How is NYC subway OMNY able to take payment while phone is locked?

#1

Post by narshian » Wed, Sep 09, 2020, 1:57 PM UTC

Apple Pay requires confirmation with the double click and Face ID, but OMNY is able to take payment merely by device proximity. Guessing this is NFC-based. But without confirmation? Aren’t there dangerous security implications to the mechanism behind whatever technique is being used here? Thanks

Re: How is NYC subway OMNY able to take payment while phone is locked?

#2

Post by phillipseamore » Wed, Sep 09, 2020, 2:13 PM UTC

Since the funds can only go to one party there is little opportunity for fraud. Likely you can only pay once at a turnstile (or station for that matter). Not sure how OMNY works but usually transport passes will not work unless you've checked-out before using it for another entry.

The pass is only an identifier, it contains no payment information (you could be using pre-paid, credit card, direct debit but that happens on the "server" end).

Re: How is NYC subway OMNY able to take payment while phone is locked?

#3

Post by narshian » Thu, Sep 10, 2020, 2:25 AM UTC

phillipseamore wrote: post #2

Since the funds can only go to one party there is little opportunity for fraud. Likely you can only pay once at a turnstile (or station for that matter). Not sure how OMNY works but usually transport passes will not work unless you've checked-out before using it for another entry. The pass is only an identifier, it contains no payment information (you could be using pre-paid, credit card, direct debit but that happen…

What is the “pass” here? It’s my phone with a card in the apple wallet. So you’re saying there is no payment information in the phone?

You don’t need to sign up for OMNY. Someone who’s never used it before merely needs to hold up their phone (with Apple wallet set up) to a turnstile and the fare is deducted.