Cordova Plugin

[AlexParticipant]

Hi Guys,
We are a bunch of developers in Australia and have developed an app to use androids built in nfc to scan visa mastercards and process transactions. Do you think we could use the ACR35 to achieve this on non NFC phones? We are currently using cordova for cross platform compatibility, do you know if we could integrate your apk with cordova? If this sounds possible would love to buy a couple of devices to play with, all going well we would need alot more.

[RichardKeymaster]

Hi Alex, we’re indeed working on our first release of a Cordova Plugin for the FloJack (ACR35) scheduled for this month. I say specifically, FloJack instead of ACR35 (although they are the same hardware) because we include our keys within the hardware so that the plugin will only work with devices purchased from us. This allows us to protect our work from folks wanting to buy direct from ACS.

That said, the FloJack is indeed hardware pre-certified for EMV L1 and can be made to process PayPass/PayWave transactions. Building out an EMV L2 kernel in javascript using the Cordova bridge is something we have on our roadmap but haven’t gotten to yet. If this is something you’re interested in accelerating, we’d be glad to participate given the upside potential. You can order FloJacks directly from our web store here.

[AlexParticipant]

Thanks for your speedy reply! We are currently using triangle.io’s cordova plugin, seen here: https://github.com/triangle-io/applications/tree/master/Cordova
We would be super keen to try out or beta test your cordova plugin, we would love to hear about it when its ready.
How would you propose we show “interest in accelerating” :p
Could you please clarify the difference between the functionality of the cordova plugin that you are planning on launching this month and what you mentioned in your second paragraph? I have not heard EMV in any previous conversations with stripe or triangle.

[RichardKeymaster]

Hi Alex, EMV is the standards body that regulates Chip+Pin and Contactless payment transactions. Seems that I went ahead of you a bit and that you’re only interested in processing non-EMV transactions. If that is the case, the FloJack will provide you with all the info Android NFC devices can out of the box. EMV transactions are more complex involving protocols between the card and reader. These are required for the next-gen of credit cards and devices like Apple Pay. More info on EMV from Triangle and Stripe:

Triangle EMV: http://www.triangle.io/Home/Pricing
Stripe Apple Pay: https://stripe.com/docs/mobile/ios

order some FloJacks and play with our SDK (once released)… you’ll need to do some integrating with the Triangle and Stripe APIs but you will have access to all the non-EMV info from the card.

[AlexParticipant]

Can we bypass triangle all together and use your cordova plugin to read the card details from the nfc tap? I’m sorry, we heavily rely on triangle to take care of all that, so I do not have a great understanding of what is required. All we need is the card number and exp to send to stripe to process a transaction, which is what we are currently using triangle for. They have horrible support and are not very helpful. Unfortunately apple pay is not available in Australia yet and according to my contact at Stripe, will not suite our needs.

[RichardKeymaster]

Yes, that would be possible but there might be some pitfalls to be aware of. Contactless credit cards vary in what they present to card readers. For instance, Mastercard PayPass supports two modes: MagStripe Mode and EMV Mode. By way of the simpler of the two, MagStripe Mode, you’ll be able to retrieve most (if not all) the details you would need to present to Stripe. In order to do so, however, you have to determine the card and compatible protocols (seeking MagStripe Mode) as well as execute the protocol correctly to get the relevant information off the card.

We can help manage the card connection and trigger callbacks in you javascript, but some will need to code the protocol command/responses in order to learn what cards are present and how to properly retrieve their accountholder data to process the transaction with Stripe. Like I mentioned before, we have this on our roadmap but given the complexities of supporting the FloJack across devices and all the features it can offer that may take some time. So if you’re interested, it’s an area we could collaborate on.

[AlexParticipant]

Hi Richard,
I will do some more research into these technologies so that I can engage in a more educated conversation with you, perhaps even over skype at some point if you have time. Could you please link me to any resources you would recommend I read? Otherwise I will just do some googling and see what I find.
Cheers,
Alex.

[RichardKeymaster]

Read up on this white paper from the authors of NFC TagInfo. It’s probably going to overwhelm you but that is a good thing. It will seed the right questions and Google will help with the rest. Feel free to drop questions into this thread if you get hung up on anything. I’m keen on disseminating this content and accelerating the adoption of NFC across mobile.

[AlexParticipant]

Hi Richard,
RE Triangle.io: Did you mention that your code will only work with your signed hardware (preventing use with ACS direct hardware), therefore it won’t be able to read using the built in NFC chips?

RE EMV: I think my understanding of what you are talking about is much clearer now, however I do still have some questions/comments.

1. In Australia CVC information is not required (like amazon online) therefore the only information we need to provide to stripe for successful payment processing is the card number and expiry. As I understand it this can be obtained using the “Mag-Strip” approach, which does not requite bidirectional communication. The card number and expiry can be obtained by either swiping the card or tapping on the NFC panel. This method does NOT have a transaction limit of $100. ($100 is the contactless payment limit in Australia before PIN authentication is required) Would you agree with this?

2. As it stands we are a team of 3 developers, two of us have full time jobs (Alex & Jarred) and the other (Jonathan) is full time at Uni. We are, as I imagine you are too, strapped for time. Our plan moving forward is to hire developers within the next 6 to 12 months to support the ongoing development of our application. I believe it will be at this point we can afford the resources to assist in the development of an EMV solution for Cordova.

3. I have concerns regarding the EMV transactions.
> Is the $100 limit a requirement, if so can we accept the PIN in the cordova app and would that void PCI compliance for having card info client side?
> What information does the EMV L2 (My understanding is that L2 is the money taking details) actually provide us with that will allow a transaction to take place. How do we actually take the money from one account and send it to another. Stripe does this for us at the moment, and I have emailed my contact Hamish regarding Stripes support for EMV transactions. I will let you know what he comes back with. Alternatively do we have to do a deal with an Australian bank? If you could help explain the actually money taking part that would be great. I think I have a fairly good idea of how to offline authorize the card (CVC3) but then what do we do once we know we have an authorized card?

4. What would you need us to do in order to assist you with this project?

I think that’s it for now. Thanks again for those resources, very helpful indeed. Look forward to hearing back from you.

Cheers,
Alex.

PS. I ordered a couple of those ACR35’s, keen to get them, any idea on shipping times to Australia?

• This reply was modified 9 years, 9 months ago by  Alex. Reason: Typo

[RichardKeymaster]

RE: Triangle.io. The Flomio SDK will support FloJack and FloBLE readers off the bat. Adding support for native readers (e.g. Android devices with NFC modules built in) is something that can come later. With the SDK in place, it’s a semi-trivial task. There are other Cordova plugins that support native readers already, but for the value add of an EMV L2 kernel may require a way to enforce licensing. More on this later.

RE: EMV.
1. Your statement is mostly correct. The only tweak I would make is that any NFC interaction will require bidirectional communication. This is because there are a sequence of command-response pairs that will need to be executed to get just the card number and expiry. What you won’t need, however, is any PKI-type signing and card verification procedures. That’s what the EMV L2 kernel is for.

2. Noted. We are a team of 4. Two hardware devs, one mobile, and one biz dev. Coding the EMV L2 kernel in javascript is a tedious task but not rocket science. There are 500 or so test cases we will need to pass for certification and so the development process needs to be guided by that. Once the test harness is put in place and all the underlying services (Flomio SDK et al) are working, I suspect the L2 work will go rather quickly. Perhaps 3 staff months.

3. RE: $100 limit. These are imposed by the issuing banks and payment gateways (FirstData, Authorize.net, etc) and will vary from place to place. The key that EMV offers is that every node along the transaction chain has a Public/Private key pair associated to their involvement. What this allows is for fraud to be pinpointed to the source along the chain. Currently the specs are not written to cover virtual PIN entry (e.g. via mobile devices) so it’s going to be a challenge to achieve certification. That said, there’s demand for it and voices in the industry suspect it will be covered soon. This may involve P2PE hardware (like a Secure Element) to create a Trusted Execution Environment (TEE) so some handsets may not qualify. Having a PIN entry step in the Cordova environment would be possible with a TEE setup natively.

3. RE: EMV + Stripe. It’s not clear wether Stripe is supporting EMV transactions. I don’t think they are. They are processing Apple Pay InApp transactions which is leveraging some of the EMV standards like the Secure Element and Tokenization. However, processing a terminal-based contactless EMV transaction involves much more. The reason you’re confused is because you’re merging two scenarios that often don’t mix, Card Present and Card Not Present transactions. Read up on this blog post for more info. By following the EMV security model, payment processors will give Card Present rates. FirstData has EMV payment infrastructure in place so you in theory you could point your Cordova app to their endpoints to implement the EMV protocol. FirstData will provide you with a Merchant account which you will associate with your bank. Then as you receive payments through your Cordova app, you will take your fee and deposit the rest into your customer’s account (merchants that sign up for your service, I presume).

4. This discussion is a good indication of your commitment to the project. I think you still have a lot more to learn though in order to be helpful. I would recommend that you read through the Smart Card Alliance Payments Landscape white paper. It will trigger more questions and we can go through them on a new Contactless EMV Payments thread (just create it when ready).

PS. International Shipping takes 6-10 business days. Your order shipped today. Tracking will take a couple days to refresh but here’s your tracking link.

[AlexParticipant]

Hi Richard,
Thanks for your above reply. As a side tangent to the main conversation here, how did you/are you going with the cordova plugin? I have the devices here but not really sure how I can test them out to see what they are like? Also what can we expect to pay for volume purchases say around 200 units?

Thanks,
Alex.

[RichardKeymaster]

Hi Alex, we are still working to get the Cordova plugin released. It’s in final testing but given that we’re at conferences most of March, it probably won’t be available until early April. If you’d like to test out the readers you have you can search the Forum for some instruction on that. This thread is a good one to try.

RE: volume discounts, here’s our standard schedule for the FloJack:

Buy 25 save 7% = $54.87
Buy 50 save 10% = $53.10
Buy 100 save 19% = $47.79
Buy 500 save 25% = $44.25
Buy 1000 save 31% = $40.71
Buy 10000 save 40% = $35.40

[AlexParticipant]

Thanks for that information Richard. May I ask why the ARC35 with mag reader is half the price of just the nfc reader, and do those same %’s apply to that product? Are we able to please have early beta access so we can start integrating our code so that we can go to market the second you launch the stable version. We are very eager to get the ball rolling and would appreciate some time to test our app out before we go live.

Cheers,
Alex.

[RichardKeymaster]

Hey Alex, explanation on differences between FloJack and ACR35 here. The discount schedule for the ACR35 follows:

Buy 10 save 2% = $34.30
Buy 25 save 3% = $33.95
Buy 50 save 5% = $33.25

We’re limiting beta access to Flomio’s SDK to customers that purchase 20 or more FloJacks (not ACR35s). It helps filter out the serious people from those looking to just play around with the technology.

[AlexParticipant]

Oh Bugger,
From what I understand we have wasted $120 AUD on the wrong thing. I only chose the ARC35 because I thought it was the same thing but with a mag strip reader and on sale. Does this mean that flojack doesn’t support card swiping through the mag reader and in order to use the Cordova app you guys are developing we need to actually have the flow jacks?

Cheers,
Alex.

[AlexParticipant]

Let me clarify that, I have realized my mistake, appologies. Are we able to return the two ARC35’s we purchased as we have no use for them? Only remaining question is, does the Cordova app support mag strip?
Considering we are yet to confirm that these devices do what we need them to do we can not sign off on $1500AUD just to get beta access. Cash is vital to our survival at our infancy, we really need to have proof that we can make this work in our scenario asap and before committing those funds. I think it is clear from our conversations that we are potentially a massive customer and not just a home geek wasting your time with this tech. We are on a strict time line to get this sorted as our sales and marketing man is eating our cash flow and we’ve just taken a massive step backwards, we had planned to have a beta app with flojack api in Cordova finished before end of April. Based on what you’ve said the Cordova plugin won’t be ready for another 3 weeks. Early access to this code is vital to ensuring we meet the time line we have budgeted for. Do you think you could please make an exception to this case and grant beta access considering that we are in a place you once where, and know what we are going through?

Thanks,
Alex.

[RichardKeymaster]

Hi Alex, sorry for the confusion. It doesn’t make sense to return the ACR35s since the FloJacks are the same hardware. What you can do is Paypal the price difference of $49.98 to info@flomio.com and email us the confirmation number to the same address along with your original order number. We can then send you a set of encryption keys and procedure to flash them into your devices. This will essentially make them FloJacks.

RE: Access to the Cordova SDK. We set the tier of a 20 reader purchase because we need the income to cover the time it will take to use it. Believe it or not, we’re just as cash strapped as you are and we need to focus on what keeps the lights on. As our beta customers commission the work, we end up rolling out the results to the community later. Maybe you’ll have to wait a bit but at least you’ll get a more mature solution once it’s officially released.

[AlexParticipant]

Hi Richard,
Thanks for that info.
How goes progress on the cordova compatibility? Is the beta available yet? Do you have an eta on the stable release? Just to confirm the cordova plugin will support android and iOS yes?

[AlexParticipant]

Hi Richard,
Any news on the above post?

Cheers,
Alex.

[RichardKeymaster]

Hi Alex, sorry for the delay. We do have a working Cordova plugin but are still documenting how to install and make it work. There’s several moving parts to a Cordova solution so we’d be willing to send you a beta release in order to help get some field testing on it. Where you able to send me your device IDs per these instructions? I’ll need that in order to provision the license of the SDK and Cordova plugin.

thanks,
Richard

[AlexParticipant]

Hi Richard,
I have sent an email to info with the details as requested. Happy to test it out for you, let me know if you need anything else.

Cheers,
Alex.

[LucaParticipant]

Hi Everybody,
I’m also quite interested in the Cordova plugin, since I have a “Cordova” app on the Play and Apple stores (DivePlanApp.com).
I am now trying to implement a NFC download of data from a scuba diving computer that has NFC technology (T1 from seabear-diving.com).
With FloJack would I be able to connect this computer to my app both in Android and iOS and download its data?
I am waiting for your answer to buy my FloJack for test. If everything works fine we could insert FloJack into the dive computer package in order to allow users connecting it with non-NFC devices.
Thanks
Luca

[RichardKeymaster]

Hi Luca, I looked over the Seabear website for details about the T1 and H3 product integrations of NFC. It’s unclear how they have done it. We’re working with American Thermal Industries (ATI) to get their NFC Temperature Logger tag working with the FloJack. Their device uses a proprietary protocol across the NFC interface that makes it less than ideal when working with the Cordova plugin.

That said, it’s quite possible Seabear took a simpler, more open approach to their data encapsulation over NFC. If this is the case, the Cordova plugin will be sufficient to connect and download the data blocks.

[LucaParticipant]

Hi. The computer will send an NDEF text message which includes a csv file with all data. No encryption or special protocol behind it.
Will I be able to receive such message and parse it with your Cordova plugin?
What is the actual stage of this plugin development?
Thanks

[RichardKeymaster]

If the computer is emulating an NFC Forum Type 2 tag like MiFare Ultralight, Classic, Mini, or NTAG then the basic Flomio SDK that’s included with the FloJack will read it. The Flomio SDK is currently only available for iOS, with Android coming out later this year. The Cordova plugin is working but hasn’t been released. We still need to port the NDEF parser to JavaScript and add extended block read support. Right now the SDK is limited to reading only 16 bytes at a time.

[LucaParticipant]

OK. So you are suggesting me to wait ’til the Cordova plugin is ready? Or I can get a beta test?
Because I will not use it with any native application.

[RichardKeymaster]

Yes, if you can afford to it’s best to wait. Otherwise, you can fork our Flomio Cordova Plugin repo and start testing it out with the current Flomio SDK. You will need a FloJack to get started.

[AlexParticipant]

Hi Richard,
I have looked everywhere and I can not find the apparently missing files (ReaderManager.h, Reader.h, NDEFMEssage.h) when running the cordova app on iOS according to the ReadeMe. Can you please point me in the right direction.
I am curious if there are any docs on how we send / receive commands. Ideally we just want to be able to read the card number and expiry from the Visa / Mastercards, is this possible?

[RichardKeymaster]

All the header files are in the include/SDKClasses folder inside the Flomio SDK zip file. Currently we don’t fully support the EMV command structure but this is on our roadmap.

BTW, I’m in Sydney for the next couple days in case you’re close by and would like to meet in person. I’m staying in the Glebe neighborhood.

best,
Richard

[AlexParticipant]

Hi Richard,
I would love to meet you, the experience and knowledge you have would be a great insight for our project and future collaboration.
I live in Brisbane, however can organize a flight to Sydney very easily.
Please email me your AU contact details to alex@mycs.net.au so we can get in touch!
I will take a look at that SDK attached.
So does that mean that at the current point in time, reading the card numbers/expiry would not be possible? Does the Cordova plugin support the mag reader?
I have tried to grasp the concept of EMV, however at this point I am still confused about who/how we decrypt the data to process the card as a CNP transaction.

[RichardKeymaster]

So does that mean that at the current point in time, reading the card numbers/expiry would not be possible?

Yes, I’m afraid so.

Does the Cordova plugin support the mag reader?

No, not at the moment.

[SarahParticipant]

Very informative post! The long-range RFID readers are also available at Do RFID readers. It is the best place for the customer to enjoying efficient service and good quality products.

[Author]

Posts