Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple unveils contactless payments via Tap to Pay on iPhone

apple.com

Post reply on HN
Print view View original

721–730 of 736 posts

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#721

Post by rswail »

The way google/apple/samsung pay work is that there is a secure element that is running its own OS that contains applications. For contactless payment (the consumer side), there are apps that implement the EMV NFC standards and also interface with the tokenization services that are run by the card issuers.

In this case, it's a different sort of application that provides the merchant side of the EMV transaction, provisioned as part of the PCI SPoC standard (https://www.pcisecuritystandards.org/assessors_and_solutions...).

SPoC relaxes some of the physical security requirements while enhancing online monitoring (of the application and security of keys etc) and approval of an end-to-end implementation.

So the SPoC standard will allow merchant side payment processing without needing specific PA-DSS compliant readers etc, because the end-to-end between the secure PIN reader (SCR-P standard) and the SPoC monitoring replaces that.

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#722

Post by rswail »

Crosseye_Jack wrote: post #637
zumu wrote: post #474

Earlier quoted context omitted.

They can always take a competitive stance later, once small businesses have gotten rid of all their PoS hardware. This makes that initial adoption much easier.

While it will reduce how often card readers will be used, card readers will be around for a while yet. In many markets contactless (atlest with real plastic) still has limits requiring the card holder to validate themselves (in the UK it’s a max of £100 per transaction and £200 over multiple transactions) and some card holders dislike contactless completely so have cards without it. So in those markets you will still…

The iPhone has a secure element that will allow for it to implement the SCRP (Secure Card Reader for PIN) PCI standard.

So this allows for an iPhone/iPad/Android phone/tablet to implement EMV contact/contactless payments (obviously contact would require a physical card reader). Contactless payments above floor limits (eg in Australia $100) can require a PIN that would be entered through the tablet.

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#723

Post by rswail »

connicpu wrote: post #684
Crosseye_Jack wrote: post #637

Earlier quoted context omitted.

While it will reduce how often card readers will be used, card readers will be around for a while yet. In many markets contactless (atlest with real plastic) still has limits requiring the card holder to validate themselves (in the UK it’s a max of £100 per transaction and £200 over multiple transactions) and some card holders dislike contactless completely so have cards without it. So in those markets you will still…

Also not all banks are even universally issuing tap to pay cards. None of my credit or debit cards are yet

That is primarily a US issue. In EU/AU/CA/NZ and increasingly in Asia, EMV chip+pin and contactless(+pin) are used and mag stripe is specifically excluded from the new standards.

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#724

Post by rswail »

monkeynotes wrote: post #412
anonymouse008 wrote: post #393

Earlier quoted context omitted.

The real news is Apple specifically took a non competitive stance — making the API available to third parties like Stripe - rather than building in house, leveraging Apple Card connections, or similar

I am surprised Apple didn't make this a closed system and compete with Square for small businesses.

It's a closed system in that the applications that are installed in the Wallet require approval from Apple and that includes fees as does the provisioning of the existing EMV and other Wallet applications (not the other Wallet uses like passes etc).

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#725

Post by lmm »

jjav wrote: post #713
lmm wrote: post #687

Earlier quoted context omitted.

> It would have worked, every other card terminal we'd used in the country still supported magstripe, and I saw that her machine had a scanner. She didn't say the reader was broken or anything, just refused to try. Just because the terminal has a magstripe reader on doesn't mean her merchant account provider accepts it. Plenty don't, or some transfer the liability to the store in that case. > If the card hadn't worke…

> In 2014 a card that doesn't have a chip might as well be broken. 2014. I don't remember with 100% confidence, but I'm pretty sure none of my (many) credit cards had a chip back in 2014. Stores here didn't even start installing chip reader card stations until ~2018 or so.

OK sure, but in 2014 in Norway a card without a chip might as well be broken. If I turned up to a restaurant where you are, asked if I could pay by card, ordered, and then busted out my UnionPay card and demanded they accept that, would you say that was reasonable?

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#726

Post by exikyut »

kyawzazaw wrote: post #592
exikyut wrote: post #220

Earlier quoted context omitted.

I was wondering how this was done. How on earth was what amounted to a userspace app able to talk to the NFC hardware to the extent necessary to process payments?! Presumably the app received the relevant entitlements to be able to do this...? How on earth was it done securely, within the Mobeewave app?

Check this out as well from Visa. Disclaimer: I worked/work on this https://usa.visa.com/about-visa/newsroom/press-releases.rele...

Wow, that's really cool.

> In January 2020, Visa first showcased the power of “Tap to Phone,” an industry-first solution that transforms current generation Android smartphones and tablets into contactless point of sale terminals. Tap to Phone was Visa’s first offering that let sellers accept payments on the devices they already own, just by downloading an app. As of December 2021, there were more than 300,000 devices across 54 countries using Tap to Phone.

I'm curious how the overall transaction/security flow works, broadly speaking.

It sounds to me like you managed to figure out a solution that satisfies the security posture of the ordinary app sandbox (ie without requiring any entitlements on iOS, or priv-app partnerships on Android). That's kind of incredible IMO. Are you using the Secure Enclave on iOS, and if you are, what are you actually storing in there? I'm curious if Android gets to play too given that it doesn't have the same sort of security guarantees, and if so, how.

I also get the impression the actual validation/verification (including steps that I would assume would typically happen on a payment terminal) has been moved to the cloud somehow. I'm very curious how that works too.

Presumably you would've also needed to design something capable of withstanding absolute worst-case scenarios like memory inspection on a rooted phone, or NFC sniffing/proxying/emulation.

Maybe you're just sending all the card data straight back to the cloud? That would pretty much solve everything :)

Also... while engineers are always going to gravitate towards balanced analyses of benefits and tradeoffs, the questions above are not coming from that perspective :) I'm very happy to hear whatever you can share about the security of the platform. (I'm just a random consumer who occasionally boggles at JavaCard when I pay for stuff lol)

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#727

Post by throwaway473825 »

user_7832 wrote: post #96
throwaway894345 wrote: post #81

Earlier quoted context omitted.

I studied abroad in France in 2012--at this time, all European card readers had been chip-based for quite a while and my US credit card didn't have one. I couldn't figure out how to use them and many store clerks had no idea what to do with my magnetic-strip credit card. I went to England in 2019, at which point cards in the US had been updated to use magnetic stripes, and everyone was using tap-to-pay. It turns out…

Can't speak for other countries, but at least here in the Netherlands, chip based cards are still the main type of card, though most of these cards support contactless payment as well. Almost all PoSes also support Apple/Google pay too which is actually pretty convenient. However, I think many (supermarket) PoSes also support magnetic - they appear to have 2 card slots on them.

Can't speak for the Netherlands, but contactless payments seem to dominate in many European countries: https://www.nets.eu/Media-and-press/news/Pages/The-DACH-regi...

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#728

Post by kyawzazaw »

exikyut wrote: post #726
kyawzazaw wrote: post #592

Earlier quoted context omitted.

Check this out as well from Visa. Disclaimer: I worked/work on this https://usa.visa.com/about-visa/newsroom/press-releases.rele...

Wow, that's really cool. > In January 2020, Visa first showcased the power of “Tap to Phone,” an industry-first solution that transforms current generation Android smartphones and tablets into contactless point of sale terminals. Tap to Phone was Visa’s first offering that let sellers accept payments on the devices they already own, just by downloading an app. As of December 2021, there were more than 300,000 devices…

I am not quite at liberty or have the capability to fully explain all of it. But I can confirm Android is one of the main focus.

We actually have a video that showcases the real-life usage. https://www.youtube.com/watch?v=OE6OmVd6Fxw&feature=youtu.be

A lot of what used to be done on Payment terminals are now done on the cloud.

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#729

Post by gtk40 »

cameronh90 wrote: post #618
gtk40 wrote: post #349

Earlier quoted context omitted.

In my area most restaurants with table service don't have an easy way to do tap-to-pay (a few chains have something at the table for you to pay at that supports it). Also two of my most common retailers do not (Kroger and Home Depot). Very few gas stations support it, though the one closest to me recently added it.

In the UK, they bring the card reader to your table and the transaction completes wirelessly. If you want to add a tip, you type the amount into the reader before you tap. Increasingly public transport supports contactless instead of tickets or proprietary NFC systems - notably the whole of London supports contactless and I've not used an Oyster card in years now. I've also not seen a card reader that doesn't support…

Many gas stations are still magnetic strip only. It was the majority as of a couple of years ago, but it's shifting quickly. That said, I still very frequently encounter gas stations that don't accept chip or tap, only strip.

Re: Apple unveils contactless payments via Tap to Pay on iPhone

#730

Post by aaronfitz »

profmonocle wrote: post #627
munk-a wrote: post #555

Earlier quoted context omitted.

Well, in all fairness, Uber mostly killed the whole taxi industry by being really really illegal and not following any of the rules - including those meant for regulatory capture and those for safety. About 3000 women are sexually assaulted by Uber drivers every year - I'm not saying that doesn't happen with taxis too, just be careful about painting a too-rosy picture.

I'm not sure how it was in the early days of Uber, but these days Uber does background checks on drivers, and IIRC they have for quite some time. Is there really any reason to believe that cab companies would do a better job of weeding out horrible people than Uber? I can't imagine they do much more than a background check.

They run the background checks, but they might not take any action on the result of them. A friend of a friend is a registered sex offender who drives for them. They stalled him for about 6 months, but ended up allowing him to drive when he was still willing to after the long delay.
Post reply on HN