5 ms·

Why would user security be compromised by NFC access any more than WiFi access or Bluetooth access? Or does Apple not provide APIs at the same abstraction level

by tetrep 10y ago

Why would user security be compromised by NFC access any more than WiFi access or Bluetooth access? Or does Apple not provide APIs at the same abstraction level for WiFi/Bluetooth that the banks are requesting for NFC?

techdragon 10y ago
Apple does not provide developers with access to the NFC hardware and they also do not provide direct access to Bluetooth either. Using these is limited to being able to make use of IOS services which make use of these hardware capabilities such as Apple Pay, Bluetooth audio outputs, etc...
- drakenot 10y ago
  This is true of NFC but Bluetooth capabilities are much more open. I've personally used Core Bluetooth to connect and communicate with arbitrary devices and communicate over custom protocols.
  - techdragon 10y ago
    I was trying a little to hard to be succinct, I've also used CoreBluetooth, I was lumping it into an awfully generic group by categorising that as part of the "services" provided by iOS, but I was thinking from the point of view that all the things the iOS frameworks provide are the ones Apple has allowed them to provide on iOS. Effectively the framework is a way to access the limited set of allowed services, as opposed to direct hardware access. Otherwise we could do much more interesting things with Bluetooth such as implement new Bluetooth profiles and create things like apps where the iPhone functioned as a Bluetooth keyboard for another device.
    - 0x0 10y ago
      This iOS app appears to be able to advertise custom bluetooth profiles, though? https://itunes.apple.com/us/app/lightblue-explorer-bluetooth/id557428110?mt=8 https://itunes.apple.com/us/app/lightblue-explorer-bluetooth...
abalone 10y ago
It's not just about NFC access, it's about ensuring the whole system is implemented securely all the way from the customer to the bank. That includes things like tokenization and privacy controls. If they let 3rd parties do it, they could do it wrong, and then users wouldn't trust or like iPhones as much for payments, and then they'd still use cards. That's the thinking at least.
cnvogel 10y ago
Certainly it would not affect “Apple Pay” (or however it's called) technically. But it would dilute/weaken the statement that “paying with your iPhone is secure”. So I can understand that Apple may want to limit payment systems on their phones to ones that they can prove to have a minimal level of security - and their strategy of putting sensitive data in the secure coprocessor while still having the convenience of a one button unlock is unrivaled in the industry. What they definitely do not want is to be associated with stories of credit card fraud involving iPhones, even if technically the fault is clearly outside Apple.

by tetrep 10y ago

techdragon 10y ago

Apple does not provide developers with access to the NFC hardware and they also do not provide direct access to Bluetooth either. Using these is limited to being able to make use of IOS services which make use of these hardware capabilities such as Apple Pay, Bluetooth audio outputs, etc...

drakenot 10y ago
This is true of NFC but Bluetooth capabilities are much more open. I've personally used Core Bluetooth to connect and communicate with arbitrary devices and communicate over custom protocols.
- techdragon 10y ago
  I was trying a little to hard to be succinct, I've also used CoreBluetooth, I was lumping it into an awfully generic group by categorising that as part of the "services" provided by iOS, but I was thinking from the point of view that all the things the iOS frameworks provide are the ones Apple has allowed them to provide on iOS. Effectively the framework is a way to access the limited set of allowed services, as opposed to direct hardware access. Otherwise we could do much more interesting things with Bluetooth such as implement new Bluetooth profiles and create things like apps where the iPhone functioned as a Bluetooth keyboard for another device.
  - 0x0 10y ago
    This iOS app appears to be able to advertise custom bluetooth profiles, though? https://itunes.apple.com/us/app/lightblue-explorer-bluetooth/id557428110?mt=8 https://itunes.apple.com/us/app/lightblue-explorer-bluetooth...

abalone 10y ago

It's not just about NFC access, it's about ensuring the whole system is implemented securely all the way from the customer to the bank. That includes things like tokenization and privacy controls. If they let 3rd parties do it, they could do it wrong, and then users wouldn't trust or like iPhones as much for payments, and then they'd still use cards. That's the thinking at least.

cnvogel 10y ago

Certainly it would not affect “Apple Pay” (or however it's called) technically. But it would dilute/weaken the statement that “paying with your iPhone is secure”. So I can understand that Apple may want to limit payment systems on their phones to ones that they can prove to have a minimal level of security - and their strategy of putting sensitive data in the secure coprocessor while still having the convenience of a one button unlock is unrivaled in the industry. What they definitely do not want is to be associated with stories of credit card fraud involving iPhones, even if technically the fault is clearly outside Apple.