Datamining Facebook's Novi wallet
I tested Facebook’s new Novi digital wallet and found evidence for upcoming features, such as a debit card to access Novi balance, third-party linking with QR codes, and a way to buy Bitcoin directly from the app.
A hands-on video! Sort of.
Here’s my “hands-on” of the Novi settings screen on Android. I can’t demo the actual wallet since I wasn’t able to sign up for an account.
https://twitter.com/zhuowei/status/1457420727838195728
Facebook Novi wallet hands-on:
— Zhuowei Zhang (@zhuowei) November 7, 2021
... except I'm not going to give Facebook my driver's license or bank account
You only get to see an empty "Settings" screen. Sorry. pic.twitter.com/Grh9Fhz22J
I wasn’t eligible for the Novi beta (which requires you to be a resident of selected states in the US or Guatamala, and requires you to upload your photo ID).
To work around this, I:
- rented a cloud server in California
- modified the APK to replace “prod.novi.com” with my own server
- disabled certificate pinning by adding a
return-void
to the function that throws thepinning error, trusted chain:
error. - changed
kyc_status
in the login response toONBOARDED
This allowed me to view… the settings screen, and that’s it. (The actual money UI is controlled by the server, and without a valid account, it just gives a blank homescreen)
Enabling feature flags in Novi’s Android app
https://twitter.com/zhuowei/status/1457420727838195728
https://twitter.com/zhuowei/status/1457428236774817796
If I enable every unreleased experiment flag in Facebook’s Novi wallet, I get a few extra settings for “Statements and Documents”, “Diem address”, “Sounds”, and “Linked accounts”:
Strings
I also pulled strings from both the Android and the iOS versions of the app:
Novi Card
Facebook’s Novi digital wallet includes text about a “Novi Card”, a Visa-compatible debit card to access your Novi balance:
https://twitter.com/zhuowei/status/1451644426221015041
QR linking
Facebook’s Novi wallet seems to let you link an account with a third party by scanning a QR code? I’m not sure what kind of third party this would support.
https://twitter.com/zhuowei/status/1451648546827030531
Buying Bitcoin
Facebook’s Novi wallet has text about… buying Bitcoin, for some reason:
https://twitter.com/zhuowei/status/1451647713150480390
Android strings
Here’s the strings.xml of the Novi Android APK if you want to see if there’s anything else interesting.