4 ms·
I'm so pleased to see this happen in a way where its not tied to Apples own payment processor. They could so easily have done that to capture more revenue but I
by samwillis 5y ago
I'm so pleased to see this happen in a way where its not tied to Apples own payment processor. They could so easily have done that to capture more revenue but I suspect it would have opened up more chance of an anticompetitive lawsuit.
Obviously they are going to vet which processors are allowed, but as a consumer you want that so you can be confident that the iPhone you are tapping your card against isn't skimming your account.
I suspect there is a revenue agreement with the processors allowed on.
- jb1991 5y ago*allowed
- samwillis 5y agoThanks, fixed.
- thebean11 5y agoProtection against account skimming should happen on the customer's iPhone (it should only send data allowing a single transaction of a certain size) not the merchant's iPhone. If the customer's iPhone doesn't have that protection it's pretty easy for the merchant to hide a skimmer in their iPhone case / POS system / gas pump.
- samwillis 5y agoIt looks like it's not just Apple Pay, it's excepts any card payment, the protection has to be on the merchant's iPhone.
- thebean11 5y agoI don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible through a tap from what I understand.
- samwillis 5y agoI believe it's possible to perform a MITM attack on contactless cards. From a quick google: https://ieeexplore.ieee.org/document/9220841 https://ieeexplore.ieee.org/document/9220841 I do also remember reading about researchers at Cambridge University who were looking at this maybe 7-8 years ago.
- thebean11 5y agoInteresting! Wasn't aware of that. Is this something that's being actively exploited in the wild though? It won't let me read the actual paper so it's hard for me to tell how practical the attack is.
- alimov 5y agoImpractical things have a tendency to become practical when enough money is involved:)
- judge2020 5y agoThere's also this: https://youtu.be/YmJ4ULncNwg https://youtu.be/YmJ4ULncNwg // https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-First-Contact-New-Vulnerabilities-In-Contactless-Payments-wp.pdf https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-Fir...
- djrogers 5y agoIt’d be trivial for a rogue payment app to display one $ amount on the screen yet deduct another.
- thebean11 5y agoDisplay the $ amount on which device though? If you want to be secure, you display it on the customer's iPhone and have them confirm. Either way though, this is different from skimming. Skimming allows the skimmer to make future transactions which is much much worse.
- deleted 5y ago[deleted]
- h0nd 5y agoI think it only allows contactless payments. No matter if from a card or phone or whatever that is equipped with NFC payments that is compatible with the merchant app.
- maerF0x0 5y agoIf they can assume connectivity it would be best to invert the flow and instead make the Customer receive an invoice ID from the NFC, then work directly with Apple servers to actually pay. Then the Business gets a push notification the invoice was paid. That way the customer phone never actually sends anything directly to the business, and the only thing sent to the customer is basically public (sure, pay my invoice if you want...) Skimming happens because you have to enter trusted things into _their_ device w/o any authentication mechanism for the device you're interacting with (the pump).
- jhatax 5y agoThey are going to accept payments from contactless credit cards as well, so connectivity isn't assumed. If it could be, the flow you describe is brilliant.