yashsingh1/xdaforums huggingface dataset:
[Nexus 5 Q&A, Help & Troubleshooting] Robalboa:
i have a s6 and samsung pay works and its rooted with custom recovery. so theres one source.

also it does support NFC and cards swipe readers

Further, it'll have to be a phone from a supported U.S. carrier that means you'll need to be on Sprint, AT&T, T-Mobile or U.S. Cellular (you may notice Verizon missing from that list). Once you have those two qualifications met, the next thing you'll need is a debit or credit card from a supported bank. At launch Samsung Pay supports VISA, MasterCard and American Express cards from Bank of America, Citi or U.S. Bank — and of course Samsung is working hard to expand the number of supported banks.

If you meet the requirements, it really is worth giving Samsung Pay a try. It works with NFC payment readers just like its competitors from Google and Apple, but importantly can also make payments at traditional card swipe machines using Samsung's proprietary MST (Magnetic Secure Transmission) tech. Just hold the phone where you'd normally swipe your card, and you've paid.

Further, Samsung is also announcing that Samsung Pay will work on Square card readers, opening up the possibilities for using Samsung Pay at all of the smaller local retailers that often use that portable payment system.

samsung has been full aware of the fact that they cut off all the rooted users the first time around and wont make that mistake again.

we are pushing for them to add the loyalty card support. which they acknowledged they are working on "diligently"

so between the samsung pay and wallet. im using a modded wallet that still works but im waiting for it to get shut down by google luckily i have samsung pay for a back up and am prepared to dump AP altogether after 3 years of solid daily use.

if anyone thinks the status quo is gonna stay the same with wallet is in for a big surprise. and remember

we did this once before 3 years ago and guess who won??? the customer, the rooted user, etc.

this move will be the biggest flop since orkut, or google wave and we know where those apps went. (discontinued list)

Like i said before when the numbers come in showing a huge decline in use then and only then will they make a move. its all about the money.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
1 Thank you for the confirmation that Samsung Pay works with root and that the no-root policy had been changed.

2 Also thanks for confirmation that it can work with NFC. Are you saying that the MST will work without special hardware? Using the NFC chip?? This doesn't sound likely.

3 The restrictions on carrier makes no sense to me. Why are the carriers involved at all. I will always use a reseller and not pay out the a$$ for one of the big 4 (well 2 as I cant do CDMA. Do you have information on this?

If Samsung can allow root and get past the bank restrictions, then so can Google.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] Robalboa:
MST is a technology not all phones have that (allows u to use your phone to pay on swipe terminals for those who dont know)

but like you said if samsung can so can google. the problem i think was google let the banks dictate the rules while samsung did not let them make all the rules and haggled with them. google just acquiesced to their terms. when in fact google could have been more demanding during their contracts. But they were afraid of liability even though i havent heard of one Not ONE incident of any breach of google wallet OG

as to what someone said earlier about sniffing your transaction:

the chance of some guy in line behind you while you check out trying to catch your nfc transaction is a joke

the NFC only transmits about 2 inches in one direction and what would he do sit in the check out line all day letting people go in front of him until someone pays with their phone? then get 2 inches from their phone while they pay without them noticing? lol

the thought is ridiculous
[Nexus 5 Q&A, Help & Troubleshooting] ajm786:
And there you have it. Nothing "security" related about this. As I was saying before, it was either Google being lazy/trying to get more control over our devices, or simply allowed the banks/credit card companies to dictate the terms. Turns out it seems like the latter (what I referred to as "shady backdoor deals").

If Samsung Pay can allow these transactions just fine on a rooted phone (which they do) and it will be allowed for the Note 4, I'll simply switch to Samsung Pay, it's that simple.

About the MST, the Google Gear 2 does not have the MST tech, but I hear that you can still use Samsung Pay with it. That being the case, there's no reason why a phone like mine (Note 4) can't use it too.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
Yes, and how many phones other than Samsung have hardware for MST?

As for sniffing NFC, the reality doesn't matter compared to the perception. People swear that they can charge your credit card 'wirelessly' by walking out the door. Movies show touch screens reading fingerprints!

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] ajm786:
I answered your question in my post.

http://www.samsung.com/global/galaxy/gear-s2/

The Galaxy Gear S2 does NOT have the MST tech, but STILL supports tap-to-pay with Samsung Pay. Thereby blowing Android Pay's sorry excuse for not allowing root out of the water.
[Nexus 5 Q&A, Help & Troubleshooting] GatoL0c0:
Delete
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
This is a reality, though I am unsure about the being in line scenario. You can catch a credit cards number if you have the tech to read the tap and pay chips and are able to get within a few feet of the target

However, this:

is hardly a valid argument. While there may be some capability to do this (cannot confirm), simply because a movie has it doesn't mean the tech exists (Otherwise, I'd have some of those killer hoverboards from Back To The Future!) ;)
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
They have hoverboards, but restricted to a certain path that contains magnets. And my point was that people think touchscreens can read a fingerprint but its simply BS

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
I read it on the internet, it must be true! lol

But seriously, I want one of those hoverboards (not the magnet types) :p
[Nexus 5 Q&A, Help & Troubleshooting] wangdaning:
This conversation is completely based on nation. Thankfully, while from the US I live in China. I walked around yesterday with almost 3000 (around 450 USD) in cash and didn't care. Card readers here work with the bank apks. Most places do not have card machines anyway.

Really, though, why should google be doing this. Shouldn't it be your bank that sets you up with phone payments?
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
I think people of all nations are pissed that they are being told they cant have root access to their own devices.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] wangdaning:
My point was more, should people care about androidpay and how it works in places it will never work. Seems more logical to me that the individual banks would set up apks for their customers. Last I heard android is not a bank, and if they give anything that works for some that is a pleasantry. If a person's bank is too lazy, then they should complain to the the bank not to google.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
And then we can have this same discussion 20000 times, one for each bank, and we'll have a dozen apks, one for each card and have to load the apk for the card as an extra step before using it, and that's if the different APKs don't ALL try and pay at once ...

And since its banks that have security issues with root access, we have the same exact problem. Fact is, most banks don't have mobile payment systems nor do they have the expertise to write it and roll it out.

Again, the issue isn't about Android Pay. Its here. Its about it not working with root, and you are telling me your bank has an NFC mobile payment system that works on a rooted phone that I can install right now? Please tell us the name of the bank and where to download.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] dk_zero-cool:
Rooted just means that you have the binary used to switch to the root account. Custom ROM and unlocked bootloader does not mean that you have root access. You can easily flash a ROM without the binary or simply delete it manually after flashing.
[Nexus 5 Q&A, Help & Troubleshooting] Stryke_the_Orc:
Android was never meant to be run with root. It is an exploit, plain and simple. Exploits, by their general nature, are insecure, hence why this app didn't work with rooted devices and why android does not naively come with a sudo (or sudo like) command. Be happy that we are even allowed to root, they could just enforce locked bootloaders, and worse, through the manufacturers.

The fact that people are still complaining about this just shows a serious problem with entitlement. Root is not a right. Using this app is not a right. You do not own the app, so you must use it by their terms or not at all (barring any exploits). You want to cry about losing privileges, complain to Microsoft because they took away ownership of the OS with 10. They took away your right to privacy. There's something worth 30+ pages of complaints. SMH...
[Nexus 5 Q&A, Help & Troubleshooting] Robalboa:
you have to admit if i own my device and android is open source. i can do as i will with it. whether it be rooting or throwing it out the window. (as long as im within guidlines with my provider)

imagine if windows didnt have administrator rights (root access) ? the difference with windows is its a license to use.

while android is open source software non proprietary . every one owns it unlike apple who specifically owns IOS.

anyway there are alternatives coming soon to a phone near you. and when googles board of directors sees this project plummeting they'll change gears quick. gotta keep that stock up or they'll oust the CEO and/or CFO in a heartbeat.

they will not let this project fail they will concede to the Numbers
[Nexus 5 Q&A, Help & Troubleshooting] WhosAsking:
Unless they're getting counter-threatened by the credit card companies who are saying toe the line or face big bills for a data breach. Your threat will just pincer them and make them think it's not worth it anymore and be forced to take another approach, such as enforcing the need for Secure Elements again (like the iPhones do now) so they can convince the credit card companies they have a way to keep even root out of the chain of trust (since they're pretty delicate as they are—try to monkey with them and you risk bricking them).
[Nexus 5 Q&A, Help & Troubleshooting] Joshmccullough:
I don't know about root not being a right, per se.......to me, it's akin to saying that I do or don't have a right to modify my car after I buy it (keeping within the law....can't make it non-street legal and lay rubber all over town), or once I buy my brand new house I'm not allowed to add on to it, paint it, knock out a wall to expand the kitchen, etc. I'm of the mind that it's a right that comes with a lot of responsibility, and yes: sometimes things may not go our way, as evidenced by the APay problems and this forum. This is just my opinion, of course, not backed by any actual research into existing laws/etc.

The Library of Congress' current head is on his way out, and it'd be interesting to see what the next person does in terms of enforcing the ability of people to root/otherwise modify their phones. On one hand I can certainly see where carriers and manufacturers don't want a lot of people having easy access to potentially screw up their phones and then call them about it, but on the other (and I think this has been gone over elsewhere in the forum): if Android's built on a free and open source kernel, and with the AOSP project in full swing, what is the ability and right of the manufacturers to say "hey, we'll take this open source thing for all it's worth, and make a boat-load of money off of it, but don't you go monkeying around with it!" Micromax and other vendors have gotten into hot water in the OSS community for not complying with open source licenses; I don't know how much legal oomph there is to enforce those licenses, but are the manufacturers (Motorola, LG, Samsung, etc.) not bound by those as well?

(EDIT: another link on the outgoing Library of Congress head, seems he's not exactly the most 'on it' when it comes to the technology the kids are using these days._

Again, just tossing out my thoughts/opinions, certainly not trying to come across as starting an argument with you; I greatly appreciate your enforcement of standards for this forum and for helping to keep it on-track and going strong :)
[Nexus 5 Q&A, Help & Troubleshooting] RaymondPJR:
I think the term, 'open source' implies a right! The way I see it carriers/manufacturers have been infringing on the open source nature of Android and Google has allowed it! Just my opinion!
[Nexus 5 Q&A, Help & Troubleshooting] Entropy512:
No, it's being blocked as a method of exerting more control over the platform. It's already been proven that Android Pay with SafetyNet is less secure (compromised within days of launch via a lockscreen bypass exploit) than Wallet with its app-specific PIN was. SafetyNet is about control, not security. It gives insecure builds (such as those vulnerable to Stagefright) an A-OK while preventing more secure builds (such as something where Stagefright has been patched) from being used. Its intrusive presence is also going to result in direct attacks on Pay's security measures, including likely defeats of the security measures that DO sort-of make sense such as lockscreen security. (Why do I say sort-of? Depending on lockscreen security in place of an app-specific PIN like the original Wallet has already been proven to be a mistake.)

EMV was also specifically designed with features such as a transaction counter to prevent sniffing from being very useful. If the transaction counter ever gets reused or decreases - BOOM, instant fraud detection trigger.

Since when was an officially supported bootloader unlock an exploit?

ROOT IS NOT AN EXPLOIT. NO EXPLOIT IS NECESSARY FOR ROOT IF YOUR DEVICE IS UNLOCKABLE (which every Nexus device is.)

It has always frustrated me that people keep on looking for root exploits so they can root devices with an unlock, and you're perpetuating this blatantly false myth.

Root is not an exploit. Root with proper access controls (such as SuperSU which is functionally equivalent to sudo) is the same thing as Administrator on a Windows machine. Or are you saying that Administrator on a Windows machine is an "exploit"?
[Nexus 5 Q&A, Help & Troubleshooting] danix180:
I'm following this thread with the utmost interest.. Just have one question that puzzles me.

How is Android pay on rooted phones less secure than using your regular credit card abroad or at a flea market tavern or online or over the phone or just leaving it in your hotel room etc?? .

I understand Google is concerned for our security and I appreciate that.. but you would have to use common sense with the most modern tech including physical credit cards..

Google needs to wake up soon to the reality that sooner or later we will be using NFC payments. And if they don't adapt to the user base they will be missing out.

Please don't tell us how secure our phones are.. Just as the banks don't tell us what color and how secure are our wallets.. Make this secure on your backend..
[Nexus 5 Q&A, Help & Troubleshooting] Yaz75:
Exactly.

This isn't about the technology and who can or can't root something.

It's all about lawyers.

Of course no one here would ever do this (rollyeyes) but some moron somewhere will root their phone, use Android Pay, get hacked then sue Google because they think that Google should make everything for everyone while taking into consideration everyone's personal preferences. So Google draws a line by saying "you want to use this service then these are the rules to use it. And BTW we're doing this to cover our backside against future hassles."

It doesn't matter if a user is the master of Android and can modify the crap out of it and ensures their own security. They're not making this requirement for you, their making it for the stupidest common denominator. The user who stumbles on this site, finds a one-click root toolkit, has no idea what they're actually doing and winds up getting hacked. Then they'll wind up on here trying to start a poll/petition to sue Google.

If I'm Google I'd have done the exact same thing. You don't like it? Don't use it.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
No. From the bootloader, I can manipulate any file I want. All security is bypassed. Recovery runs as root. If you can install a whole new OS then you can do anything.

Just because you aren't running Android code doesn't mean you don't have root access and can easily compromise security

Taglines suck. https://eddon.systems

---------- Post added at 02:21 PM ---------- Previous post was at 02:16 PM ----------

I think root IS my right, but everything else, no. They are within their rights, and possibly rightly so, to not allow root users to run Android Pay. I do think another solution might make for better security, such as having the app in a proper Linux container (essentially a virtual machine without the overhead) with encryption on all files, statically linked, etc. I think there may be better security available, and we are simply hoping they use that.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] dk_zero-cool:
Just because you have administrative access in one OS (Recovery), does not give you administrative access in another OS (Android). You are talking about two different systems. Unless you have the SU binary on your Android installation, you will not be able to access the root user from Android, which in turn means that your device is NOT "rooted".

He he, yes and so does Android. Everything starts at the highest level, then during boot, processes starts sub-processes with less access, but most of the Android core is running with full root access. The term "rooted" does not mean that you can access root in general, because root is always used. It just means that any non-root process can request to obtain root access.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
Transactions over the phone and such are 'card not present' while NFC is card present even though it isn't. The banks have gotten lawmakers to basically say that if there is a breach, Google pays and not them. So, hello Android Pay ... and goodbye root.

Google doesn't care where you leave your physical card since they aren't responsible.

Taglines suck. https://eddon.systems

---------- Post added at 02:43 PM ---------- Previous post was at 02:35 PM ----------

No again. These systems are not separate in any way. From a security perspective, the rescue system has root. It can install any back doors it wants, change system libraries, kernels, etc on the Android filesystem. It is no different from giving me root access. How do you not have root? It may not look like you are rooted because Android apps don't have root access, but *I* have root and the chain of trust is broken.

The only way to give an application root access without logging in as root is by using a setuid binary, and only root can grant that bit. You install supersu from recovery, thus recovery has root and can compromise Android security.

Taglines suck. https://eddon.systems
[Nexus 5 Q&A, Help & Troubleshooting] lionelhuts:
I have the right to root the device I purchased.

Google has the right to deny access to their app for any reason they want.

I have the right to voice my displeasure with their decision.
[Nexus 5 Q&A, Help & Troubleshooting] trickinit:
And they have the right to not give a ****. ;)
[Nexus 5 Q&A, Help & Troubleshooting] zeroibis:
Basically we all got to hope that plastic turns out well. What will really suck is if paying via phone ever actually takes off. Then we all got to bring a second phone with us everywhere just to use only for making payments so we can keep our actual phone rooted...
[Nexus 5 Q&A, Help & Troubleshooting] ajm786:
Or wait till someone hacks the APK or something. Like was mentioned before, this is not the first time this happened. This is literally Google Wallet Mod v2.0 scenario.
[Nexus 5 Q&A, Help & Troubleshooting] dk_zero-cool:
If we are talking about from a security perspective, then I agree. This is one example of why it is not very smart to rely on device info for any type of security. If you have physical access to a device, you can do just about any thing. Checking Android's setup is not very safe, the info can be altered and you also have other options like the recovery. If you some how check the recovery as well (which is harder), users can always find other means to breach the device. Security should be made in ways that does not get affected by the state of the device (Unlocked, Rooted, etc...). It is possible to create a secure payment system that stores card info and uses NFC, like Google Pay, without trying to eliminate recoveries, root, custom rom's and so on. We already use this type of product in Denmark.
[Nexus 5 Q&A, Help & Troubleshooting] zeroibis:
Ideally, Google needs to figure out how to sand box the stuff so that it no longer is an issue for the lawyers and as an added benefit their payment platform is even safer. Maybe it should just run inside its own little VM. I mean **** maybe that is what we got to do is run a stock android on a VM within our device and use the app there...
[Nexus 5 Q&A, Help & Troubleshooting] gflash2015:
I guess it somewhat depends what you think your Android phone is. You can think of it as a phone which allows you a limited set of additional functionality with a gatekeeper being a carrier (i.e. Verizon, AT&T etc.) or a manufacturer/OS supplier (i.e. Blackberry/Microsoft/Apple). Or you can see it as something that is more and more becoming just a general purpose computing device with a high-speed LTE modem attached. I go with Android phone because I believe it is largely a general purpose computing device which I can do what I want with. So root is my right. And obtaining root through "fastboot oem unlock" is not an exploit.

I personally don't care too much about Android pay. Adding an extra intermediary just adds more security risks to the transactions (and both my personal info and my bank info is in one place - bonus!). And with credit cards I don't have to worry about making sure they are powered up before going out shopping.

However, I can understand that some people excited by the technology are upset about being locked out of Android Pay on their phones. We know there are some foolish people that root their phones, but I believe in general people who do root are more likely to know what they are doing. And yes having root can be an attack vector if you are not careful, but attacking servers is a much more likely and fruitful venture (I believe I have received four letters this year so far saying my information has been stolen - ugh). I don't know of any similar large scale hacking of Android root users (yet). And whilst new rules may have started Oct 1, it is still going to be many, many years before chip-and-pin will be the norm in the US.

Thus I believe their grievances are perfectly reasonable, especially since Android Pay is being baked into OEM ROMs or being auto-installed by Google through the Play Store (you auto-install this %^$^$ on my phone then you lock me out of it???). Just because you disagree with their concerns, I don't believe it is helpful to disparage them.
[Nexus 5 Q&A, Help & Troubleshooting] uudruid74:
In fact, once the card info is entered, Google gives you an account number and the card info itself isn't transmitted and I don't think its stored on the device either.

Taglines suck. https://eddon.systems