8 ms·

Google Pay was a great way to send money to my kid in college. Since we both had debit cards, it was instantaneous and free. It was easy to use from the web int

Google Pay was a great way to send money to my kid in college. Since we both had debit cards, it was instantaneous and free. It was easy to use from the web interface. Now they're doing away with the web interface. They don't say why, so the reason has to be pretty shady. There was some bad UI with the web. It would pop up a window to warn you to only send money to people you know, but it was a window you couldn't move to see who you were sending money to, in case you clicked the wrong person! But that's better than the experience I had with the app when I paid at a McDonald's recently. I was expecting a screen which said something like "You are about to pay $9.72 to McDonald's Corporation. CONTINUE/Cancel. Instead, when I put my thumb on my phone's fingerprint sensor, here's the feedback I got: (vibrate) No information on who I was about to pay or how much I was about to pay. And afterward, absolutely no information about who I just paid or how much I paid them. I went into the payment history screen and they payment wasn't there either, although it showed up about a minute later. How is that acceptable? I would NEVER use the app unless I lost my wallet! Using the Google Pay app at a point of sale was a terrifying experience.

lxgr 6y ago
> absolutely no information about who I just paid or how much I paid them. That's unfortunately how the contactless payments protocol works. Chip cards don't have a display, so user-visible on-device payment confirmation was never a design goal. There's been some attempts in introducing it (apparently with mixed/bad results, since it's not a thing anymore), but it's ultimately not possible: Since the final payment amount is often not known at the time you tap/dip/swipe your card, what you'd see on your phone would differ from what is ultimately charged. Arguably, not showing an amount rather than an estimate that will usually be either way over or under the actual amount is better.
- brmgb 6y ago
  > Since the final payment amount is often not known at the time you tap/dip/swipe your card As a foreigner, I have trouble understanding this. How can the final amount of a transaction not be known when you are paying it? Is that one of the usual nonsensical shenanigans stores like to play with taxes in the USA?
  - dagw 6y ago
    One example is at the gas station I have to tap/swipe my card to activate the pump and then I get charged when I'm done.
    - lxgr 6y ago
      Gas stations are an exception: They will usually pre-authorize a certain amount (usually some number that is not likely to be exceeded by reasonable gas tank sizes) and adjust downwards once the final amount is known. This is different from having different amounts in the chip transaction and in the "actual" transaction amount fields.
      - kevincox 6y ago
        This was annoying when gas prices were very high. We had a van with a massive tank and the pre-auth wasn't enough. We would hit the limit and need to drive to the next pump to continue.
    - PeterisP 6y ago
      At this gas station scenario, you have two transactions - the preauth, verified by the card, with a specific limit; and afterwards a transaction (not verified or even seen by the card) with the actual amount. The former is something that the card/phone can show and verify, as that is the actual amount you're authorising, even if you don't "spend" all of it.
  - fabbari 6y ago
    In some stores you can tap your card before the transaction is completed, once the receipt is 'closed' the payment terminal will receive the final amount and use the authorized session to complete the payment. You can also simply wait for the receipt to be closed before tapping, then the terminal will show you the full amount. I - for example - use the pre-transaction tapping when buying groceries, it means I can just walk out when the last item is scanned. It is a security risk - an attacker may add some expensive item to the session - but I think I can take it, the terminal will still show the total at transaction close.
- PeterisP 6y ago
  At least for the EMV standard the card definitely knows the transaction amount; it's one of the core fields of the transaction that's signed by the chip on the card iff it meets the restrictions configured in it. Of course, the issuing bank may charge some extra fee on top afterwards, but the amount that the chip card sees and signs should be the exact same number that the POS system would print onto a receipt as the transaction amount.
pmlnr 6y ago
Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.
- johannes1234321 6y ago
  Hoping one is talking to that terminal and it's not manipulated to show wrong information. (The later is quite unlikely at a larger store as it would lead to too many complaints, but still nothing I can ; even the first one could be noticed by them not receiving money, thus other payment could be noticed and reverted - eventually)
- wokwokwok 6y ago
  Contactless debit cards can be skimmed without being authd too; does that mean we should make the app not bother to get your finger print and just have nfc on all the time? Obviously not. They’re different things: approval and notifications seem pretty appropriate for an app.
  - lxgr 6y ago
    No, but local authentication before authenticating any payment is possible within the limitations of the protocol. Amount and payee authentication is unfortunately not. It would require updating all payment terminals in the field – the last time we tried that (i.e. introducing chip support) it took literally decades (and we're still not done).
  - brmgb 6y ago
    > does that mean we should make the app not bother to get your finger print and just have nfc on all the time? You don't need to unlock your phone to pay amounts under 30€ in my country. You just need the screen to be on. I'm quite glade it's like this actually. If I had to fiddle with the phone every time I wanted to pay, I would just use my card.
  - amaccuish 6y ago
    > Contactless debit cards can be skimmed without being authd too; nitpicking, but contactless cards as far as I am aware cannot be "skimmed" (a process of copying the information from a magnetic stripe and creating a cloned card). If the payment terminal can handle a chip, it will refuse to downgrade the security. In addition, countries are marked as chip only, which means it's almost impossible to get a bank to authorise a transaction for a card that should have a chip in a country where most readers are chip-capable. And if the card was suddenly used in a non-chip region, any good bank would block it. All you can do with contactless is relay the signal over the internet, but that introduces delay and can sometimes be detected by the reader.
jonathantf2 6y ago
That's exactly how a contactless debit/credit card would work. I'm fairly sure most (if not all) payment terminals would not have the capability to send your device the information. I use it, get a notification from the bank and from Google Pay usually instantaneously.
brmgb 6y ago
> But that's better than the experience I had with the app when I paid at a McDonald's recently. I was expecting a screen which said something like "You are about to pay $9.72 to McDonald's Corporation. CONTINUE/Cancel. That's written on the payment terminal. Google Pay is just a standard NFC payment. You might be prompted if the payment is large depending of the legislation in your country but for small amount, it's fast on purpose.
- kevincox 6y ago
  The terminal is an untrusted device. It would be much more secure if the details could be printed on my device for my confirmation. (It could then sign them to approve the payment.) Of course this isn't how the payment system was designed as it was designed for cheap, simple cards. The saving grace is that you can perform a chargeback if the transaction is wrong. Not as elegant, but is basically as effective at the end of the day.
  - jaywalk 6y ago
    >The terminal is an untrusted device. Untrusted by who? You? The terminal is a trusted device in the payment system, and in most cases is the only trusted device in the store involved in the payment chain.
    - kevincox 6y ago
      It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.
      - renewiltord 6y ago
        You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available. If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.
EMM_386 6y ago
> Now they're doing away with the web interface. They don't say why, so the reason has to be pretty shady. The article explains why. > Just like with Google Allo, SMS-based authentication means there's no desktop support at all. The Google Pay website is being stripped of all its useful functionality because a browser does not have a carrier SIM card and therefore can't be authenticated by the SMS-reliant system.
- kahirsch 6y ago
  That's not really an explanation, though. The web interface works today and will continue to work through April 3. So, if Google wanted it to continue, it would.
hnick 6y ago
I've since switched to iPhone but on Android I didn't get a confirmation but I always got a pop up notification at the top of the screen saying who I paid and how much within seconds of the buzz. Maybe it's different in Australia? You are correct about the payment history though, mine was always missing huge chunks (sometimes weeks) of payments for some reason.
stjohnswarts 6y ago
Why? I used to review my GP transactions at night (these days I'm using apple pay). All those charges can be reversed if they don't look right. Don't use your debit card for GPay or ApplePay though, those can be much harder to reverse.

lxgr 6y ago

> absolutely no information about who I just paid or how much I paid them. That's unfortunately how the contactless payments protocol works. Chip cards don't have a display, so user-visible on-device payment confirmation was never a design goal. There's been some attempts in introducing it (apparently with mixed/bad results, since it's not a thing anymore), but it's ultimately not possible: Since the final payment amount is often not known at the time you tap/dip/swipe your card, what you'd see on your phone would differ from what is ultimately charged. Arguably, not showing an amount rather than an estimate that will usually be either way over or under the actual amount is better.

brmgb 6y ago
> Since the final payment amount is often not known at the time you tap/dip/swipe your card As a foreigner, I have trouble understanding this. How can the final amount of a transaction not be known when you are paying it? Is that one of the usual nonsensical shenanigans stores like to play with taxes in the USA?
- dagw 6y ago
  One example is at the gas station I have to tap/swipe my card to activate the pump and then I get charged when I'm done.
  - lxgr 6y ago
    Gas stations are an exception: They will usually pre-authorize a certain amount (usually some number that is not likely to be exceeded by reasonable gas tank sizes) and adjust downwards once the final amount is known. This is different from having different amounts in the chip transaction and in the "actual" transaction amount fields.
    - kevincox 6y ago
      This was annoying when gas prices were very high. We had a van with a massive tank and the pre-auth wasn't enough. We would hit the limit and need to drive to the next pump to continue.
  - PeterisP 6y ago
    At this gas station scenario, you have two transactions - the preauth, verified by the card, with a specific limit; and afterwards a transaction (not verified or even seen by the card) with the actual amount. The former is something that the card/phone can show and verify, as that is the actual amount you're authorising, even if you don't "spend" all of it.
- fabbari 6y ago
  In some stores you can tap your card before the transaction is completed, once the receipt is 'closed' the payment terminal will receive the final amount and use the authorized session to complete the payment. You can also simply wait for the receipt to be closed before tapping, then the terminal will show you the full amount. I - for example - use the pre-transaction tapping when buying groceries, it means I can just walk out when the last item is scanned. It is a security risk - an attacker may add some expensive item to the session - but I think I can take it, the terminal will still show the total at transaction close.
PeterisP 6y ago
At least for the EMV standard the card definitely knows the transaction amount; it's one of the core fields of the transaction that's signed by the chip on the card iff it meets the restrictions configured in it. Of course, the issuing bank may charge some extra fee on top afterwards, but the amount that the chip card sees and signs should be the exact same number that the POS system would print onto a receipt as the transaction amount.

pmlnr 6y ago

Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.

johannes1234321 6y ago
Hoping one is talking to that terminal and it's not manipulated to show wrong information. (The later is quite unlikely at a larger store as it would lead to too many complaints, but still nothing I can ; even the first one could be noticed by them not receiving money, thus other payment could be noticed and reverted - eventually)
wokwokwok 6y ago
Contactless debit cards can be skimmed without being authd too; does that mean we should make the app not bother to get your finger print and just have nfc on all the time? Obviously not. They’re different things: approval and notifications seem pretty appropriate for an app.
- lxgr 6y ago
  No, but local authentication before authenticating any payment is possible within the limitations of the protocol. Amount and payee authentication is unfortunately not. It would require updating all payment terminals in the field – the last time we tried that (i.e. introducing chip support) it took literally decades (and we're still not done).
- brmgb 6y ago
  > does that mean we should make the app not bother to get your finger print and just have nfc on all the time? You don't need to unlock your phone to pay amounts under 30€ in my country. You just need the screen to be on. I'm quite glade it's like this actually. If I had to fiddle with the phone every time I wanted to pay, I would just use my card.
- amaccuish 6y ago
  > Contactless debit cards can be skimmed without being authd too; nitpicking, but contactless cards as far as I am aware cannot be "skimmed" (a process of copying the information from a magnetic stripe and creating a cloned card). If the payment terminal can handle a chip, it will refuse to downgrade the security. In addition, countries are marked as chip only, which means it's almost impossible to get a bank to authorise a transaction for a card that should have a chip in a country where most readers are chip-capable. And if the card was suddenly used in a non-chip region, any good bank would block it. All you can do with contactless is relay the signal over the internet, but that introduces delay and can sometimes be detected by the reader.

jonathantf2 6y ago

That's exactly how a contactless debit/credit card would work. I'm fairly sure most (if not all) payment terminals would not have the capability to send your device the information. I use it, get a notification from the bank and from Google Pay usually instantaneously.

brmgb 6y ago

> But that's better than the experience I had with the app when I paid at a McDonald's recently. I was expecting a screen which said something like "You are about to pay $9.72 to McDonald's Corporation. CONTINUE/Cancel. That's written on the payment terminal. Google Pay is just a standard NFC payment. You might be prompted if the payment is large depending of the legislation in your country but for small amount, it's fast on purpose.

kevincox 6y ago
The terminal is an untrusted device. It would be much more secure if the details could be printed on my device for my confirmation. (It could then sign them to approve the payment.) Of course this isn't how the payment system was designed as it was designed for cheap, simple cards. The saving grace is that you can perform a chargeback if the transaction is wrong. Not as elegant, but is basically as effective at the end of the day.
- jaywalk 6y ago
  >The terminal is an untrusted device. Untrusted by who? You? The terminal is a trusted device in the payment system, and in most cases is the only trusted device in the store involved in the payment chain.
  - kevincox 6y ago
    It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.
    - renewiltord 6y ago
      You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available. If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.

EMM_386 6y ago

> Now they're doing away with the web interface. They don't say why, so the reason has to be pretty shady. The article explains why. > Just like with Google Allo, SMS-based authentication means there's no desktop support at all. The Google Pay website is being stripped of all its useful functionality because a browser does not have a carrier SIM card and therefore can't be authenticated by the SMS-reliant system.

kahirsch 6y ago
That's not really an explanation, though. The web interface works today and will continue to work through April 3. So, if Google wanted it to continue, it would.

hnick 6y ago

I've since switched to iPhone but on Android I didn't get a confirmation but I always got a pop up notification at the top of the screen saying who I paid and how much within seconds of the buzz. Maybe it's different in Australia? You are correct about the payment history though, mine was always missing huge chunks (sometimes weeks) of payments for some reason.

stjohnswarts 6y ago

Why? I used to review my GP transactions at night (these days I'm using apple pay). All those charges can be reversed if they don't look right. Don't use your debit card for GPay or ApplePay though, those can be much harder to reverse.