3 ms·

>The terminal is an untrusted device. Untrusted by who? You? The terminal is a trusted device in the payment system, and in most cases is the only trusted dev

>The terminal is an untrusted device. Untrusted by who? You? The terminal is a trusted device in the payment system, and in most cases is the only trusted device in the store involved in the payment chain.

kevincox 6y ago
It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.
- renewiltord 6y ago
  You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available. If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.
  - kevincox 6y ago
    For sure. It is far more important for the phone payments to have widespread adoption than improving security. I don't blame them for that. However it would be cool if they could start adding security features. I can imagine that your use case could be solved by signing to token such as "Up to $500 in the next 6h" or something. You could be promoted on your phone and approve it. In fact I would like the whole credit card system to be overhauled or replaced with a different system that gives consumers much more control over the access they give companies. Sure, some companies like online stores I might give full access like I do today as I plan to make many future purchases with different values, but I can also see a lot of uses for more restricted access like fixed monthly subscriptions and one time fixed-cost payments that don't give them access to charge me later.
    - renewiltord 6y ago
      Certainly, I imagine it's a product decision weighing security and convenience.
- mdoms 6y ago
  How do you pay for things when not using the phone system (which you explicitly refuse to use)? I'm curious what system of electronic payment you believe is trustworthy if the payment terminal is not.
  - kevincox 6y ago
    I do use it. All I am saying is that you can't trust anything the terminal tells you. The only way to be sure what you paid is checking the statements at the end of the month and requesting chargebacks if anything isn't correct.
- jaywalk 6y ago
  If it's fake or modified, it will not have the ability to communicate with the payment network and process the transaction.

kevincox 6y ago

It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.

renewiltord 6y ago
You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available. If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.
- kevincox 6y ago
  For sure. It is far more important for the phone payments to have widespread adoption than improving security. I don't blame them for that. However it would be cool if they could start adding security features. I can imagine that your use case could be solved by signing to token such as "Up to $500 in the next 6h" or something. You could be promoted on your phone and approve it. In fact I would like the whole credit card system to be overhauled or replaced with a different system that gives consumers much more control over the access they give companies. Sure, some companies like online stores I might give full access like I do today as I plan to make many future purchases with different values, but I can also see a lot of uses for more restricted access like fixed monthly subscriptions and one time fixed-cost payments that don't give them access to charge me later.
  - renewiltord 6y ago
    Certainly, I imagine it's a product decision weighing security and convenience.
mdoms 6y ago
How do you pay for things when not using the phone system (which you explicitly refuse to use)? I'm curious what system of electronic payment you believe is trustworthy if the payment terminal is not.
- kevincox 6y ago
  I do use it. All I am saying is that you can't trust anything the terminal tells you. The only way to be sure what you paid is checking the statements at the end of the month and requesting chargebacks if anything isn't correct.
jaywalk 6y ago
If it's fake or modified, it will not have the ability to communicate with the payment network and process the transaction.