search

kormax / apple-vas

Reverse-engineering Apple VAS protocol
89 stars 9 forks source link

[QUESTION] Signup URL #5

Closed renesass closed 2 months ago

renesass commented 2 months ago

Apart from reading passes, this protocol also allows reader to send a signup URL to the device, causing a signup link notification to appear on devices that do not have an appropriate pass downloaded.

This sentence only applies if a payment was made, right? Or is there a way to present the signup URL if the card in the wallet was not detected?

kormax commented 2 months ago

I didn’t note it here, but as far as I remember - yes.

Phone attempts a request only if payment was performed after signup URL has been sent in the same NFC communication session.

kormax commented 2 months ago

Also, as far as I know, even if you manage to generate a valid response to the initial HTTP request in order to continue the flow, the device will then phone home to Apple servers, checking if that pass type identifier is allowed to perform “personalization”, which is subject to a separate agreement with Apple, and it will abort the flow if it isn’t.