5 ms·
> "tap my phone to pay" ... offers greater security than any of the above I doubt the security is greater: * Phones have a far larger attack surface and are r
by hackuser 10y ago
> "tap my phone to pay" ... offers greater security than any of the above
I doubt the security is greater:
* Phones have a far larger attack surface and are regularly exploited.
* Confidentiality is part of security, and I don't want my purchases tied to the rest of my phone data and identity.
- umeshunni 10y agoNeither of those statements are true. Read up on payment network tokenization.
- makecheck 10y agoNot that I know the entire implementation but I believe the phone has secure-element hardware that decouples sensitive material from the rest of the device. Therefore, in theory, attacking “the phone” gives you no access to (say) a credit card number. This should be a relatively small attack surface.
- SEJeff 10y agoCorrect, even if IOS is root level compromised it doesn't matter, as the secure element is a self contained hardware security module: https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module
- hackuser 10y agoWhat about Android phones, which are over 80% of the market?
- SEJeff 10y agoNope, most android phones (that I'm aware of) lack a dedicated HSM. The iPhone 6+ was I believe the first general consumer phone that shipped with a HSM. Being a linux guy through and through, it is/was the reason I got a 6+ and I couldn't be happier. It isn't perfect, but it is a huge improvement over most other things out there. Motorolla has the horribly overpriced AME 2000 (ick), and Samsung has the knox platform built standard into most of their stuff (which is very good), but they lack a true HSM. If you're an android user and want a HSM for sensitive data, get one of the Microcrypt SD devices. It is as good as you'll get (and still not as good as an iPhone).
- illumin8 10y agoApple Pay generates a unique credit card # for every transaction, ensuring a compromise of one merchants system will never end up in the ability for hackers to use your card for any other transactions. Unique card # per transaction is the holy grail of security. Your claims of somehow compromising confidentiality are also provably false.
- Normal_gaussian 10y agoThen prove them as false? There is a reliance on the security of the local device that isn't an issue with cards. Primarily this is more of a social engineering concern anyway, rendering most technical solutions useless.
- deleted 10y ago[deleted]
- kbenson 10y ago> Your claims of somehow compromising confidentiality are also provably false. What's the point of saying something is provably false and then completely leaving out any reference to that proof?
- bardworx 10y agoLast year there was an article how Apple Pay was making it easier for scammers to use cards. I believe this particular vector was patched by having to authenticate that you are trully adding your card via bank authorization. However, Mobile Payment is susceptible to fraud and thieves will find a way. http://mashable.com/2015/03/02/apple-pay-scammers/ http://mashable.com/2015/03/02/apple-pay-scammers/