4 ms·

Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.

by pmlnr 6y ago

johannes1234321 6y ago
Hoping one is talking to that terminal and it's not manipulated to show wrong information. (The later is quite unlikely at a larger store as it would lead to too many complaints, but still nothing I can ; even the first one could be noticed by them not receiving money, thus other payment could be noticed and reverted - eventually)
wokwokwok 6y ago
Contactless debit cards can be skimmed without being authd too; does that mean we should make the app not bother to get your finger print and just have nfc on all the time? Obviously not. They’re different things: approval and notifications seem pretty appropriate for an app.
- lxgr 6y ago
  No, but local authentication before authenticating any payment is possible within the limitations of the protocol. Amount and payee authentication is unfortunately not. It would require updating all payment terminals in the field – the last time we tried that (i.e. introducing chip support) it took literally decades (and we're still not done).
- brmgb 6y ago
  > does that mean we should make the app not bother to get your finger print and just have nfc on all the time? You don't need to unlock your phone to pay amounts under 30€ in my country. You just need the screen to be on. I'm quite glade it's like this actually. If I had to fiddle with the phone every time I wanted to pay, I would just use my card.
- amaccuish 6y ago
  > Contactless debit cards can be skimmed without being authd too; nitpicking, but contactless cards as far as I am aware cannot be "skimmed" (a process of copying the information from a magnetic stripe and creating a cloned card). If the payment terminal can handle a chip, it will refuse to downgrade the security. In addition, countries are marked as chip only, which means it's almost impossible to get a bank to authorise a transaction for a card that should have a chip in a country where most readers are chip-capable. And if the card was suddenly used in a non-chip region, any good bank would block it. All you can do with contactless is relay the signal over the internet, but that introduces delay and can sometimes be detected by the reader.

Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.

by pmlnr 6y ago

Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.

Hoping one is talking to that terminal and it's not manipulated to show wrong information. (The later is quite unlikely at a larger store as it would lead to too many complaints, but still nothing I can ; even the first one could be noticed by them not receiving money, thus other payment could be noticed and reverted - eventually)

wokwokwok 6y ago

Contactless debit cards can be skimmed without being authd too; does that mean we should make the app not bother to get your finger print and just have nfc on all the time? Obviously not. They’re different things: approval and notifications seem pretty appropriate for an app.

lxgr 6y ago
No, but local authentication before authenticating any payment is possible within the limitations of the protocol. Amount and payee authentication is unfortunately not. It would require updating all payment terminals in the field – the last time we tried that (i.e. introducing chip support) it took literally decades (and we're still not done).
brmgb 6y ago
> does that mean we should make the app not bother to get your finger print and just have nfc on all the time? You don't need to unlock your phone to pay amounts under 30€ in my country. You just need the screen to be on. I'm quite glade it's like this actually. If I had to fiddle with the phone every time I wanted to pay, I would just use my card.
amaccuish 6y ago
> Contactless debit cards can be skimmed without being authd too; nitpicking, but contactless cards as far as I am aware cannot be "skimmed" (a process of copying the information from a magnetic stripe and creating a cloned card). If the payment terminal can handle a chip, it will refuse to downgrade the security. In addition, countries are marked as chip only, which means it's almost impossible to get a bank to authorise a transaction for a card that should have a chip in a country where most readers are chip-capable. And if the card was suddenly used in a non-chip region, any good bank would block it. All you can do with contactless is relay the signal over the internet, but that introduces delay and can sometimes be detected by the reader.