and American Express do.

Visa Japan has yet to sign directly with Apple Pay, the reason why Japanese issue Visa cards don’t work for Apple Pay Suica Recharge, but there may be hope. Suzuki san’s tweet suggests Visa Japan might finally sign with Apple Pay, “in the very near future.”

I certainly hope so, but given that Visa Japan has ‘been in discussions with Apple’ to officially join Apple Pay Japan since the service launched in October 2016, and have done nothing the whole time, I’ll believe it when I see it.

Apple Pay Suica Recharge Performance in iOS 12.4 b4 and the Apple Card Connection

Okay A12 Bionic and FeliCa fans, try this on iPhone XS/XR with Apple Pay Suica on iOS 12.4 b4:

  • Initiate a Suica Recharge
  • While the recharge is processing swipe up and you will feel the haptic feedback bump indicating the recharge process has been cancelled, the Apple Pay ‘ka-ching’ all done sound and checkmark never happens
  • On the Suica Recharge screen tap cancel and go back to the main Suica card screen where the recharge is processing and updates the Suica balance
Apple Pay Suica recharge just keeps on going even after cancellation

So, the Suica Recharge process barrels along without giving feedback. iOS didn’t do this before, is it a bug or a feature, and what’s happening? It’s related to what I observed in the previous post where the Suica FeliCa prepaid transaction and EMV Apple Pay postpay processing happened simultaneously because the A12 Bionic Secure Enclave processes FeliCa transactions directly without iOS.

We now have an explanation why EMV Express Transit went missing in the first few iOS 12.4 beta releases: Apple was doing lots of heavy duty Wallet optimization to make the prepaid recharge process fast and bulletproof.

But why? We have an explanation for that too: Apple wants the Apple Card EMV postpay to prepaid Apple Cash card recharge performance to be fast and absolutely bulletproof. The Apple Cash connection with Apple Card is a huge selling point, and Apple is making damn sure that people are going to love it for the reliable Apple Cash e-money recharge performance, even if that means breaking Suica recharge a little to do it.

This kind of aggressive optimization is a good ‘problem’ for Suica to have, and because all things Suica, from the UI changes to the Express Transit performance improvements since iOS 12.2 have been a testing ground for Apple Card, unavoidable. After all, Apple Pay Suica is the closest thing to Apple Card with Apple Cash that Apple has going, making Suica a great test environment for new Apple Pay development. Hopefully Apple will fine tune and fix remaining Suica recharge issues before the final release and Apple Card debut.

Deep Secrets of Apple Pay Express Transit

Apple Pay Suica on A12 Bionic iPhone XS/XR works even in the middle of a recharge

Apple Pay Suica on A12 Bionic iPhone XS/XR is different from other devices because basic FeliCa transactions bypass iOS and go directly to the Secure Enclave. You can see this in action with Express Transit power reserve, but if you observe carefully you can catch it in other ways.

I caught a glimpse today buying ice coffee at a JR station NewDays shop (supplied by Doutor btw). I was recharging Suica with Apple Pay and forgot it was still processing when I touched iPhone XS to the reader. The payment went through without a problem, the recharge completed a few seconds later.

Is this a iOS 12.4 beta thing or did A12 Bionic iPhone do this all along? I suspect it did all along and makes sense: the payment transaction bypassed iOS which was busy processing the Apple Pay recharge and wasn’t ready to post a balance update to the Secure Enclave. Prepaid and postpay processing at the same time…very interesting.

Most people think all Express Transit is the same, but Suica Express Transit prepaid is very different from EMV Express Transit postpay. Suica settles the transit bill in less than 200 milliseconds (ms) locally right at the transit gate, while EMV Express Transit leisurely (500 ms) tells the gate, ‘I am bank card XXX, put it on the bill’ for settlement later between the bank and the transit agency. For EMV there is a lot of backend system work to make that happen, and even then the user sometimes has to tap twice: