Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poynt – Smart payment terminal

getpoynt.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Poynt – Smart payment terminal

#61

Post by rtanaka »

bravo22 wrote: post #57
rtanaka wrote: post #30

Earlier quoted context omitted.

Okay, I'll bite. I'm an employee so you'll have to take what I say with a grain of salt. The video was produced with a cosmetic device and with actors. You're right that the card has to be in the device during PIN entry. The scene you're referring to, however, is depicting tip entry. The device does not have an ethernet port but we will be shipping with a separate charging dock that will provide wired connectivity. I…

I appreciate you posting! I am not doubting that you are building the product. You/The company should probably put more effort in correcting the datasheet and the information you put out there. We can only judge by what is being presented. Your datasheet says Ethernet. It doesn't say Ethernet would be on a separate dock. It probably should. If you are placing the antennas behind plastic surfaces, that is great. You s…

No problem. I've been mostly a lurker on HN for a while but this is the first time being put under the microscope. I apologize if I came off as defensive. This is a product that's very close to my heart given the amount of time and effort we've put into the product offering. For the record, none of us here posted the article we are here because of the amount of attention and discussion it has garnered.

Point taken about the errors. There are many things we can improve on all across the board. We made a conscious decision to not let perfect be the enemy of good. The video is done so we won't go back and change that but I will work with the team to fix all of our marketing material to be as accurate as possible. Thank you for pointing out or errors.

With regards to tip entry. Industry standard recommends gratuity be added before PIN but it is not mandatory and is a merchant preference. I can't find all the card network examples easily but I happen to have the AMEX EMV Acceptance Guide open and this is what section 4.2.7 states - "In certain Merchant categories such as restaurants, it is standard practice to enable customers to add a gratuity to the amount of the transaction. There are many different ways in which a gratuity can be added. American Express does not define any specific methods for adding gratuities..." it further goes on to say "American Express recommends that Terminal software enables the Cardmember to add the gratuity amount to the transaction before entering his or her PIN. This enables the transaction to be processed as a normal, “card present” transaction."

In any case, we've all appreciated the various comments on here and it has clearly been the most critical audience of the bunch.

Re: Poynt – Smart payment terminal

#62

Post by bravo22 »

rtanaka wrote: post #61
bravo22 wrote: post #57

Earlier quoted context omitted.

I appreciate you posting! I am not doubting that you are building the product. You/The company should probably put more effort in correcting the datasheet and the information you put out there. We can only judge by what is being presented. Your datasheet says Ethernet. It doesn't say Ethernet would be on a separate dock. It probably should. If you are placing the antennas behind plastic surfaces, that is great. You s…

No problem. I've been mostly a lurker on HN for a while but this is the first time being put under the microscope. I apologize if I came off as defensive. This is a product that's very close to my heart given the amount of time and effort we've put into the product offering. For the record, none of us here posted the article we are here because of the amount of attention and discussion it has garnered. Point taken ab…

Omissions and errors happen. Your company has responded better than most. I'm glad someone from your company was on the forum to correct the record.

With respect to the tip flow, with Chip & PIN you would need the final amount before authorizing the transaction so the tip would be added before just as your guide suggests. Chip & PIN terminals in Canada and Europe do just that. They present you with the tip screen (% or amount) before you enter your PIN & finish the transaction. For MSR, just like in restaurants today, they can change the amount after the initial authorization but they also often authorize for about 50% more (to allow for tip) and then do the capture once the server takes the bill from the table and "closes" it with the correct tip.

I can say from personal preference that I would do a double take if a device allowed me to put my card in and finished the transaction and then permitted a change to the charge amount. What is stopping the cashier from adding her own tip once I walk away.

Re: Poynt – Smart payment terminal

#63

Post by rtanaka »

bravo22 wrote: post #59
rtanaka wrote: post #38

Earlier quoted context omitted.

A very valid concern. To begin with, while our terminal is Android based we have taken numerous steps to lock this device down. Side loading apks is not possible nor is arbitrary access via adb. On top of that, we take great lengths to protect consumer data. In addition to full PCI compliance data is fully encrypted on the device. And if that's not enough, there are several anti-tamper mechanisms that will trigger an…

Well, here is my big question: WHY ARE YOU STORING CARD DATA AT ALL ? (sorry for the caps). You are a pass-through entity, merchant terminals do not store card data. They keep the authorization number from upstream provider to allow void/refunds but there is no need for them to store the number. With respect to anti-tamper mechanism, are you FIPS-140-2 certified or plan to be?

We aren't storing actual card data encrypted or otherwise. As you said, we are a passthrough as far as the payment portion is concerned. We do store a hashed representation of the card for things like refunds (referenced credits).

Our security subsystem is being built to be FIPS 140-2 Level 3. Complete with tampers seals, switches and a security mesh that will destroy sensitive keys when triggered.

Re: Poynt – Smart payment terminal

#64

Post by rtanaka »

bravo22 wrote: post #62
rtanaka wrote: post #61

Earlier quoted context omitted.

No problem. I've been mostly a lurker on HN for a while but this is the first time being put under the microscope. I apologize if I came off as defensive. This is a product that's very close to my heart given the amount of time and effort we've put into the product offering. For the record, none of us here posted the article we are here because of the amount of attention and discussion it has garnered. Point taken ab…

Omissions and errors happen. Your company has responded better than most. I'm glad someone from your company was on the forum to correct the record. With respect to the tip flow, with Chip & PIN you would need the final amount before authorizing the transaction so the tip would be added before just as your guide suggests. Chip & PIN terminals in Canada and Europe do just that. They present you with the tip screen (%…

As mentioned, the point at which the dialog for tip is presented (before or after CVM check) is a configuration option for the merchant. Keep in mind we are deploying a US solution first. We are also anticipating that in the US we will have signature as the primary CVM before PIN. From that perspective, our flow will should be a little less odd.

That said, in the true Chip & PIN solution, once you ask for tip after PIN entry you as the merchant are opening yourself up to higher rates (Card Not Present) as well assuming liability for chargebacks. I don't know why a merchant would want to do that but as a platform we have chosen that use-case as an option.

Re: Poynt – Smart payment terminal

#65

Post by bravo22 »

rtanaka wrote: post #64
bravo22 wrote: post #62

Earlier quoted context omitted.

Omissions and errors happen. Your company has responded better than most. I'm glad someone from your company was on the forum to correct the record. With respect to the tip flow, with Chip & PIN you would need the final amount before authorizing the transaction so the tip would be added before just as your guide suggests. Chip & PIN terminals in Canada and Europe do just that. They present you with the tip screen (%…

As mentioned, the point at which the dialog for tip is presented (before or after CVM check) is a configuration option for the merchant. Keep in mind we are deploying a US solution first. We are also anticipating that in the US we will have signature as the primary CVM before PIN. From that perspective, our flow will should be a little less odd. That said, in the true Chip & PIN solution, once you ask for tip after P…

Thank you for the context.

Re: Poynt – Smart payment terminal

#66

Post by efiftythree »

fayez wrote: post #53
efiftythree wrote: post #50

Earlier quoted context omitted.

Assuming that someone managed to not only walk off with the device from a retailer but were also able to gain access to the device itself. What kind of data could be harvested from the device?

First things first; the card data is encrypted on read and the device will soon be PCI certified. So none of the card data will be accessible to anyone on the device. The transaction data (amounts, items, transaction statuses, etc) is managed by the PoyntOS (owned by Poynt). That data has the necessary authentication and authorization around it to prevent just anyone with the device from having access to it. Only a m…

Thank you.

Re: Poynt – Smart payment terminal

#67

Post by BillinghamJ »

rtanaka wrote: post #30
bravo22 wrote: post #27

Interesting merchant terminal -- but it seems to be little more than a pretty rendering and physical mock-up right now. I like how the first guy puts his card in, takes it out AND THEN punches in his PIN, which is exactly how PIN & Chip doesn't work. I would have hoped they'd at least be familiar with the process. It looks to me like a mobile computer strapped to a terminal. I'm not sure why this is better than havin…

Okay, I'll bite. I'm an employee so you'll have to take what I say with a grain of salt. The video was produced with a cosmetic device and with actors. You're right that the card has to be in the device during PIN entry. The scene you're referring to, however, is depicting tip entry. The device does not have an ethernet port but we will be shipping with a separate charging dock that will provide wired connectivity. I…

The expected way to handle Chip + PIN transactions is that the final price is set before you enter your PIN. It is never changed after you put the PIN in - because at that point, it becomes a card-not-present transaction.

Re: Poynt – Smart payment terminal

#69

Post by notatoad »

caissy wrote: post #17
ctz wrote: post #15

This is the first EMV payments terminal I've seen that allows PIN entry using a touch screen. Is that really allowed by EMV, as a tamper-evident PIN pad?

I've seen a few merchants using a touch screen, including a few Gap stores in Montreal.

Yeah, the touchscreen terminal that GAP uses is pretty common. Canada Post uses it too, and i know i've seen it in some other places.
Post reply on HN