Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Pay on pace to account for 10% of global card transactions

qz.com

Post reply on HN
Print view View original

221–230 of 432 posts

Re: Apple Pay on pace to account for 10% of global card transactions

#221

Post by xenocratus »

reaperducer wrote: post #160
thesimon wrote: post #154

Earlier quoted context omitted.

>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system…

I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.

It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess

Re: Apple Pay on pace to account for 10% of global card transactions

#222

Post by Marsymars »

riffraff wrote: post #90
_bxg1 wrote: post #54

Earlier quoted context omitted.

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.

my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?

Depends on card issuer, jurisdiction, retailer, security heuristics, etc.

Most of my cards have a $100 contactless limit for most retailers. Costco gets $200.

Re: Apple Pay on pace to account for 10% of global card transactions

#223

Post by [deleted] »

walshemj wrote: post #136
ryukafalz wrote: post #118

Earlier quoted context omitted.

Typically in the US the waiter will take your credit card back to a payment terminal rather than bringing a card reader to you. Contactless isn’t really an option in that case.

No wonder you have more problems with fraud in the USA if you let a waiter take the card away from you and do god knows what with it.

[deleted]

Re: Apple Pay on pace to account for 10% of global card transactions

#224

Post by nottorp »

privateSFacct wrote: post #99
fierarul wrote: post #10

Earlier quoted context omitted.

In Romania we have Visa PayWave for years. For small amounts you just wave the card in from of the POS and you are done. For bigger amounts you are asked your PIN and I find that reasonable. I don't see how waving my watch in front of the POS would make this easier, it would actually be more cumbersome depending on how the POS is presented.

So we are 100% clear, contactless cards generally have very weak security relative to apple pay. https://www.which.co.uk/news/2015/07/which-reveals-contactle... There is a reason they are not being promoted in major markets.

Transactions over some limit (in Romania it's over ~$25 because it's 100 local romanian lei so a nice round number) require you to enter the pin in the terminal.

But the US doesn't seem to have discovered pin numbers.

And judging by other posts for this story, you haven't discovered contactless payments either. They were available long before Apple Pay.

Re: Apple Pay on pace to account for 10% of global card transactions

#225

Post by sjwright »

needusername wrote: post #104
anamexis wrote: post #89

Earlier quoted context omitted.

So, yep? They didn't claim it was a unique feature of Apple Pay.

They make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a "token" instead of a PAN is used for the transaction. This is very misleading. If you read it very carefully they are not wrong, but for the uninitiated a wrong impression is crated. They are using an industry standard protocol that is 25 years old.

You are right that the core of Apple Pay security is functionally identical to chip and contactless transactions.

However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used.

This reduces the scope for downgrade attacks.

Re: Apple Pay on pace to account for 10% of global card transactions

#226

Post by Marsymars »

notJim wrote: post #26

I honestly love Apple Pay, but I don't use it super often because it makes me self-conscious. I feel like a bit of a dick for some reason. If you try to do something "weird" and it doesn't work, people get annoyed, or it feels like an imposition. Even when it works, people sometimes make some kind of comment. Relatedly, it's unpredictable whether it will work or not. It usually does, as long as the card machine says…

> wanted to add that here in Portland, we have the special Apple Pay transit wallet for the bus, which is amazing!

I'm aware of this, because here in Canada, if you add a transit pass to Google Pay, the only options are 1) Las Vegas Monorail, 2) Melbourne myki, 3) Portland Hop and 4) Manatee County, Florida MCAT.

Re: Apple Pay on pace to account for 10% of global card transactions

#227

Post by xenocratus »

_bxg1 wrote: post #172
thesimon wrote: post #154

Earlier quoted context omitted.

>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system…

I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

That's Static Data Authentication. Dynamic Data Authentication is also a thing - the recommended thing nowadays, actually. Check it out https://www.openscdp.org/scripts/tutorial/emv/DDA.html

These schemes are independent of physical transfer mechanism (well, mostly)

Edit: https://en.m.wikipedia.org/wiki/Contactless_smart_card you might be talking about MSD while I'm talking about EMV. C'mon, America, you're better than that

Re: Apple Pay on pace to account for 10% of global card transactions

#228

Post by Marsymars »

bxio wrote: post #204
denzil_correa wrote: post #120

Earlier quoted context omitted.

Sometimes, the cashier says "not ok" despite being "ok".

In my experience, some small businesses avoid Apple Pay/Google Pay because you can add American Express cards to them, and they want to not accept Amex cards in order to save on the fee, despite the service agreement of their payment processor obligating them to.

I don't think it's possible to have a PoS terminal that doesn't accept physical Amex cards but that does accept Amex cards via Apple/Google Pay.

Re: Apple Pay on pace to account for 10% of global card transactions

#229

Post by remir »

herpderperator wrote: post #117

What frustrates me is the way everyone talks about Apple Pay as if it's the standard in mobile payments. Everyone calls contactless payments Apple Pay, which is technology other countries have had for many years built into the cards themselves via an NFC chip. Visa calls it PayWave(TM), because you just wave your credit card over the terminal to pay. I have been taking advantage of the benefits of contactless pay sin…

One of Apple's core strength is in marketing. I heard some folks refer to an Android phone as an iPhone. When I pointed out that it was in fact an Android (LG), they didn't knew what Android was. For them, the category of devices that we call "smartphones", are named iPhones.

Again, Apple did a hell of a marketing job here.

Re: Apple Pay on pace to account for 10% of global card transactions

#230

Post by pathartl »

kelnos wrote: post #80
pathartl wrote: post #68

Earlier quoted context omitted.

While I agree with you it's definitely an exaggeration, part of the UX that's a bit of a pain for the purchaser is when the terminal is locked up until the cashier confirms the purchase. Either you're forced to leave your card in or you can't put your card in until they're ready. I really think some messaging to change it from "Please Wait" to "Waiting for cashier" would help the real non-tech-savvy people. My parent…

I think some of this is dependent on the hardware used? At least for Apple/Google Pay, I've noticed that for some merchants (Safeway), I can "pay" at any point while the cashier is still scanning times, while for others (Trader Joe's), I have to wait until the cashier is done and moves the transaction into the payment phase. On the other hand, I don't recall a merchant where I could physically insert my card whenever…

Oh yeah, it depends on the hardware and also how they're configured
Post reply on HN