38 ms·

Apple Pay will support NFC tags

78 points by smoser 7y ago

post_break 7y ago
Can it write to NFC? That's the golden goose for me. I have to use an android phone to write to NFC so my iPhone can read them and do things.
- saagarjha 7y ago
  No, there exists no public API to do this.
smoser 7y ago
From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking. I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.
- heavymark 7y ago
  I assume will only work with approved partners not with any nfc sticker.
  - cryptonector 7y ago
    When the universe of approved partners is large enough, the security considerations will be non-trivial.
    - dogma1138 7y ago
      Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable. If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila. The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
      - closeparen 7y ago
        Apple Pay is not giving away any shared secrets over the air that are useful to steal. I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
        dogma1138 7y ago
        Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
    - penagwin 7y ago
      My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment. Essentially as soon as somebody reports you to Apple your account will be burned. Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
- dogma1138 7y ago
  It’s already easy enough now however it doesn’t work in reality. It doesn’t scale due to limits. And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business. Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred. They can also be used to buy physical goods which can then be resold. You can’t do the same with NFC tags.
- floatingatoll 7y ago
  You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.
- randyrand 7y ago
  You’d think if it was that important they have accepted visa by now then. But I agree this is nice. convenient.
NikkiA 7y ago
What is written: > Imagine tapping your phone on a scooter or a parking-meter and paying for it without signing up or downloading an app first. What I read: > Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking. Basically, the entire planet is now 'fair game' as a skimmer.
- metabren 7y ago
  I imagine they will have thought of this — there's probably an authorization step like Face/Touch ID or entering your Apple ID password.
- jwr 7y ago
  Huh? Apple pay requires double-tapping the power button and then authenticating with Face ID before the payment gets processed. Where did you get the idea that you can get charged automatically by "some anonymous dude"?
  - foota 7y ago
    I think there point is that you might not be able to verify the identity of the person you're paying. Like you might intend to pay someone but the nfc sticker has been overridden.
    - coldtea 7y ago
      They will probably be signed, like HTTPS sites are...
- Someone 7y ago
  As others said, chances are the phone will still show you a payment takes place, allowing you to reject it, presumably while showing the amount to be paid and the payee. I would also guess that: - the first payment to a new payee to have a bit more UI. - the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction. - those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags. - Apple acting as an intermediary between iOS user and payee to protect their user’s privacy. It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments. If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient. For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up. I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.
theshrike79 7y ago
This is essentially just a fancy QR code. The tag contains the data who the payment is for and how much the payment is. You could do the exact same thing with QR, but with more fussing and aiming and worrying about the amount of light and whether the image is dirty or not.
- return1 7y ago
  Why not both? It could be awesome from micropayments on a browser
  - MBCook 7y ago
    Apple Pay on the web already exists. And it’s already fantastic.
- bluetidepro 7y ago
  I think the key is proximity, I believe. Like with a QR code, you could hypothetically take a picture of it and have that QR code be used anywhere. With this, you have to actually be in proximity to use it, I believe, which adds value in some contexts.
  - LeoPanthera 7y ago
    Is it not possible to clone NFC tags?
    - chrisbroadfoot 7y ago
      There's likely a secure element in these NFC devices, more sophisticated than the common NFC tags. My guess is something similar to the chips in bank cards.
- ksec 7y ago
  >This is essentially just a fancy QR code. But with much better UX and Security. QR Code does have its uses, but for many things it is the wrong solution.
cwt137 7y ago
What are some of the non-payment applications of this new found support?
- xenospn 7y ago
  Any kind of “attach this physical device to your application/service/account on your phone”
- penagwin 7y ago
  None, iPhones already can read (but not write due to lack of apple providing an API for it) NFC tags. This announcement is that Apple Pay will support it as well.
- jhrmnn 7y ago
  I vaguely remember that Yubikeys with NFC cannot be used with iPhones (only with Android phones) because of some limitation related to NFC tags. So perhaps after this update, it will be possible.
- hallman76 7y ago
  Two obvious location-based things that could benefit from NFC: - event registration - punching a time clock I'd argue that Apple's lack of NFC support effectively stifled any would-be innovators from even exploring the possibilities.
philo23 7y ago
I think a more accurate title might be "Apple Pay announces support for NFC tags", as NFC in general has been supported since the iPhone 7, but read-only.
- dang 7y ago
  Ok, added. Thanks!
arrty88 7y ago
Just in time for NYC subway electronic payments!
bsder 7y ago
Well, gee, golly, Apple finally supports what the rest of the universe has been supporting for decades--so innovative! Yeah, I'm salty from working around Apple's brain-damaged short range communication idiocies for years.
- coldtea 7y ago
  >Well, gee, golly, Apple finally supports what the rest of the universe has been supporting for decades--so innovative! As with the iPod, iPhone, iPad, Apple Watch, etc, Apple are never the first: just the ones that do it better.
  - buildzr 7y ago
    That's the marketing narrative. In reality, Apple's implementations tend to be just as half-assed as everyone else's. Egregious security problems like setting the password as the hint on their FDE, date handling bugs forcing people to factory reset devices and lose data, for all the glory people give them on UI stuff, their file manager and window management on MacOS are exceedingly awful.
    - PascLeRasc 7y ago
      Finder is a bad file manager? That's a new one. I'll listen to that take when Windows File Explorer has tabs.
      - buildzr 7y ago
        Finder is awful IMO, this thread is probably fully of Apple-y types who will disagree, but if you're actually interested: - Why does hitting the enter key not "go into directory" or "open file"? - I can't even see a path tree to know where I am in the filesystem out of the box. - Search, by default searches the entire system not the directory I'm in - The default presentation is some weird list of random stuff from my system, recent files and temporary files and assorted irrelevant garbage. I had to fuss with options for quite some time just to get this to be intelligible. - What the hell are all these colors? Why would any sane person want to group their files by color? In the end I wiped OSX off the machine as I just couldn't put up with it's constant annoyances for no gain - more of window management than file management though. I shouldn't need 3rd party tools like Spectacle just to make things tolerable on a modern OS. Having used dozens of different desktops on Linux and Windows I didn't think a "user friendly" one would be such a pile of annoyances. Turns out that part was marketing wank too I guess. Just in case anyone reading this has noticed the problem here but hasn't quite woken up to it: I really hate that people seem to accept their marketing at face value and not analyze any further, think they're doing something wrong if they run into problems with an Apple product. It's not just you. They make garbage and promote it like it's gold and people fall for it.
dstaley 7y ago
Google actually demoed the same approach three years ago. [1] Hopefully now that Apple is doing it, Android developers will finally implement it as well. [1] https://www.greenbot.com/article/3072233/zip-pow-google-shows-off-android-instant-apps-that-load-without-installation.html https://www.greenbot.com/article/3072233/zip-pow-google-show...
divan 7y ago
I wonder if NFC chip implants people usually put in their hands can be rewritten to work with this. That would be pretty dope to accept payments from people just by asking them to tap your hand :)
- post_break 7y ago
  You can use NFC to trigger the shortcuts app, so I'm sure Square cash could add the functionality into it.
- return1 7y ago
  i mean, you can just implant it in your wallet, don't need a freaking surgery
  - divan 7y ago
    Right, but it's not a surgery, they're implanted using syringe implanter and it's fairly easy and fast procedure.
- leshokunin 7y ago
  Sure. It’s really just a url though. Nothing fancy going on: url says pay for this item and call Apple Pay.
  - divan 7y ago
    Nice! If it's really just URL, that'll work for sure.
fma 7y ago
92% of people in China use WeChat pay as their primary payment method. Why can't/doesn't the US adopt a QR code payment system? https://www.businessinsider.com/alipay-wechat-pay-china-mobile-payments-street-vendors-musicians-2018-5 https://www.businessinsider.com/alipay-wechat-pay-china-mobi...
- pertymcpert 7y ago
  Why not use NFC instead? You don't have to get your phone out and focus the camera, just hold it near the sensor. Works with wearables too like Apple Watch. NFC is just better.
  - paranoidrobot 7y ago
    Because cameras are cheap, ubiquitous, and pretty much just as fast. If you rely on NFC, then on Apple devices you need Apple's blessing - and for financial transactions that means Apple Pay only, you don't get access to install applications in the secure element of the NFC chip in the phone. eg my bank installed a virtual contactless Visa/Mastercard on my Android device that worked with everything long before Google/Android Pay was a thing, and without Google getting a slice of the transaction. Transit systems can install their own virtual transit card on Android too.
    - pertymcpert 7y ago
      Not just as fast, significantly slower. I double tap my watch and then move it near the payment terminal. Then I walk out. With wechat I have to pull out my phone, unlock it, open the app, navigate to the payments part and open the camera, point it at the QR code. What’s the relevance of Apple here? What’s to stop Android doing this with wearables? We’re taking about NFC not a particular brand of phone.
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
leshokunin 7y ago
Interesting. I remember doing experiments with this on my Nokia C7 (one of their last Symbian 3 phones) back in 2011. The vision of tapping nfc stickers / POS systems hasn’t really materialized since, but hopefully this helps. From my discussions with various store owners, the adoption has been difficult because changing your POS system is really painful. Hopefully this introduces an option where the problem is sidestepped entirely.
- viraptor 7y ago
  > The vision of tapping nfc stickers / POS systems hasn’t really materialized In the US. Many other countries are using NFC payments on their phones for years.

78 points by smoser 7y ago

Can it write to NFC? That's the golden goose for me. I have to use an android phone to write to NFC so my iPhone can read them and do things.

saagarjha 7y ago
No, there exists no public API to do this.

smoser 7y ago

From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking. I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.

heavymark 7y ago
I assume will only work with approved partners not with any nfc sticker.
- cryptonector 7y ago
  When the universe of approved partners is large enough, the security considerations will be non-trivial.
  - dogma1138 7y ago
    Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable. If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila. The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
    - closeparen 7y ago
      Apple Pay is not giving away any shared secrets over the air that are useful to steal. I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
      - dogma1138 7y ago
        Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
  - penagwin 7y ago
    My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment. Essentially as soon as somebody reports you to Apple your account will be burned. Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
dogma1138 7y ago
It’s already easy enough now however it doesn’t work in reality. It doesn’t scale due to limits. And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business. Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred. They can also be used to buy physical goods which can then be resold. You can’t do the same with NFC tags.
floatingatoll 7y ago
You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.
randyrand 7y ago
You’d think if it was that important they have accepted visa by now then. But I agree this is nice. convenient.

NikkiA 7y ago

What is written: > Imagine tapping your phone on a scooter or a parking-meter and paying for it without signing up or downloading an app first. What I read: > Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking. Basically, the entire planet is now 'fair game' as a skimmer.

metabren 7y ago
I imagine they will have thought of this — there's probably an authorization step like Face/Touch ID or entering your Apple ID password.
jwr 7y ago
Huh? Apple pay requires double-tapping the power button and then authenticating with Face ID before the payment gets processed. Where did you get the idea that you can get charged automatically by "some anonymous dude"?
- foota 7y ago
  I think there point is that you might not be able to verify the identity of the person you're paying. Like you might intend to pay someone but the nfc sticker has been overridden.
  - coldtea 7y ago
    They will probably be signed, like HTTPS sites are...
Someone 7y ago
As others said, chances are the phone will still show you a payment takes place, allowing you to reject it, presumably while showing the amount to be paid and the payee. I would also guess that: - the first payment to a new payee to have a bit more UI. - the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction. - those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags. - Apple acting as an intermediary between iOS user and payee to protect their user’s privacy. It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments. If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient. For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up. I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.

theshrike79 7y ago

This is essentially just a fancy QR code. The tag contains the data who the payment is for and how much the payment is. You could do the exact same thing with QR, but with more fussing and aiming and worrying about the amount of light and whether the image is dirty or not.

return1 7y ago
Why not both? It could be awesome from micropayments on a browser
- MBCook 7y ago
  Apple Pay on the web already exists. And it’s already fantastic.
bluetidepro 7y ago
I think the key is proximity, I believe. Like with a QR code, you could hypothetically take a picture of it and have that QR code be used anywhere. With this, you have to actually be in proximity to use it, I believe, which adds value in some contexts.
- LeoPanthera 7y ago
  Is it not possible to clone NFC tags?
  - chrisbroadfoot 7y ago
    There's likely a secure element in these NFC devices, more sophisticated than the common NFC tags. My guess is something similar to the chips in bank cards.
ksec 7y ago
>This is essentially just a fancy QR code. But with much better UX and Security. QR Code does have its uses, but for many things it is the wrong solution.

cwt137 7y ago

What are some of the non-payment applications of this new found support?

xenospn 7y ago
Any kind of “attach this physical device to your application/service/account on your phone”
penagwin 7y ago
None, iPhones already can read (but not write due to lack of apple providing an API for it) NFC tags. This announcement is that Apple Pay will support it as well.
jhrmnn 7y ago
I vaguely remember that Yubikeys with NFC cannot be used with iPhones (only with Android phones) because of some limitation related to NFC tags. So perhaps after this update, it will be possible.
hallman76 7y ago
Two obvious location-based things that could benefit from NFC: - event registration - punching a time clock I'd argue that Apple's lack of NFC support effectively stifled any would-be innovators from even exploring the possibilities.

philo23 7y ago

I think a more accurate title might be "Apple Pay announces support for NFC tags", as NFC in general has been supported since the iPhone 7, but read-only.

dang 7y ago
Ok, added. Thanks!

arrty88 7y ago

Just in time for NYC subway electronic payments!

bsder 7y ago

Well, gee, golly, Apple finally supports what the rest of the universe has been supporting for decades--so innovative! Yeah, I'm salty from working around Apple's brain-damaged short range communication idiocies for years.

coldtea 7y ago
>Well, gee, golly, Apple finally supports what the rest of the universe has been supporting for decades--so innovative! As with the iPod, iPhone, iPad, Apple Watch, etc, Apple are never the first: just the ones that do it better.
- buildzr 7y ago
  That's the marketing narrative. In reality, Apple's implementations tend to be just as half-assed as everyone else's. Egregious security problems like setting the password as the hint on their FDE, date handling bugs forcing people to factory reset devices and lose data, for all the glory people give them on UI stuff, their file manager and window management on MacOS are exceedingly awful.
  - PascLeRasc 7y ago
    Finder is a bad file manager? That's a new one. I'll listen to that take when Windows File Explorer has tabs.
    - buildzr 7y ago
      Finder is awful IMO, this thread is probably fully of Apple-y types who will disagree, but if you're actually interested: - Why does hitting the enter key not "go into directory" or "open file"? - I can't even see a path tree to know where I am in the filesystem out of the box. - Search, by default searches the entire system not the directory I'm in - The default presentation is some weird list of random stuff from my system, recent files and temporary files and assorted irrelevant garbage. I had to fuss with options for quite some time just to get this to be intelligible. - What the hell are all these colors? Why would any sane person want to group their files by color? In the end I wiped OSX off the machine as I just couldn't put up with it's constant annoyances for no gain - more of window management than file management though. I shouldn't need 3rd party tools like Spectacle just to make things tolerable on a modern OS. Having used dozens of different desktops on Linux and Windows I didn't think a "user friendly" one would be such a pile of annoyances. Turns out that part was marketing wank too I guess. Just in case anyone reading this has noticed the problem here but hasn't quite woken up to it: I really hate that people seem to accept their marketing at face value and not analyze any further, think they're doing something wrong if they run into problems with an Apple product. It's not just you. They make garbage and promote it like it's gold and people fall for it.

dstaley 7y ago

Google actually demoed the same approach three years ago. [1] Hopefully now that Apple is doing it, Android developers will finally implement it as well. [1] https://www.greenbot.com/article/3072233/zip-pow-google-shows-off-android-instant-apps-that-load-without-installation.html https://www.greenbot.com/article/3072233/zip-pow-google-show...

divan 7y ago

I wonder if NFC chip implants people usually put in their hands can be rewritten to work with this. That would be pretty dope to accept payments from people just by asking them to tap your hand :)

post_break 7y ago
You can use NFC to trigger the shortcuts app, so I'm sure Square cash could add the functionality into it.
return1 7y ago
i mean, you can just implant it in your wallet, don't need a freaking surgery
- divan 7y ago
  Right, but it's not a surgery, they're implanted using syringe implanter and it's fairly easy and fast procedure.
leshokunin 7y ago
Sure. It’s really just a url though. Nothing fancy going on: url says pay for this item and call Apple Pay.
- divan 7y ago
  Nice! If it's really just URL, that'll work for sure.

fma 7y ago

92% of people in China use WeChat pay as their primary payment method. Why can't/doesn't the US adopt a QR code payment system? https://www.businessinsider.com/alipay-wechat-pay-china-mobile-payments-street-vendors-musicians-2018-5 https://www.businessinsider.com/alipay-wechat-pay-china-mobi...

pertymcpert 7y ago
Why not use NFC instead? You don't have to get your phone out and focus the camera, just hold it near the sensor. Works with wearables too like Apple Watch. NFC is just better.
- paranoidrobot 7y ago
  Because cameras are cheap, ubiquitous, and pretty much just as fast. If you rely on NFC, then on Apple devices you need Apple's blessing - and for financial transactions that means Apple Pay only, you don't get access to install applications in the secure element of the NFC chip in the phone. eg my bank installed a virtual contactless Visa/Mastercard on my Android device that worked with everything long before Google/Android Pay was a thing, and without Google getting a slice of the transaction. Transit systems can install their own virtual transit card on Android too.
  - pertymcpert 7y ago
    Not just as fast, significantly slower. I double tap my watch and then move it near the payment terminal. Then I walk out. With wechat I have to pull out my phone, unlock it, open the app, navigate to the payments part and open the camera, point it at the QR code. What’s the relevance of Apple here? What’s to stop Android doing this with wearables? We’re taking about NFC not a particular brand of phone.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]

leshokunin 7y ago

Interesting. I remember doing experiments with this on my Nokia C7 (one of their last Symbian 3 phones) back in 2011. The vision of tapping nfc stickers / POS systems hasn’t really materialized since, but hopefully this helps. From my discussions with various store owners, the adoption has been difficult because changing your POS system is really painful. Hopefully this introduces an option where the problem is sidestepped entirely.

viraptor 7y ago
> The vision of tapping nfc stickers / POS systems hasn’t really materialized In the US. Many other countries are using NFC payments on their phones for years.