Comments on: ARM TrustZone Powered Mobile Payments

By: Google Wallet should use ARM TrustZone for 100% security – ARMdevices.net

Google Wallet should use ARM TrustZone for 100% security – ARMdevices.net — Mon, 13 Feb 2012 18:49:29 +0000

[…] ARM TrustZone to make the pin code authentication system 100% secure. I filmed about ARM TrustZone a couple years ago. The way ARM TrustZone works is to create a separate 100% trusted OS used just to enter the pin […]

By: TI OMAP5 28nm ARM Cortex-A15 sampling second half 2011 already – ARMdevices.net

Wed, 09 Feb 2011 17:46:57 +0000

[…] output up to 4 screens including 1 HDMI, it has TI’s M-Shield Security system which includes ARM Trustzone Hardware Support, USB 3.0 host, Sata 2.0, SDXC Flash. Designed for easy porting of software from […]

By: John Bruggerman of Cadence on EDA360 at ARM Techcon 2010 – ARMdevices.net

John Bruggerman of Cadence on EDA360 at ARM Techcon 2010 – ARMdevices.net — Wed, 10 Nov 2010 10:52:07 +0000

[…] standardization of Linux on ARM, supporting drivers, implementing security at the hardware level (see my video of ARM TrustZone), and how John Bruggerman thinks competing EDA providers should agree on how to collaborate on […]

By: Alban Rampon

Alban Rampon — Tue, 09 Mar 2010 16:57:54 +0000

Hi David,
TrustZone could be called a special environment to which access is regulated. As this is embedded, in order to clone it you would need to reverse engineer at the die level = deprocess the chip.
This is not a matter of obscurity, but this way any keylogger or trojan would be useless and that is the point: working in a safe known environment.
Cheers, Alban.

By: Charbax

Charbax — Sun, 07 Mar 2010 17:53:21 +0000

In reply to David Ashwood. If I understand this correctly, the PIN is only between you and the phone. So for example someone stealing your phone cannot use it to transfer money or authenticate unless they know your 4 digit pin code. The secure thing towards the web app happens at another highly encrypted level in the hardware which I think is not connected with your pin code. I'd rather have one pin code for net banking, payments, another pin code for all my web apps, than having to type in passwords on web browser sessions and have to think of having a different password for each site for it to be secure, and regularly change the password.

By: David Ashwood

David Ashwood — Sun, 07 Mar 2010 17:16:54 +0000

Security through obscurity isn't.
Tied to the phone? Phone cloning has been around for a long time.
People do reuse passwords but they also reuse PIN's – what would you rather have a 7+char password or a 4 char pin?