Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Plans iPhone for Japan With Tap-to-Pay for Subways

bloomberg.com

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#51

Post by raverbashing »

lathiat wrote: post #46
raverbashing wrote: post #42

Earlier quoted context omitted.

Probably none This "contactless phone payment" seems more like a gimmick than anything else

actually it makes total sense for foreign travelers, who can immediately travel without finding a suitable location to purchase an Oyster card (for 5GBP), worrying about how much balance to put on it (being a tourist, I had no idea) and then waiting in line for over 30 minutes to return it (and get whatever was remaining as a refund) when I was done. I actually had to do all of these things, because the first set of…

Might be easier for tourists yes, but I just get the Oyster card last time I was there

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#52

Post by astrange »

raverbashing wrote: post #42
semi-extrinsic wrote: post #38

Earlier quoted context omitted.

So, realistically, what value does paying with your phone add over an Oyster or contactless card? Sure, you might claim that I'm more likely to forget my Oyster than my phone, but I'm also much less likely to run out of power on the Oyster.

Probably none This "contactless phone payment" seems more like a gimmick than anything else

I have at least eight cards of unknown value from different times I've been to Atlanta, and had to leave the airport on the train, which requires you to buy a transit card. Somehow I never remember this is a thing.

A phone replaces all this just like FiveStars replaced carrying point cards.

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#53

Post by fennecfoxen »

semi-extrinsic wrote: post #38
robmcm wrote: post #31

Earlier quoted context omitted.

Also be aware that the hash for each ApplePay instance of the same card is unique, so you have to use the same device when tapping out that you did when tapping in (or all day in order to hit the cap). It's also worth priming your device (double tap home button from lock screen) and authenticating before you reach the gate. You don't want to hold up the 50 stressed commuters behind you fiddling with your phone.

So, realistically, what value does paying with your phone add over an Oyster or contactless card? Sure, you might claim that I'm more likely to forget my Oyster than my phone, but I'm also much less likely to run out of power on the Oyster.

> what value does paying with your phone add over an Oyster

Phones and contactless payments actually do the fare-capping calculations slightly differently - if you do a "commute into London, then around London a bunch, then back" travel pattern, it can purchase a virtual central-London travelcard in the middle of the day, and adjust the commute-in payment retroactively. If you want that fare treatment with Oyster then you need to get the travelcard option loaded on it in advance.

> or contactless

modestly better security

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#54

Post by MBCook »

the_mitsuhiko wrote: post #37
c0g wrote: post #36

Earlier quoted context omitted.

That's what apple claims[1]: "Providing simple access to the NFC antenna by banking applications would fundamentally diminish the high level of security Apple aims to have on our devices" [1] http://fortune.com/2016/08/11/apple-pay-tech-banks-security/

I do not understand what the attack vector here would be. Can someone elaborate?

You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID.

Or (and this seems REALLY probable) people make apps to 'help' you pay or track you spending and pay/etc. But they now have very sensitive banking data so that's insecure.

How about CurrenC or Walmart or some other company makes their own NFC payment thing on a different standard that isn't compatible with standard terminals. Now anyone who uses that new payment system is vulnerable to any bugs in that implementation as opposed to a very well tested system like the current NFC stuff (which I'm sure has shortcomings, but at least is well understood).

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#55

Post by the_mitsuhiko »

MBCook wrote: post #54
the_mitsuhiko wrote: post #37

Earlier quoted context omitted.

I do not understand what the attack vector here would be. Can someone elaborate?

You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID. Or (and this seems REALLY probable) people make apps to 'help' you pay or track you spending and pay/etc. But they now have very sensitive banking data so that's insecure. How about CurrenC or Walmart or some other company makes their ow…

> You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID.

So? You can already do that. You can put an NFC shell around your phone which connects with bluetooth and that is being done already. You can touch an Android phone or anything else. Same story.

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#56

Post by MBCook »

the_mitsuhiko wrote: post #55
MBCook wrote: post #54

Earlier quoted context omitted.

You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID. Or (and this seems REALLY probable) people make apps to 'help' you pay or track you spending and pay/etc. But they now have very sensitive banking data so that's insecure. How about CurrenC or Walmart or some other company makes their ow…

> You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID. So? You can already do that. You can put an NFC shell around your phone which connects with bluetooth and that is being done already. You can touch an Android phone or anything else. Same story.

You can't do that because you have to buy extra hardware. All of a sudden everything you need would be built in. That makes it WAY more practical of an attack. All of a sudden ANY phone can be used.

Re: Apple Plans iPhone for Japan With Tap-to-Pay for Subways

#57

Post by robmcm »

semi-extrinsic wrote: post #38
robmcm wrote: post #31

Earlier quoted context omitted.

Also be aware that the hash for each ApplePay instance of the same card is unique, so you have to use the same device when tapping out that you did when tapping in (or all day in order to hit the cap). It's also worth priming your device (double tap home button from lock screen) and authenticating before you reach the gate. You don't want to hold up the 50 stressed commuters behind you fiddling with your phone.

So, realistically, what value does paying with your phone add over an Oyster or contactless card? Sure, you might claim that I'm more likely to forget my Oyster than my phone, but I'm also much less likely to run out of power on the Oyster.

For me it was a few things:

- I normally have my phone in my hand anyway. - My phone is in a pocket by it's self, so there is less risk of pulling out keys, coins, or notes along with my wallet. - I have many contact-less cards, so would have to pull the right one out of my wallet. - I would then have to put everything back, and go back to getting out my phone. - I get an apple pay notification ever evening when my card is charged, so I can easily tell if I have been over charged and get a refund.

Post reply on HN