>It's still their hardware. No, they lease them from their bank. :-) But yes, there is still an attack vector there, and I agree that the best solution is one

>It's still their hardware. No, they lease them from their bank. :-) But yes, there is still an attack vector there, and I agree that the best solution is one where the business owner gives me payment details, I complete the transaction using my own hardware, and they verify it using theirs. I have a hard time seeing a solution built on smartphones gaining widespread adoption though.