About NFC Tags; Tectiles, SmartTags, Tag+, Mifare and much more

Note that the applications installed on the phone drive what actually happens (and when installing the application you grant it permission). Usually this means that a contact might be added to an address book, or a web page is displayed on your browser.

To do what you suggest would require installation of a malicious app that cooperates with a malicious tag…

NFC tags have a chip inside them that stores a certain amount of data. As some folks have mentioned, that data is very similar to what’s stored in a QR code. Tags can be written by an NFC device multiple times and locked (useful if you post it in a public place…) The tag doesn’t “run” anything; it just supplies data. The way an Android phone uses the data is very simple. The NFC service detects and reads the tag data (only when the phone is unlocked) and creates an Intent object with that data. Android looks for installed application that have stated they can handle certain types of intent data.

For example, if the tag had an http url on it, this would trigger any application installed to handle http urls, like a browser. Application Intent filters may be much more specific. For example, I could create an application that registers a filter for http urls for my website and when a tag with a url starting with my server name is read, my application starts.

As an example for a class I’m teaching, I programmed a tag with a url that included a server address and a grid location. The data from the tag was handled by a game application that starts up (via normal Android Intent processing), connects to the specified server, and sends the grid location. Using a bunch of NFC-enabled Android phones, we created a little game where you can move “game pieces” around a game board that communicated with each other via that server. All you needed to do was move the phone, no other configuration was needed. NFC really enables many new kinds of simpler interaction…