Xposed worked well enough for me but I found it to be a battery drain and wanted to see if i could get this into the android framework itself as I build my own ROM for my Nexus 5.

So, the first thing i did was modify Nfc and Settings apps so you can choose when to enable Nfc Polling...

• Polling off
• Screen off
• Screen on and locked
• Screen on and unlocked
• Screen on and locked only - this is a new mode i've put in that turns Nfc on with the screen and then off again once unlocked. As I only use Nfc on my phone for unlocking, this is really useful as its nice on the battery and doesn't prompt with the empty tag viewer every time i unlock!

Then, using the Xposed module as a basis for the code (so big thanks to those guys!) I added Nfc unlocking into the framework and Nfc app as well as a section under Security settings where you can add/remove tags that are allowed to unlock.

In terms of security, the Nfc tag acts as an override to whatever other lock screen you're using, pattern, pin etc. The tag contents are only handled if the screen is unlocked. If polling is set to 'screen on and locked' then the tag will be picked up as soon as the device is unlocked but there's no way for an unauthorised tag to have its contents handled while the screen is off or on and locked. The unlock is triggered from the Nfc app as an intent, it's probably possible to trigger this intent from elsewhere but the tags uid is checked from within the keyguard while handling it so the uid needs to be known and passed as part of the intent for this to work.

It's all working nicely so far but given i'm not that familiar with the guts of the android lock screen security and creating new ui's, there's probably room for improvement.

Given this is framework changes there isn't really an easy way to release something people can use and test. The code is all here:

https://github.com/AospPlus/android_frameworks_base/commits/aosp-plus_4.4
https://github.com/AospPlus/android_packages_apps_Settings/commits/aosp-plus_4.4
https://github.com/AospPlus/android_packages_apps_Nfc/commits/aosp-plus_4.4

and it's based on pure aosp (with a few other relatively minor changes) so should be straight forward enough to merge into other ROMs. If anyone wants to make changes/fixes and submit pull requests then please do. Once it's tested a bit and improved where needed I'll see about getting patches submitted to the major ROMs, (CyanogenMod etc.)

Anyone with a Nexus 5 who knows how to compile ROMs can do so with

    repo init https://github.com/AospPlus/android_manifest -b aosp-plus_4.4
    repo sync
    brunch hammerhead

I've added something similar to this in a fork of passwdsafe for android by Jeff Harris. The master password is encrypted and stored on the Nfc tag. Then, when the password entry prompt is displayed, the tag can be used to unlock the safe instead of typing in the password.

To keep the master password safe:

• I have a dialog ask for the password safe password and a new encryption password.
• The password safe password is encrypted using the encryption password and the resulting string stored on the NFC Tag
• The encryption password is itself encrypted using the encrypted string (that's on the tag) and this second encrypted string is stored on the device in the application prefs area.

This way, both pieces of data are safe on their own but when brought together can be used to unlock the password safe.

The code is here: https://github.com/tombriden/passwdsafe but it's pretty rough at the minute as I've not had much time to do it properly (eg it's own 'create key' button and a nice a progress dialog for the tag writing rather than monitoring adb logcat :) )

@johnyma22

That's what I've been using; here's the output:

Erase -> write failed
Quick Format -> Write protect failed (unknown error)

The app detecting is wrong detects the black tag correctly so seems unlikely it's a bug there given TagWriter can't write to it.

Hi,

I've just received a replacement Horizon ring due to the tags coming off the last one and now have a new problem. I sent the following to support but they suggested to post in the forums first...

I can't seem to write anything to the transparent tag. The black tag is fine and works as expected but the other reads as an empty tag and no app I've tried can let me write to or format it. Also, it's detected by android app 'NFC Tools' as an NTAG206 where the black tag is detected as NTAG216; not sure if that's right or not?

For anyone with a Linux server, there's an application called fwknop (http://www.cipherdyne.org/fwknop/) that allows you to lock down your firewall and then use single packet authentication to open specific ports for a user defined time for the IP address the packet was sent from. As an example, my firewall blocks all SSH access but sending the SPA packet from my phone opens up port 22 for it's ip

The android app (https://play.google.com/store/apps/details?id=org.cipherdyne.fwknop2) now has NFC support so you can unlock your firewall by tapping your ring

I've added something similar to this in a fork of passwdsafe for android by Jeff Harris. The master password is encrypted and stored on the Nfc tag. Then, when the password entry prompt is displayed, the tag can be used to unlock the safe instead of typing in the password.

To keep the master password safe:

• I have a dialog ask for the password safe password and a new encryption password.
• The password safe password is encrypted using the encryption password and the resulting string stored on the NFC Tag
• The encryption password is itself encrypted using the encrypted string (that's on the tag) and this second encrypted string is stored on the device in the application prefs area.

This way, both pieces of data are safe on their own but when brought together can be used to unlock the password safe.

The code is here: https://github.com/tombriden/passwdsafe but it's pretty rough at the minute as I've not had much time to do it properly (eg it's own 'create key' button and a nice a progress dialog for the tag writing rather than monitoring adb logcat :) )

Xposed worked well enough for me but I found it to be a battery drain and wanted to see if i could get this into the android framework itself as I build my own ROM for my Nexus 5.

So, the first thing i did was modify Nfc and Settings apps so you can choose when to enable Nfc Polling...

• Polling off
• Screen off
• Screen on and locked
• Screen on and unlocked
• Screen on and locked only - this is a new mode i've put in that turns Nfc on with the screen and then off again once unlocked. As I only use Nfc on my phone for unlocking, this is really useful as its nice on the battery and doesn't prompt with the empty tag viewer every time i unlock!

Then, using the Xposed module as a basis for the code (so big thanks to those guys!) I added Nfc unlocking into the framework and Nfc app as well as a section under Security settings where you can add/remove tags that are allowed to unlock.

In terms of security, the Nfc tag acts as an override to whatever other lock screen you're using, pattern, pin etc. The tag contents are only handled if the screen is unlocked. If polling is set to 'screen on and locked' then the tag will be picked up as soon as the device is unlocked but there's no way for an unauthorised tag to have its contents handled while the screen is off or on and locked. The unlock is triggered from the Nfc app as an intent, it's probably possible to trigger this intent from elsewhere but the tags uid is checked from within the keyguard while handling it so the uid needs to be known and passed as part of the intent for this to work.

It's all working nicely so far but given i'm not that familiar with the guts of the android lock screen security and creating new ui's, there's probably room for improvement.

Given this is framework changes there isn't really an easy way to release something people can use and test. The code is all here:

https://github.com/AospPlus/android_frameworks_base/commits/aosp-plus_4.4
https://github.com/AospPlus/android_packages_apps_Settings/commits/aosp-plus_4.4
https://github.com/AospPlus/android_packages_apps_Nfc/commits/aosp-plus_4.4

and it's based on pure aosp (with a few other relatively minor changes) so should be straight forward enough to merge into other ROMs. If anyone wants to make changes/fixes and submit pull requests then please do. Once it's tested a bit and improved where needed I'll see about getting patches submitted to the major ROMs, (CyanogenMod etc.)

Anyone with a Nexus 5 who knows how to compile ROMs can do so with

    repo init https://github.com/AospPlus/android_manifest -b aosp-plus_4.4
    repo sync
    brunch hammerhead