3 ms·

Ah, I was suggesting that comparing "I have a CC in my wallet and can do stupid things with it" to "I have a CC on my phone now others (hackers, bad apps) do ca

Ah, I was suggesting that comparing "I have a CC in my wallet and can do stupid things with it" to "I have a CC on my phone now others (hackers, bad apps) do can evil things with it" are two totally different things. I was drawing parallels between hostile NFC readers and hostile apps/hackers :)

Dylan16807 10y ago
But the more important comparison in those posts is not CC in wallet. It's that CC on desktop computer has no restrictions. "hackers/hostile apps can do evil things on desktop" is nearly identical to "hackers/hostile apps can do evil things on phone" So while in a vacuum you could argue that you need to protect against hostile apps the same way you protect against hostile NFC, it's a weak comparison. While the treatment of hostile apps on your heavier home computing device is a super strong comparison.
- kiallmacinnes 10y ago
  I'm not sure I agree it's a weak comparison, mostly because I think we've made a whole bunch of bad decisions in how we handle things on a PC.. The PC was born in a different era to the smartphone, and it's treated as such. Example: CVV numbers, these are needed for "Card not present" transactions are must not be saved (e.g. no browser will save them). Using your phone for an NFC payment on the other hand does not need this number. Yes, this is a tiny detail. But this detail entirely changes the share of responsibility between the consumer/merchant/payment processor/bank.. This is usually reflected in the different fees that are charged for different types of transactions, card swipe vs card not present vs Chip+PIN vs NFC. Assuming that just because a CC number + errata stored on a PC can be stolen an abused, that the banks etc should just let me do that on e.g. Android Pay is just wrong.. Nobody is stopping you from creating a text file on your phone with the card and CVV numbers, but don't expect to be able to use that text file as a NFC payment method! Edit: in case I wasn't clear (I know I wasn't, because I kinda forgot to say it ;)), once your phone is untrusted - as in untrusted by the bank etc - everything stored on it may as well be that plain text file as far as they are concerned.

Dylan16807 10y ago

But the more important comparison in those posts is not CC in wallet. It's that CC on desktop computer has no restrictions. "hackers/hostile apps can do evil things on desktop" is nearly identical to "hackers/hostile apps can do evil things on phone" So while in a vacuum you could argue that you need to protect against hostile apps the same way you protect against hostile NFC, it's a weak comparison. While the treatment of hostile apps on your heavier home computing device is a super strong comparison.

kiallmacinnes 10y ago
I'm not sure I agree it's a weak comparison, mostly because I think we've made a whole bunch of bad decisions in how we handle things on a PC.. The PC was born in a different era to the smartphone, and it's treated as such. Example: CVV numbers, these are needed for "Card not present" transactions are must not be saved (e.g. no browser will save them). Using your phone for an NFC payment on the other hand does not need this number. Yes, this is a tiny detail. But this detail entirely changes the share of responsibility between the consumer/merchant/payment processor/bank.. This is usually reflected in the different fees that are charged for different types of transactions, card swipe vs card not present vs Chip+PIN vs NFC. Assuming that just because a CC number + errata stored on a PC can be stolen an abused, that the banks etc should just let me do that on e.g. Android Pay is just wrong.. Nobody is stopping you from creating a text file on your phone with the card and CVV numbers, but don't expect to be able to use that text file as a NFC payment method! Edit: in case I wasn't clear (I know I wasn't, because I kinda forgot to say it ;)), once your phone is untrusted - as in untrusted by the bank etc - everything stored on it may as well be that plain text file as far as they are concerned.