4 ms·

Anyone got any comments/info/insights on the tap and pay thing? I haven't read anything on the security model but from a high level it seems like its going to

by rjd 15y ago

Anyone got any comments/info/insights on the tap and pay thing? I haven't read anything on the security model but from a high level it seems like its going to be a cluster f/k of fraud to me, loose your phone and you're loosing direct access to your finances. I've had a few conversations here and there but everyones opinions seem to be the same as mine... anyone with anything to placate my fears? because this seems like something I'm going to avoid by a huge distance.

sliverstorm 15y ago
I think the main comment is "We were too busy thinking about how cool it was going to be".
foob 15y ago
Is it really all that different from losing your wallet? You can protect it with a pin number (http://www.google.com/wallet/how-it-works-security.html http://www.google.com/wallet/how-it-works-security.html) so it sounds kind of like losing a debit card in that respect. You can still cancel your cards as soon as soon as you've noticed that you lost it as well. I wonder if the federal laws limiting credit card fraud liability to $50 will also apply here. If they do then I'm even less concerned about it.
- rjd 15y ago
  Yeah it is alot worse because my wallet needs signatures, has things like photo id on my credit card. One thing about that interface is how large the display is, it would be damned simple to catch someones PIN from a distance. I mean even current systems I see my friends PINs without trying ... on small covered terminals, not a 7" screen. A nice shiny phone would slip out of someones pocket a lot easier than wallet as well, I would hazard a guess its going to be a boon for pickpockets at events. By the time you could cancel the account they could of stripped hundreds of dollars. But thanks I will do some deeper reading around that link.
  - DannoHung 15y ago
    No one ever checks your signature and most stores have customer swipe pads these days, so it's not like the cahsier even touches your card in a lot of transactions.
    - rjd 15y ago
      Is that in the US? seems very relaxed to other countries I have been in. I've been declined in London, Ireland, Austrlia, Thailand, and New Zealand over my signature. From emeory I have never been checked in Spain which is notorious for credit card fraud... and I dont remember getting checked in Germany either... although I may have used a standard debit card with a PIN while I was in Germany. Anyway I have my sig upside down on my card to create a point in time when I can proove fraud has begun (because travelling is a b/tch and after every trip I end up replacing my card and filling out forms to reclaim fraud). I often get pulled up and have to show a secondary ID, my passport or something to prove my upside signature is infact upside down.
  - angryasian 15y ago
    i don't even sign the back of my card, because they are supposed to ask for a license at that point. Its very rare anybody even looks at the credit card. Even the signature doesn't matter anymore as most of the digital pads are ineligible what you write anyways. Its just swipe and done.
InclinedPlane 15y ago
So keep better track of your phone then. The same vulnerability exists for your wallet or your keys, of course, but we've already accepted that. This is the future. In some shockingly few decades from now it will be uncommon to carry a wallet or keys. Everything will be digital, everything will be mediated by your phone (or something similar), identity, payment, security, etc.
- rjd 15y ago
  No the vulnerability doesn't exist with your current wallet because it has analogue trappings to prevent theft. For example my current contents require PIN as well as signature as well photo IDs on cards. This type of fraud is so high in Britain that my cards issued there have an extra chip in the cards to slow down theives. Although I was living in Britain when they first released 'chip and PIN' and the crims had working scanners 2-3 days after launch. The level of determination and skill the bad guys have is amazing, and I currently see this cell phone move as a step in there favour and not mine. The other aspect is people leave cell phones laying around, they don't tend to leave there wallets. I guess having it fully tied to your bank account will add a level of apranoia which may stop this behaviour. But for example at my last work place it was the joke to wait till someone had left there iPhone at lunch, slip it into your pocket, and after getting back to teh office convince the person they had to go back and get it. Not funny when its you, but funny enough after you watch a work mate walk several blocks and back fuming because he knows one of us has it. Loosing your keys is not the same as for it to be effective the criminal needs to know where to use the keys, in a sense it has to be premeditated, a completely different criminal scenario. And yeah I know a few people who have already changed their house doors to keypads and electric terminals. Guess I have a few niche geek friends, but that future is alreayd ehre for some.
  - deleted 15y ago
    [deleted]
  - mhansen 15y ago
    Signatures are a joke, nobody checks them (I used to work in retail). And even if people did check them, they're trivial to forge (there's a copy of the signature on the card telling you what it's supposed to look like!)
bonzoesc 15y ago
Doesn't sound any worse than regular credit card transactions, where signature verification and ID checking are never done. It might even be better, since you can lock your phone, and presumably wire it to wipe remotely or after some failed guesses. If the wallet is something you have to manually summon and isn't running in the background all the time, it'll be safer than the contactless RFID credit cards out there now. If you're in the US, if your card does get stolen you'll only be responsible for the first $50[1], just like if you were paying with plastic or online. 1: Legally; some cards protect you from the first $50 too, but none will make you responsible for more than $50.
- rjd 15y ago
  Yeah I wouldn't be impressed with that. My cards don't have any amount to pay when I get compromised. Which is good as I booked a trip around Thailand and used my personal credit card for it, and used pre pay cards when I got there. I got back and within a few weeks I started getting transactions booked to personal card. I delibratly didn't use that card this time (as this happens all the time when I head to Asia) and hence why I got the pre pay cards. But either Bangkok Airways, Air Asia, or JetStar have had there systems compromised, as sure enough like clock work the fraudulent charges started. Luckily you mention asia and credit card fraud and you don't even have to supply evidence, Master Card just roll the transactions back immediatly and cancel the card. I guess its cheaper for them to do that waste time getting evidence for each incident.
kul 15y ago
Not directly related to Google Wallet, but have a read of this wrt to NFC payments: http://news.cnet.com/8301-1001_3-20090016-92/visa-sets-deadlines-on-nfc-efforts/ http://news.cnet.com/8301-1001_3-20090016-92/visa-sets-deadl... "Visa will also push dynamic authentication to overcome any security worries and encourage adoption. With dynamic authentication it would be hard for a criminal to use a card at a point-of-sale system even if payment data is compromised. Visa will support personal identification numbers (PINs) and signatures--so called static authentication--but expects both to give way to dynamic authentication."
- rjd 15y ago
  Yep thanks thats more of what I was expecting to be under pinning it.

by rjd 15y ago

sliverstorm 15y ago

I think the main comment is "We were too busy thinking about how cool it was going to be".

foob 15y ago

Is it really all that different from losing your wallet? You can protect it with a pin number (http://www.google.com/wallet/how-it-works-security.html http://www.google.com/wallet/how-it-works-security.html) so it sounds kind of like losing a debit card in that respect. You can still cancel your cards as soon as soon as you've noticed that you lost it as well. I wonder if the federal laws limiting credit card fraud liability to $50 will also apply here. If they do then I'm even less concerned about it.

rjd 15y ago
Yeah it is alot worse because my wallet needs signatures, has things like photo id on my credit card. One thing about that interface is how large the display is, it would be damned simple to catch someones PIN from a distance. I mean even current systems I see my friends PINs without trying ... on small covered terminals, not a 7" screen. A nice shiny phone would slip out of someones pocket a lot easier than wallet as well, I would hazard a guess its going to be a boon for pickpockets at events. By the time you could cancel the account they could of stripped hundreds of dollars. But thanks I will do some deeper reading around that link.
- DannoHung 15y ago
  No one ever checks your signature and most stores have customer swipe pads these days, so it's not like the cahsier even touches your card in a lot of transactions.
  - rjd 15y ago
    Is that in the US? seems very relaxed to other countries I have been in. I've been declined in London, Ireland, Austrlia, Thailand, and New Zealand over my signature. From emeory I have never been checked in Spain which is notorious for credit card fraud... and I dont remember getting checked in Germany either... although I may have used a standard debit card with a PIN while I was in Germany. Anyway I have my sig upside down on my card to create a point in time when I can proove fraud has begun (because travelling is a b/tch and after every trip I end up replacing my card and filling out forms to reclaim fraud). I often get pulled up and have to show a secondary ID, my passport or something to prove my upside signature is infact upside down.
- angryasian 15y ago
  i don't even sign the back of my card, because they are supposed to ask for a license at that point. Its very rare anybody even looks at the credit card. Even the signature doesn't matter anymore as most of the digital pads are ineligible what you write anyways. Its just swipe and done.

InclinedPlane 15y ago

So keep better track of your phone then. The same vulnerability exists for your wallet or your keys, of course, but we've already accepted that. This is the future. In some shockingly few decades from now it will be uncommon to carry a wallet or keys. Everything will be digital, everything will be mediated by your phone (or something similar), identity, payment, security, etc.

rjd 15y ago
No the vulnerability doesn't exist with your current wallet because it has analogue trappings to prevent theft. For example my current contents require PIN as well as signature as well photo IDs on cards. This type of fraud is so high in Britain that my cards issued there have an extra chip in the cards to slow down theives. Although I was living in Britain when they first released 'chip and PIN' and the crims had working scanners 2-3 days after launch. The level of determination and skill the bad guys have is amazing, and I currently see this cell phone move as a step in there favour and not mine. The other aspect is people leave cell phones laying around, they don't tend to leave there wallets. I guess having it fully tied to your bank account will add a level of apranoia which may stop this behaviour. But for example at my last work place it was the joke to wait till someone had left there iPhone at lunch, slip it into your pocket, and after getting back to teh office convince the person they had to go back and get it. Not funny when its you, but funny enough after you watch a work mate walk several blocks and back fuming because he knows one of us has it. Loosing your keys is not the same as for it to be effective the criminal needs to know where to use the keys, in a sense it has to be premeditated, a completely different criminal scenario. And yeah I know a few people who have already changed their house doors to keypads and electric terminals. Guess I have a few niche geek friends, but that future is alreayd ehre for some.
- deleted 15y ago
  [deleted]
- mhansen 15y ago
  Signatures are a joke, nobody checks them (I used to work in retail). And even if people did check them, they're trivial to forge (there's a copy of the signature on the card telling you what it's supposed to look like!)

bonzoesc 15y ago

Doesn't sound any worse than regular credit card transactions, where signature verification and ID checking are never done. It might even be better, since you can lock your phone, and presumably wire it to wipe remotely or after some failed guesses. If the wallet is something you have to manually summon and isn't running in the background all the time, it'll be safer than the contactless RFID credit cards out there now. If you're in the US, if your card does get stolen you'll only be responsible for the first $50[1], just like if you were paying with plastic or online. 1: Legally; some cards protect you from the first $50 too, but none will make you responsible for more than $50.

rjd 15y ago
Yeah I wouldn't be impressed with that. My cards don't have any amount to pay when I get compromised. Which is good as I booked a trip around Thailand and used my personal credit card for it, and used pre pay cards when I got there. I got back and within a few weeks I started getting transactions booked to personal card. I delibratly didn't use that card this time (as this happens all the time when I head to Asia) and hence why I got the pre pay cards. But either Bangkok Airways, Air Asia, or JetStar have had there systems compromised, as sure enough like clock work the fraudulent charges started. Luckily you mention asia and credit card fraud and you don't even have to supply evidence, Master Card just roll the transactions back immediatly and cancel the card. I guess its cheaper for them to do that waste time getting evidence for each incident.

kul 15y ago

Not directly related to Google Wallet, but have a read of this wrt to NFC payments: http://news.cnet.com/8301-1001_3-20090016-92/visa-sets-deadlines-on-nfc-efforts/ http://news.cnet.com/8301-1001_3-20090016-92/visa-sets-deadl... "Visa will also push dynamic authentication to overcome any security worries and encourage adoption. With dynamic authentication it would be hard for a criminal to use a card at a point-of-sale system even if payment data is compromised. Visa will support personal identification numbers (PINs) and signatures--so called static authentication--but expects both to give way to dynamic authentication."

rjd 15y ago
Yep thanks thats more of what I was expecting to be under pinning it.