A security company announced yesterday that it has discovered a “significant vulnerability in the Google Wallet mobile phone payment system.” The company found that a Wallet PIN is susceptible to a brute force attack – trying all possible key combinations until the PIN is discovered – that can make it possible for thieves to make purchases with a Google Wallet-enabled phone.

But Zvelo, the security company in question, buried the lede; a phone must be rooted ahead of time in order for its hack to work. An attack will not work on a non-rooted device, and rooting the phone post-theft would wipe away the PIN information and be of no use. Google made that important distinction in a statement to The Next Web.

The zvelo study was conducted on their own phone on which they disabled the security mechanisms that protect Google Wallet by rooting the device. To date, there is no known vulnerability that enables someone to take a consumer phone and gain root access while preserving any Wallet information such as the PIN.

We strongly encourage people to not install Google Wallet on rooted devices and to always set up a screen lock as an additional layer of security for their phone.

Zvelo did note in the bottom of its announcement post that root is required for the hack to work. However, the company claims that because Nexus devices are more likely to be rooted, that doesn’t diminish the danger of the way that Google Wallet data is stored on a device. The only solution is to move PIN information into the Secure Element, an area in which all data is encrypted. Google is already working on this adjustment.

So the simple solution here is to not root your phone if you want to use Google Wallet. And if you are rooted, you already know that doing so exposes you to a lot more security risks than the average customer. That naturally means the onus is on you to keep your information secure. Employ a pin code lock screen on your phone and don’t lose your phone.

It’s still safer than losing your actual wallet and credit cards that thieves can use for a shopping spree before you realize its gone.

Hey now! It looks like Google, or the mystery magical app fairies, managed to get Google Wallet into the Android Market for more Nexus devices. Previously, Google Wallet was viewable in the Android Market only by Sprint Nexus S 4G users, but it’s suddenly popped up for Galaxy Nexus users on AT&T and Nexus S owners on T-Mobile USA.

There’s no telling when it first started happening, but The Verge reports that it’s available now. A few people in the comment section report that they are now able to see the app and download it, a welcome change from the previous solution of hunting down APK’s and having to repeat the process when an update was available. This method is officially sanctioned and allows users to get to Google Wallet via the standard installation method.

Also of note is that some Verizon Galaxy Nexus 4G users are also able to download directly through the Android Market via a workaround. Droid-Life received a tip from a reader who found a roundabout way to install through the browser on the Galaxy Nexus. I managed to get it to work on my stock, non-rooted Galaxy Nexus on my third attempt (use the long way described); others weren’t so lucky.

In an ideal world, Google would just make the app available to everyone, but carriers sadly stand in the way of that happening. You can look around for an APK to install manually if you own an unsupported device, but those lucky enough to get Wallet through the Market can get a list of local stores that support it here.

Mint.com ranks as one of the best personal finance management services around. I said as much when I first reviewed the Mint.com Android app back in 2010, and I’m more convinced of it now. Especially since the company announced today that users can add Android tablets to the list of devices on which they can monitor the bills and bank accounts.

An update to the Mint.com app has added support for Android Honeycomb tablets. The new app is optimized for larger screens and adds the convenience of a touch-friendly mobile app rather than asking users to visit the site through their browser. The same features are available, just in a better-looking format.

• Organize accounts – Mint links with your credit cards, checking/savings accounts, and investments to provide a snapshot of your financial picture. The app can only view accounts, not make transfers or payments, so this is strictly a monitoring tool.
• Track spending – Members can create a budget organized by category and spending limits, then import transactions from their accounts to ensure that they are sticking to it. You can also manually enter cash transactions.
• Financial insight - the app shows detailed graphs that show where you spend money, and can be narrowed to a specific period. You can also search for a specific transaction or purchases made within a category, tag, or merchant.
• Alerts and updates - Mint can set-up reminders to pay bills, recent account balances, and notify you when large transactions take place.

Head over to the Android Market and sign-up for a Mint account to start using the service if you haven’t already. Accounts are free.

ShopSavvy was one of the first “wow” apps on Android thanks to its ability to scan a barcode and provide a quick price comparison between local and online retailers. The app has since faced pressure from several competing companies, including Google, but the latest version really pushes the company’s strength in the buying and selling process.

Yes, buying and selling. ShopSavvy 5 now supports selling items that you own directly within the app. The feature is still in beta according to ShopSavvy, but it’s available in the app if you know how to look for it. To sell an item, scan a barcode as you normally would. Then when the results appear, press Options > Sell This Product yourself and enter the pricing/condition information. Then other users who search for that item will be able to see and purchase it.

ShopSavvy has sort of created a mobile Craigslist. Deal hunters often go to that site to purchase cheaper items, but they also do comparison shopping at brick-and-mortar and online retailers. By being able to show how much an item costs new at Best Buy, Amazon, and Joe down the block, ShopSavvy could become a central place to try and locate deals. It will take a lot of adoption for that to happen, but it’s an interesting change of pace for the app.

Also new in ShopSavvy 5 is the digital wallet feature that allows consumers to make a purchase directly within the app. The “one tap” purchasing will let consumers enter their payment and shipping data into an account with ShopSavvy. It will always be ready for quick purchasing should the member spot a deal. So instead of paying $59 for Modern Warfare 3 in Target, you select an online retailer selling it for $49 and pay for it within the app. About 50 retailers and growing are supported, according to ShopSavvy. Check out the video below to see it in action.

The New Jersey Transit Corporation has announced that it will begin accepting Google Wallet for payments at select locations. Rather than have mass transit riders rely strictly on cash and credit cards, NJ Transit vending machines and ticket windows will add Wallet as a payment option.

NJ Transit will accept Google Wallet for ticket purchasing at New York Penn Station, Newark International Airport Rail Station, and bus routes 6, 43, 80, 81, 87, and 120. The 126 route will accept payments as well, but only some buses will be equipped to support the contactless tap and pay system.

As someone who visits the Garden State multiple times per year and gets frustrated with its ticketing system on trains, I’m happy to see the state finally take some steps toward easing the purchasing process. I would have preferred to see something more akin to Japan where users simply tap their phone and gain entrance, but the current system that NJ Transit uses still requires paper.

For Google, this will be a major promotional tool for encouraging NFC awareness. As we saw in Charles’ review of Google Wallet and the recent promotional video we covered, people are impressed when they see NFC. Impressed enough to shell out money for a new phone capable of supporting it? Not so much, but that may be influential when the eventual upgrade time comes. Pressing a phone against a receiver is more convenient than reaching for exact change.

“Transit has been a common element of every major successful NFC effort globally and is a critical component of Google Wallet’s success,” said Stephanie Tilenius, vice president of Commerce at Google. “Transit is the fastest way to accelerate adoption and reach usage density in major urban centers by habituating the behavior of tapping and paying with phones, and we’re excited to launch our transit effort here with NJ TRANSIT.”

Translation: the more people we expose to NFC through mass transit, the more likely we are to make them use NFC at the other stores that accept the payment. See a map of NFC-capable businesses in your area here.

NJ Transit via TechCrunch Thanks, Cris!

I’ve read a lot about Google Wallet today. Earlier this morning, I saw a report from a research company, reprinted by The Telegraph, that claims most consumers in the UK are fearful of near field communications. Only 17 percent of 1,000-plus people surveyed by Intersperience say that they want to use their phone to make mobile payments. A perceived lack of security worried 44 percent of respondents, with 24 percent saying that they fear their phone is more likely to be stolen than a wallet.

And? When someone steals your wallet, they can walk into a store or go online with your credit card and go on a spree. If someone steals your Google Wallet-enabled phone, they get your phone – not your purchasing info. Aside from calling your credit company to prevent purchases just like you would if any actual wallet was stolen, consumers should also read the Wallet security policy to see why their data is secure.

The Secure Element…is separate from the phone’s main operating system and hardware, which enables encrypted protocols to enforce access control. Only authorized programs like Google Wallet can access the Secure Element to initiate a transaction. There are multiple levels of protection for data stored on the Secure Element and it is protected at the hardware level from snooping or tampering…Even Google Wallet itself has very limited access to the Secure Element, and cannot read or write data from its memory.

Google Wallet is obviously more secure than your actual wallet, so the challenge to encouraging adoption will be letting people know how easy and secure it is to use Wallet. That’s exactly what Google did in New York and San Francisco. In this video shared on Google Plus, we can see Google picking up the tab for a bunch of shoppers wowed by the system. I’d guess there’s a degree of over-excitement because the cameras are rolling, but there are some people who are genuinely impressed and surprised by the simplicity. Google will probably need viral videos like this and a whole lot more marketing in order for people to embrace Wallet. Among other things.

Friday is Apps Day at Androinica.com. At the end of each week, we take a look at the press releases, review requests, tips, and many visits spent to the Android Market while watching trashy TV reality shows, all in the name of finding some interesting apps to recommend to our readers each week. Android Apps Alert is all about digging through the Android Market to find what you need, so take a look below and see what you want to load on your phone.

Amex for Android

Android 3.0+ required

American Express already has a well-received app for Android phones, and now has what will probably be a well-received app for tablets. Amex for Android is a Honeycomb-only app that does all of the things you would expect from a credit card application: schedule payments, view balances, and view charges and payments. It also displays Membership Rewards points to see how many points you have, as well as special offers. Multiple cards and accounts are supported in the Amex app, and the interface is simply beautiful. All of the information you need is presented in a simple interface, and users can find contact or help within the app.

SlingPlayer for Tablets

$29.99 USD
Android 3.0+ required
Slingbox Solo or Pro-HD required

While the rest of the Android world was complaining about the lack of Hulu and Netflix on Android, Slingbox owners were watching television on their Android phones. That’s because SlingPlayer allows anyone who owns Slingbox hardware to access video from their cable or satellite DVR, Tivo, and Apple TV. A Slingbox Pro HD or Solo is required, but once you connect the hardware, you’ll be watching hours of television anywhere that has Internet access. The $29.99 price tag is a little steep, especially if you have already purchased the phone app that works on tablets. However, that’s a 1-time fee rather than the monthly costs paid to Hulu and Netflix for less choices. Differences between this and the phone version include an on-screen remote, Honeycomb optimization, and a better program guide that is the same as your home channel set-up.

RBC Mobile

Android 2.1+ required

The Royal Bank of Canada finally has an Android app. The RBC Mobile app is long overdue and has room for improvement based on Market reviews, but it is a serviceable replacement for using the mobile site. RBC allows customers to view their account details, including balances and transactions. It can also transfer funds between accounts, pay bills, and transfer money to someone else’s registered account. The app can also calculate mortgage payments and exchanges to other currencies. And for those times when you need to get cash or speak with a teller, a Branch & ATM Locator provides directions based on your GPS location. The app is available in both English and French.

RushCard has finally delivered an Android app for smartphone owners looking to manage their accounts on the go. The prepaid debit card provider has followed the trend of other banks like Bank of America and Chase by building an Android app that lets users monitor their accounts.

The mobile banking trend has finally trickled down to RushCard users, who can now check an account balance or view transaction history to make sure that everything is order. The Android 1.6 or higher app can perform transfers from one RushCard to another, including your own or that of a friend you owe money to for splitting pizza costs. Users can even bump phones to exchange contact information and store information for people whom they wish to transfer money.

RushCard, the prepaid Visa debit card service endorsed by music mogul-turned-entrepreneur Russell Simmons, is a fee-based charge card that uses only funds deposited by cardholders. It’s commonly used by young people, students, and people sending remittances to family members as a way to access money without having a checking account or credit card. That’s a convenient option for some, but not having a way to easily monitor or manage account status was anything but convenient. The lack of an app was especially troubling considering that so many of the RushCard’s target audience (teens and college-age consumers) use smartphones.

Download the app from the Android Market and set-up a username and password to access your account. An existing RushCard.com account will work as well.

Payment processing company Heartland Payment Systems, has just launched a system to allow merchants to accept payments through smartphones and tablets, which effectively challenges both Square and Verifone’s Android apps. Heartland’s system is called Mobulye, and much like its competition, it includes an Android application and an encrypting reader that plugs into the device’s headphone jack for the use of credit card swiping.

There’s a lot of competition from not just Square and Verifone, but Google Wallet. So in an effort to slightly bypass its competitors, Heartland plans to focus more on the merchant side of things. Mobulye is ideal for merchants who face large lines and have a limited number of checkout counters. Just think about all the times you went to a local store and you had to wait for some obscene amount of time to buy a soda, Heartland plans to cure that problem.

The way the company plans to cure such a problem is by allowing employees to pick up one of the systems and begin processing purchases for customers in line. The merchant can then email the receipt to the customer once it processes the transaction. Heartland plans to get its system up and running on its own without any partners. I don’t know about you, but faster checkouts sounds like a breath of fresh air to me.

Down the road the company plans to use the tap-and-go payment system called near-field communications (NFC) technology, which Google is firmly behind with future NFC Android enabled phones.

Business Wire

The Android Market has more than 250,000 apps to put on your Nexus S or Motorola Xoom. Of course, you can’t fit – and probably don’t want to – all of those apps onto your phone, so Androinica.com tries to help each week by providing a quick round-up of what’s new and interesting in the Android Market.

This week’s theme is the “Would You Look at That” edition because that’s what people will be doing in most of these apps. Looking at their television, looking at what their photos, looking at what they eat, and looking at their screens as they play what’s likely to become one of Android’s most-popular games. Keep in mind that not everything is compatible if you aren’t running a recent version of Android.

Quick Hits on New Apps

• TouchRetouch Free - Remember that awesome app that we reviewed that can remove items from a photo like magic? Well, a free version is now available that is equally awesome. Download now and touch-up some of your favorite photos.
• Scottrade Mobile - Monitor your portfolio with the Scottrade app. It links with the user’s account make trades, but anyone can use the other features of the app. Scottrade has “real-time” stock prices, news artless, and can be set to provide alerts when a stock reaches a certain price.
• FoxSports Mobile - Not content to let ESPN have all the fun, FoxSports has released its own Android application for sports fans to track. The app shows schedules, news, scores, standing, stats, and select video from the FSN channels.
• Shahr Ramadan – If you’ve been looking for an app that will help estimate the time of sunset and sunrise during the month of Ramadan, check out this app. It uses GPS settings to determine your location and then reports when you’ll be able to break your fast.

Star Legends Beta (3D MMO)

You may be familiar with Spacetime Studios as the company behind the very popular Pocket Legends MMORPG. Spacetime is back once again with a Sci-Fi-themed adventure. Star Legends features a a world in which the player joins others online and travel through space to fight aliens. Players assume the role of a Command, who is the warrior of the group; an Operative that uses lasers to fight back; and an Engineer, which is the role that manages tech and repairs. Each class of fighter has its strengths and weaknesses, and users will benefit from co-opting online with other characters. The game is compatible with iOS and has been in an Android beta for a few weeks, so there are already plenty of people playing online.

Streamzoo

We recently took a look at the best apps to use while you wait for Instagram to arrive on Android. That seems less likely to happen with each passing day, so let’s focus on some good alternatives already on the market. Streamzoo missed being included in our round-up, but it’s got the makings of being a contender in the future. The app offers a limited set of filters, border, and tilt-shift options, but it can customize photos with a decent set of effects.

However, the real draw to Streamzoo is that it handles the social aspect of sharing better than most apps. Photos can be shared with public streams (think of them as photo pools) with certain tags. Someone can add a description with the #Honolulu hashtag and a stream will be viewable of other photos with that tag. Users can create profiles, follow streams, connect with friends, export to Facebook/Twitter, and earn points for photos shared to reach the leaderboard.

Calorific

This morning I woke up and had a breakfast that would make the guys from Epic Meal Time proud: bacon, eggs, bacon, pork, bacon, waffles, bacon, and Orange Juice…mixed with bacon and Jack Daniels. That’s way too many calories, so Calorific Diet Tracker is an app that logs the food someone eats each meal. Calorific lets users snap a photo of a dish, enter notes on what they eat, add food type (great, ok, bad) or food group (Fruit, veggie, grains, etc.), and then list portion size.

The app is a personal diary that monitors calorie intake and helps keep users honest about the type of food they should be eating vs. the type of foods they actually eat. It also monitors amount of water the user drinks throughout the day, so download this app and get back into the habit of eating less epic and more healthy.

Peel

What’s on TV right now? Fire up Peel and you’ll see a personalized, visually-based guide that is more fun to navigate than text-based listings. Peel shows tabs of programs on TV now or set to air later, and can then provide the important details for that program: air time, duration, channel, and a quick synopsis. Users can star a program to mark it as a favorite or cut it to remove such shows from appearing again.

This is important because it makes Peel’s recommendations more intuitive to your tastes. For instance, I love the Jaime Foxx Show and True Life but hate Meet The Browns and Sex & The City. By sending those signals, Peel doesn’t display that show during the time-slot (it may appear at other times) and promotes the ones that I do like. Users can also browse TV shows, movies, sports, genres, and search to find a specific show.

IntoNow

IntoNow is part of the crop of social television shows that have popped up this year. It allows users to find their Facebook/Twitter friends and check-in to see what others are watching. But rather than simply tap on a show listing, IntoNow is like a Shazam for TV that can identify what’s on the tubes.

The app listens to audio from the TV and figures out what program is being viewed. It then provides cast and genre information, lists other people currently watch (who you may want to friend for having similar tastes), and links to IMDb. It also lists the Popular shows among all IntoNow members.

Android App Reviews of the Week

• DSLR Controller makes Android a live controller for Canon DSLR cameras
• LoopNet delivers another property search app to Android
• New Skype update brings video calling to a slew of handsets
• Nissan LEAF manages controls directly from your Android phone
• GroupMe update shows G+ Huddles aren’t the only game in town
• Google+ Android app update fixes notification problems, refines sharing
• Squarespace for Android: A Beta Preview
• Go Launcher becomes an even better home launcher with Facebook & Twitter widgets [App Review]
• Capital One Mobile Banking app hits the Android Market