5 ms·

From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking. I'm curious about

by smoser 7y ago

From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking. I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.

heavymark 7y ago
I assume will only work with approved partners not with any nfc sticker.
- cryptonector 7y ago
  When the universe of approved partners is large enough, the security considerations will be non-trivial.
  - dogma1138 7y ago
    Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable. If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila. The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
    - closeparen 7y ago
      Apple Pay is not giving away any shared secrets over the air that are useful to steal. I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
      - dogma1138 7y ago
        Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
  - penagwin 7y ago
    My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment. Essentially as soon as somebody reports you to Apple your account will be burned. Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
dogma1138 7y ago
It’s already easy enough now however it doesn’t work in reality. It doesn’t scale due to limits. And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business. Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred. They can also be used to buy physical goods which can then be resold. You can’t do the same with NFC tags.
floatingatoll 7y ago
You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.
randyrand 7y ago
You’d think if it was that important they have accepted visa by now then. But I agree this is nice. convenient.

by smoser 7y ago

heavymark 7y ago

I assume will only work with approved partners not with any nfc sticker.

cryptonector 7y ago
When the universe of approved partners is large enough, the security considerations will be non-trivial.
- dogma1138 7y ago
  Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable. If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila. The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
  - closeparen 7y ago
    Apple Pay is not giving away any shared secrets over the air that are useful to steal. I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
    - dogma1138 7y ago
      Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
- penagwin 7y ago
  My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment. Essentially as soon as somebody reports you to Apple your account will be burned. Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.

dogma1138 7y ago

It’s already easy enough now however it doesn’t work in reality. It doesn’t scale due to limits. And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business. Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred. They can also be used to buy physical goods which can then be resold. You can’t do the same with NFC tags.

floatingatoll 7y ago

You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.

randyrand 7y ago

You’d think if it was that important they have accepted visa by now then. But I agree this is nice. convenient.