4 ms·

Protection against account skimming should happen on the customer's iPhone (it should only send data allowing a single transaction of a certain size) not the me

Protection against account skimming should happen on the customer's iPhone (it should only send data allowing a single transaction of a certain size) not the merchant's iPhone. If the customer's iPhone doesn't have that protection it's pretty easy for the merchant to hide a skimmer in their iPhone case / POS system / gas pump.

samwillis 5y ago
It looks like it's not just Apple Pay, it's excepts any card payment, the protection has to be on the merchant's iPhone.
- thebean11 5y ago
  I don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible through a tap from what I understand.
  - samwillis 5y ago
    I believe it's possible to perform a MITM attack on contactless cards. From a quick google: https://ieeexplore.ieee.org/document/9220841 https://ieeexplore.ieee.org/document/9220841 I do also remember reading about researchers at Cambridge University who were looking at this maybe 7-8 years ago.
    - thebean11 5y ago
      Interesting! Wasn't aware of that. Is this something that's being actively exploited in the wild though? It won't let me read the actual paper so it's hard for me to tell how practical the attack is.
      - alimov 5y ago
        Impractical things have a tendency to become practical when enough money is involved:)
    - judge2020 5y ago
      There's also this: https://youtu.be/YmJ4ULncNwg https://youtu.be/YmJ4ULncNwg // https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-First-Contact-New-Vulnerabilities-In-Contactless-Payments-wp.pdf https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-Fir...
  - djrogers 5y ago
    It’d be trivial for a rogue payment app to display one $ amount on the screen yet deduct another.
    - thebean11 5y ago
      Display the $ amount on which device though? If you want to be secure, you display it on the customer's iPhone and have them confirm. Either way though, this is different from skimming. Skimming allows the skimmer to make future transactions which is much much worse.
      - nmstoker 5y ago
        Absolutely agree, it ought to be displayed and then consented to based on that knowledge. Right now with most contactless in shops in the UK you're left thinking "did they key that amount in right?" and if you're paranoid you ask for a receipt (from the machine, although merchants often drag their feet or try to give you one from the till not the reader!) and/or you check on the phone afterwards (which would be a pain if it showed an issue because by then it's a bit late!)
    - minitoar 5y ago
      Presumably these apps will be heavily locked down and reviewed by Apple to mitigate this. Could also imagine iOS ux to help here (obviously could still be phished).
    - samwillis 5y ago
      I suspect that Apple will have full control of the screen, like Apple Pay. Your POS app will call an apple+(stripe/other) api which will show the payment screen and enable the NFC hardware. There will be no way of an app to display a fake payment screen in front of the real one, or accessing the NFT apis themselves. It's clearly one of the key reasons why Apple have not opened up the NFC hardware for outside developers.
    - pimterry 5y ago
      This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-releases/en-gb/2020/march/mastercard-enables-contactless-limit-raise-across-29-countries-and-champions-permanent-increase/ https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless). The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-products-and-services/payments-transfers-cheques/index_en.htm#shortcut-2 https://europa.eu/youreurope/citizens/consumers/financial-pr...). No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.
- deleted 5y ago
  [deleted]
- h0nd 5y ago
  I think it only allows contactless payments. No matter if from a card or phone or whatever that is equipped with NFC payments that is compatible with the merchant app.
maerF0x0 5y ago
If they can assume connectivity it would be best to invert the flow and instead make the Customer receive an invoice ID from the NFC, then work directly with Apple servers to actually pay. Then the Business gets a push notification the invoice was paid. That way the customer phone never actually sends anything directly to the business, and the only thing sent to the customer is basically public (sure, pay my invoice if you want...) Skimming happens because you have to enter trusted things into _their_ device w/o any authentication mechanism for the device you're interacting with (the pump).
- jhatax 5y ago
  They are going to accept payments from contactless credit cards as well, so connectivity isn't assumed. If it could be, the flow you describe is brilliant.

samwillis 5y ago

It looks like it's not just Apple Pay, it's excepts any card payment, the protection has to be on the merchant's iPhone.

thebean11 5y ago
I don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible through a tap from what I understand.
- samwillis 5y ago
  I believe it's possible to perform a MITM attack on contactless cards. From a quick google: https://ieeexplore.ieee.org/document/9220841 https://ieeexplore.ieee.org/document/9220841 I do also remember reading about researchers at Cambridge University who were looking at this maybe 7-8 years ago.
  - thebean11 5y ago
    Interesting! Wasn't aware of that. Is this something that's being actively exploited in the wild though? It won't let me read the actual paper so it's hard for me to tell how practical the attack is.
    - alimov 5y ago
      Impractical things have a tendency to become practical when enough money is involved:)
  - judge2020 5y ago
    There's also this: https://youtu.be/YmJ4ULncNwg https://youtu.be/YmJ4ULncNwg // https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-First-Contact-New-Vulnerabilities-In-Contactless-Payments-wp.pdf https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-Fir...
- djrogers 5y ago
  It’d be trivial for a rogue payment app to display one $ amount on the screen yet deduct another.
  - thebean11 5y ago
    Display the $ amount on which device though? If you want to be secure, you display it on the customer's iPhone and have them confirm. Either way though, this is different from skimming. Skimming allows the skimmer to make future transactions which is much much worse.
    - nmstoker 5y ago
      Absolutely agree, it ought to be displayed and then consented to based on that knowledge. Right now with most contactless in shops in the UK you're left thinking "did they key that amount in right?" and if you're paranoid you ask for a receipt (from the machine, although merchants often drag their feet or try to give you one from the till not the reader!) and/or you check on the phone afterwards (which would be a pain if it showed an issue because by then it's a bit late!)
  - minitoar 5y ago
    Presumably these apps will be heavily locked down and reviewed by Apple to mitigate this. Could also imagine iOS ux to help here (obviously could still be phished).
  - samwillis 5y ago
    I suspect that Apple will have full control of the screen, like Apple Pay. Your POS app will call an apple+(stripe/other) api which will show the payment screen and enable the NFC hardware. There will be no way of an app to display a fake payment screen in front of the real one, or accessing the NFT apis themselves. It's clearly one of the key reasons why Apple have not opened up the NFC hardware for outside developers.
  - pimterry 5y ago
    This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-releases/en-gb/2020/march/mastercard-enables-contactless-limit-raise-across-29-countries-and-champions-permanent-increase/ https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless). The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-products-and-services/payments-transfers-cheques/index_en.htm#shortcut-2 https://europa.eu/youreurope/citizens/consumers/financial-pr...). No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.
deleted 5y ago
[deleted]
h0nd 5y ago
I think it only allows contactless payments. No matter if from a card or phone or whatever that is equipped with NFC payments that is compatible with the merchant app.

maerF0x0 5y ago

If they can assume connectivity it would be best to invert the flow and instead make the Customer receive an invoice ID from the NFC, then work directly with Apple servers to actually pay. Then the Business gets a push notification the invoice was paid. That way the customer phone never actually sends anything directly to the business, and the only thing sent to the customer is basically public (sure, pay my invoice if you want...) Skimming happens because you have to enter trusted things into _their_ device w/o any authentication mechanism for the device you're interacting with (the pump).

jhatax 5y ago
They are going to accept payments from contactless credit cards as well, so connectivity isn't assumed. If it could be, the flow you describe is brilliant.