Skip to content

Security & Threat Model

1. Overview

This document outlines the security constraints for the "Manual Tap" feature to specifically address risks associated with NFC broadcasts and peer-to-peer data exchange.

2. Threat Analysis

2.1 NFC Skimming / Eavesdropping

  • Threat: A malicious actor with a high-gain antenna reads the NFC signal from the Merchant POS from a distance (e.g., 1-2 meters).
  • Mitigation:
  • Public Data Only: The broadcasted NDEF message contains only the intentId (reference UUID). It contains NO customer data, NO private keys, and NO amount information.
  • Short Lived: The UUID is only valid for the duration of the payment window (e.g., 15 minutes).
  • Contextual Validation: Even if an attacker clones the tag, they can only pay the merchant. They cannot steal funds or redirect the payment.

2.2 Malicious Tag Emulation (Relay Attack)

  • Threat: An attacker sets up a fake Merchant Terminal broadcasting their own intentId overlaying the real merchant.
  • Mitigation:
  • Merchant Verification: When the Customer Wallet resolves the intentId, the UI MUST display the Merchant Name, Verification Status (e.g., "Verified Business"), and an optional Merchant Logo.
  • User Confirmation: The user must explicitly confirm the recipient on their screen before signing the transaction.
  • Location Check (Future): Compare GPS of Merchant (registered) w/ Customer (current).
  • Threat: Another malicious app installed on the user's phone registers sagio:// and intercepts the payment intent.
  • Mitigation:
  • Android App Links / iOS Universal Links: Use verified app links (https://sagio.app/pay/...) which are cryptographically signed and associated with the domain, preventing other apps from claiming them.
  • Note: Spec 002 currently recommends custom scheme sagio://. Shifting to https://sagio.app/pay/{id} is recommended for security hardening with x402.

3. Data Minimization Principles

  1. NFC Channel: intentId ONLY.
  2. WebSocket Channel: intentId, status, masked_customer_info. Full PII is never sent to the POS via WebSocket.
  3. HCE Service: The native service strictly accepts strings for encoding and performs no logic/storage of sensitive data.

4. Worldline Segregation

Ensure no data leaks between Worldline Banking SDK contexts and Sagio contexts.

  • Memory isolation: Ensure HCE buffers are cleared after stop.
  • Process isolation: HCE runs in the main app process, while Banking SDKs often use protected memory spaces. Do not attempt to bridge data between them.