Develop Bugs

Significant security flaw in Google wallet

There's quite a significant security flaw in Google wallet at the moment.
Going into application settings and then clearing data for wallet is the same as resetting wallet from within the application, without having to enter a pin. Know what that means? You're able to set up a new password and have access to your prepaid card.
That's right. If a tech-savvy thief has your phone and you don't have a passcode on the lockscreen (possibly because Google's implementation of passcode stuff sucks) or the screen hasn't timed out yet, the thief will have access to whatever funds remain on your Google prepaid card, regardless of the pin you set in the application.
This is yet another reason why Google needs to add the ability to lock out INDIVIDUAL applications with a code or face recognition, not just the friggin' lockscreen. If someone gets your phone after you've entered your lockscreen code/pattern, they have free reign over the device as long as the screen is on. Third party software for this purpose just doesn't work very well at this stage. This functionality needs to be integrated into the OS. Sorry for going off on a tangent.
Basically:
1) Go into application settings
2) Clear data for Google wallet
3) Open wallet and set it back up
4) Everything remaining on your Google prepaid card can now be used.

That's a good point I don't know if Google wallet is supposed to more secure than a credit card.
If some one steals your wallet, what do you do? Suspend any transactions for that stolen card. Just do the same with the cards you have on Google wallet.
Or I'd just remotely wipe the phone , so they have none of your information on your phone .
Sent from my Galaxy Nexus using XDA App

bigmike2424 said:
That's a good point I don't know if Google wallet is supposed to more secure than a credit card.
If some one steals your wallet, what do you do? Suspend any transactions for that stolen card. Just do the same with the cards you have on Google wallet.
Or I'd just remotely wipe the phone , so they have none of your information on your phone .
Sent from my Galaxy Nexus using XDA App
Click to expand...
Click to collapse
Any actual cards that you add to Wallet will of course be removed, but the Prepaid card will still work. How easy would it be to suspend transactions with Google?

Ouch... report it!
Greets
____________
mDroid - Tapatalk
Phone: LG-P500
ROM: Nitrogen - Beta-V1b
Kernel: custom .35
Theme: ICS (Z25 - paid. ported by me )
Tweaks: ALL
Wishlist: Galaxy Nexus

You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.
Click to expand...
Click to collapse
You can reset the application without the passcode. Once that's done, simply open it up, set it up with a new passcode and you have access to the prepaid card immediately.

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
To use this application, you have to get into line, make sure that your screen is on when you get to the counter and then make sure you put in your pin #/Passcode before swyping.
The only way for a thief to get access is to take your phone while its in your hand and the screen is open but then also if the screen shuts off, the application closes and you have to input your pin #/passcode again.
Try it.
Click to expand...
Click to collapse
try this:
open clear google wallet data, run google wallet again.
it will prompt you for new passcode and link it to the google account on your device.
of course, all the credit card info is wiped, but your google prepaid card can still be added without passcode, so whatever remaining balance you have on it will be usable by whoever activate it

Ronin09 said:
You have to have a passcode to use the wallet feature. I am not following this at all seriously.
Click to expand...
Click to collapse
The OP explains it perfectly.
Evangelion01 said:
1) Go into application settings
2) Clear data for Google wallet
3) Open wallet and set it back up
4) Everything remaining on your Google prepaid card can now be used.
Click to expand...
Click to collapse
That means anyone who gets your phone, even while it's turned off, can follow these steps to remove whatever pin you have set. They can then set up Google Wallet with their own pin and add your prepaid card with all its funds back onto the app and start using it.
To be safe, you'll need to set your lockscreen to use one of the other security types such as pin, pattern, or password, and then hope nobody gets ahold of your phone while the phone itself is unlocked. I don't find face unlock to be very safe at all so I won't even recommend it for protecting Google Wallet funds.

to add some other failure of google wallet...somehow ur wallet gets registered w/ ur device...or that's how it looks like...i had a nexus s w/ wallet fully functional and about $12 left on the prepaid card...bought the GN and gave the NS to my wife...fully wiped the device, reinstalled the wallet and activated w/ my wife's account...guess what she got my remaining balance and when i activated mine on the GN i only got the $10...but to be 100% fair it could be something related with the fact that we're not really supposed to have this running on our phone...so might be something related to that, since my NS was on t-mobile and not sprint...hence i was running a "not approved" app...

Evangelion01 said:
You can reset the application without the passcode. Once that's done, simply open it up, set it up with a new passcode and you have access to the prepaid card immediately.
Click to expand...
Click to collapse
I was having a hard time understanding too until you pointed this out (again?) ... thanks for the heads up.
did you submit this issue to google?

Elganja said:
I was having a hard time understanding too until you pointed this out (again?) ... thanks for the heads up.
did you submit this issue to google?
Click to expand...
Click to collapse
Nope. How would I go about doing that? Knowing Google, even if we were to inform them today there wouldn't be a fix for at least a month.
Still can't believe that after three years they haven't got a solution allowing you to passcode protect individual applications in the OS. Dumbphones could do that back in 2004!

Evangelion01 said:
Nope. How would I go about doing that? Knowing Google, even if we were to inform them today there wouldn't be a fix for at least a month.
Still can't believe that after three years they haven't got a solution allowing you to passcode protect individual applications in the OS. Dumbphones could do that back in 2004!
Click to expand...
Click to collapse
should be here: http://support.google.com/wallet/bin/static.py?hl=en&page=known_issues.cs (click on "let us know") but it isn't working for me atm

Elganja said:
should be here: http://support.google.com/wallet/bin/static.py?hl=en&page=known_issues.cs (click on "let us know") but it isn't working for me atm
Click to expand...
Click to collapse
No surprise there, then. Thanks for the link. Hopefully they'll fix it by Q2.

MIUI had a sweet security app based on individual apps. I would lock down my games cause my boy liked to get in there and press buttons aka delete my saves.
I don't know what process it would involve to port this over. But it would be a welcome one.
Galaxy Nexus - 4.0.3 CM9
Asus Transformer - 3.2 Revolver

I went ahead and emailed the relevant Google deparment about the issue. I'll keep you all updated if I get a response, but bear in mind that this is Google's rubbish customer service that we're talking about... I'm not getting my hopes up.

If you lose your phone just log into your Gmail and change the password. Problem solved.

bp328i said:
If you lose your phone just log into your Gmail and change the password. Problem solved.
Click to expand...
Click to collapse
Yes, problem solved if you can get access to an internet-connected device quickly enough.

Evangelion01 said:
Yes, problem solved if you can get access to an internet-connected device quickly enough.
Click to expand...
Click to collapse
I guess I just don't see it as big of an issue as you do.
I mean if you lose your real wallet you have to track down the phone numbers to your credit card companies and call then all one by one. It would be easier and quicker in this day and age to find an internet-connected device.
All my friends and family have internet-connected devices (smart phones) so I could change my Gmail password faster than I could call one credit card company, get through their phone system, get a live person on the phone and cancel the card.
When it comes to money, credit cards or any thing being use as either of the two there will always be flaws that someone will try to exploit. And with this flaw it can be correct/stopped by the end user within 5 - 10 minutes.
But seriously good find on this!

bp328i said:
I guess I just don't see it as big of an issue as you do.
I mean if you lose your real wallet you have to track down the phone numbers to your credit card companies and call then all one by one. It would be easier and quicker in this day and age to find an internet-connected device.
All my friends and family have internet-connected devices (smart phones) so I could change my Gmail password faster than I could call one credit card company, get through their phone system, get a live person on the phone and cancel the card.
When it comes to money, credit cards or any thing being use as either of the two there will always be flaws that someone will try to exploit. And with this flaw it can be correct/stopped by the end user within 5 - 10 minutes.
But seriously good find on this!
Click to expand...
Click to collapse
That's true, I was trying to look at the worst case scenario. The flaw itself is pretty serious, but the consequences wouldn't be that great yet. I've only heard of one person who had over $100 on their prepaid card, and I think there are extra measures in place when purchasing larger items? Not sure.
But something as simple as this certainly needs to be fixed before NFC payments go mainstream.

Evangelion01 said:
That's true, I was trying to look at the worst case scenario. The flaw itself is pretty serious, but the consequences wouldn't be that great yet. I've only heard of one person who had over $100 on their prepaid card, and I think there are extra measures in place when purchasing larger items? Not sure.
But something as simple as this certainly needs to be fixed before NFC payments go mainstream.
Click to expand...
Click to collapse
I agree it is simple and does need to be fixed. They could make a quick fix by having each app that is based off our Gmail accounts require the Gmail password re-entered when an app is setup and not just ask permission.

Emails secure element

ive decided i would keep emailing the Google Wallet Support Team until they decide to fix the problem they have cause with are phones. the way i see it "Google Wallet" app has broken my phone(Secure Element) and i feel they should be fixing this problem.
From Google
Hi Luke,
Thank you for calling Google Wallet. It appears that your phone has experienced a rare hardware error with the Secure Element that makes it incompatible with the Google Wallet mobile app. We are currently working with our hardware partner to address this particular error and we apologize for the inconvenience this has caused you. If you wish to continue using Google Wallet, we recommend contacting your phone carrier or the retailer from whom you purchased your phone to learn more about your options to remedy the issue with your device’s Secure Element.
For more information about the Secure Element and security with the Google Wallet mobile app, please visit our help center at http://support.google.com/wallet/bin/answer.py?hl=en&topic=1350361&ctx=topic&answer=1350362
Thank you for your patience with this issue. We appreciate your help as we work to improve Google Wallet.
The Google Wallet mobile app requires an NFC-enabled Android phone and Secure Element chip. The phone must have an operating system of Gingerbread Android 2.3.7 at a minimum. To check if your Android phone is compatible with Google Wallet, please visit https://support.google.com/wallet/bin/answer.py?hl=en&answer=1347934&topic=1347912&ctx=topic
Currently, Google Wallet is only available in the United States.
We're continually working to expand Google Wallet to more devices, carriers and locations. If you’d like to be notified when Google Wallet is available on more devices, please visit http://www.google.com/wallet/get.html and click "Sign up for email updates" at the bottom of the page.
It was a pleasure assisting you today. Feel free to contact us again if you have any additional questions regarding Google Wallet or visit our Help Center at http://www.google.com/support/wallet
Sincerely,
Mark
The Google Wallet Team
Click to expand...
Click to collapse
From me
This is not a rare hardware issue as a lot of the android community have this problem. A factory reset or clearing the apps data in the setting app also causes this issue. This leads me to suspect that the app changes the files in the phone or lock your google account from using it with the phone. Not making it a hardware issue at all.
Like google music which wasn't released to out side of the US for a wile, but worked fine in the UK, this is the same with Google Wallet. When I buy a £500 phone that I am told I can use as a credit card I expect it to be enabled. I understand that only few places in the UK support this option, but I still don't want Google to limit this.
Please get back to us with a fix to this issue because a large amount of android community are very disappoint in Samsung and google due to this problem. Some first, and last, time android users.
when the error message appeared on the app I was told to contact google wallet support. One of your advisers then told me to contact the manufacture. Personally I agree with the apps advise about contacting your selfs as it was your app that broke my phone.
I went to your support forum and no contact number, help files to anything else was available to help me. Please change this as I had to spend time then searching through different forums on the subject for the contact number.
Sincerely
Luke Pring, LukeMovement Android (Market) App Developer
Click to expand...
Click to collapse
^^^Ended it like that so that he doesnt continue to talk down to me like im an idiot, with the adviser on the phone did so i hung up on him XD

lukemovement1 said:
^^^Ended it like that so that he doesnt continue to talk down to me like im an idiot, with the adviser on the phone did so i hung up on him XD
Click to expand...
Click to collapse
Haha clever, though you have some grammar mistakes which you should have probably addressed before sending thee message
Sent from my Galaxy Nexus using Tapatalk 2

Any altrentative from Google pay?

I live in an unsupported country (Cyprus)
I am trying to make Google pay to work, i saw a lot of people from uk come here and pay with apple pay!
I found that revolut card is supported on apple pay and on google pay but there is a catch you can add your card if you live in UK Germany etc rather that Apple pay there was support for apple pay!
I found.boon Germany alternative app but I wasn't able to transfer money from my card
is there any way to make Google pay work in my country?; or at least find an alternative app?
I am 16 and most of my friends does carry wallet but I hate using it and most of the time I forget it home with my card inside.... rather if there is an app, or make Google pay work in my country I will be able to pay with it without trying to find my wallet; is such a pain trying to find my wallet or coming home to get it because I forgot it

If your card is issued in Germany, you can use VPN to change your Google account to Germany (or just create a new account and keep both logged in on your phone), and then add that card to G Pay on your German account.
If it is bot issued in Germany, boon in the only option I've heard about.

DubelBoom said:
If your card is issued in Germany, you can use VPN to change your Google account to Germany (or just create a new account and keep both logged in on your phone), and then add that card to G Pay on your German account.
If it is bot issued in Germany, boon in the only option I've heard about.
Click to expand...
Click to collapse
I tried that but it needs phone verification

Do you guys create and login with a Huawei ID?

I was going to link it with my Gmail but it looks like it gives access to third party accounts? Sounds a little suspect...
Do you guys even use this on your phone? Doesn't seem like it's necessary, I don't care about any of the Huawei provided cloud services, at least I think I don't.....

A Huawei Id is helpful.

I get an error with the phone telling me that service is not available in my country (the United States).
Can anybody else in the US log in?

jeepentj said:
I get an error with the phone telling me that service is not available in my country (the United States).
Can anybody else in the US log in?
Click to expand...
Click to collapse
Ive been logged in since the Honor Note 8, You dont really gain anything from it, 5GB cloud storage, find my phone finally works (didnt with the HN8), but I really dont use it, but its there if I choose to.

omniphil said:
I was going to link it with my Gmail but it looks like it gives access to third party accounts? Sounds a little suspect...
Do you guys even use this on your phone? Doesn't seem like it's necessary, I don't care about any of the Huawei provided cloud services, at least I think I don't.....
Click to expand...
Click to collapse
I sign into it but don't use any of the services.

Question Critical Bug found affecting Google Pay purchases on Pixel Phones

I have found a nasty bug with my Pixel 6 Pro and Google Play. The bug currently makes it, so any purchases done through Google Play (including in-app purchases) don’t require authentication or biometric prompt even though both options to ask for biometric and ask to authorize every purchase enabled. They all get bypassed.
Here what I mean:
The main configuration page:
https://imgur.com/Xkw4Ssb
Purchases authentification:
https://imgur.com/BK8mzcQ
I have able to replicate that issue three times. I’ve factory reset phone and only kept the bare minimal. And every time I add my Mastercard credit card to my Google Pay, it makes it bypassing all security measures. So, my kids could take my phone and make my wallet cry. But what is strange is my debit card was added and it never did that bug. Mastercard asks to call the bank and authorize your phone. As soon as my card becomes active, the bug is back.
I’ve tried to contact Google about this issue, but I’ve had no one answering me. I don’t know what else to do. Anyone can verify, and see? Three other people confirmed the bug to me so far and they all Pixel phones (5, 4a, 6 pro). I have a video too, but I need to blur it out and I need a software for that
Phone: Pixel 6 Pro
App: Google Pay
Card: Mastercard

Good find! I hope you report it to google

I've reported it to Google Play, Google Pay, Pixel Hardware and Google general update and I've got yet a proper answer. Everyone just pass the puck asking me to do many things I've done regardless of me saying I've Factory reset without backup restore which is the shotgun approach.
I want to see if this issue is more widespread. I need more sample data. But I don't understand how it could be a problem only affecting me and not other users...

bHello, I have a similar problem I think. when I add my MasterCard card to Google play Impossible to complete the configuration it blocked the validation of the cardHello, I have a similar problem I think. when I add my MasterCard card to Google play Impossible to complete the configuration it blocked the validation of the card

crappp said:
bHello, I have a similar problem I think. when I add my MasterCard card to Google play Impossible to complete the configuration it blocked the validation of the cardHello, I have a similar problem I think. when I add my MasterCard card to Google play Impossible to complete the configuration it blocked the validation of the card
Click to expand...
Click to collapse
That is an entirely different problem. It can happen due to a host of reasons. Maybe your mastercard provider doesn't support Google Pay, maybe you used a VPN, maybe GPay didn't like your IP. It can sometimes be difficult to add cards to GPay. You are not rooted, are you? That makes GPay a bit more complicated.

m the card works great of course my other devices so i assume it is from the pixel

delete

Currently with three tickets open, at Google Play, Google Pay and Google Hardware. All of them are giving me the same answer. Yet, I show video of the bug, they ignore it. I would appreciate if there were people here that can try and test this issue.
Else... I don't get how it could only affect me when my phone is factory fresh and has only a Mastercard credit card added to Google Pay.

Ticket was escalated higher, sent a bug report to Google. Awaiting more info on this bug.
If anyone here could try it on their Pixel phone, it would be appreciated.
From my findings.
Everything updated, Android 12, Google Play up to date
Google Pay with one credit card activated (in my case Mastercard)
Make a purchase of a cheap app. You can get it refund for free if it's the first time you buy it.
You will never get prompted for the authentication.
Thanks guys

Waibashi said:
Ticket was escalated higher, sent a bug report to Google. Awaiting more info on this bug.
If anyone here could try it on their Pixel phone, it would be appreciated.
From my findings.
Everything updated, Android 12, Google Play up to date
Google Pay with one credit card activated (in my case Mastercard)
Make a purchase of a cheap app. You can get it refund for free if it's the first time you buy it.
You will never get prompted for the authentication.
Thanks guys
Click to expand...
Click to collapse
Print authorisation required for me.
Pixel 6 Pro with Feb update...

disregard this message, sent without quoting or reply.

Follow-up, Google has been making me go back and forth with basic troubleshooting. I've got yet an answer to this bug. I'm trying to find more people with this same issue but seems I'm the only crazy one out here. *sigh*
To be continued!

simannjo said:
Print authorisation required for me.
Pixel 6 Pro with Feb update...
Click to expand...
Click to collapse
You have a credit card activated on Google Pay ?

Waibashi said:
You have a credit card activated on Google Pay ?
Click to expand...
Click to collapse
Yes I do.

So. Google support is not doing anything and just ignoring my plea. I've end up with a RMA. Factory sealed phone. Up to date. No restore. Stock OS and only enter my card in Google Pay.
Bam. As soon as I do this. All purchases go thru without any authentication. Straight purchase.
I'm getting really tired by the lack of urgency on this matter from Google. This opens up a lot of issues for phone users with kids and also opens up a lot of room for accidental in-app purchases...
Anyway to go further with this issue ? This is insane. I can reproduce the issue everytime and all I'm getting from Google are emails saying. Hey, sync your accounts

Waibashi said:
Anyway to go further with this issue ?
Click to expand...
Click to collapse
Hit up some of the Android news sites like AndroidPolice and 9to5Google and contact the writers. I would bet they will write some articles on it.