5 ms·

I feel like a broken record, but in the near future we are going to switch to a public key authentication object for everything social we do. Payment has alread

I feel like a broken record, but in the near future we are going to switch to a public key authentication object for everything social we do. Payment has already moved to it: tap payments use public key cryptography. Yet, at the same time, whenever it is brought up people love to engage in contrarian rambles about how it is simply too hard, people will lose their dongles, etc etc. Most phones support NFC communications these days, it's a tap against a phone or reader for verification and so couldn't be easier. Within 10 years people are going to wonder how we ever lived _without_ this.

JohnFen 4y ago
> Most phones support NFC communications these days There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous. Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.
- f38zf5vdt 4y ago
  Yes, I phrased this badly. I meant that instead of using the phone's NFC for verification, we can use a small NFC device that we tap to the phone and which the phone reads via NFC to verify our identities. Just like we tap our cards to payment terminals.
- kwhitefoot 4y ago
  There is no reason why simple non-smart phones should not support NFC. > watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment. It seem more like 50% here in central Norway, perhaps more.
  - JohnFen 4y ago
    But doesn't the phone need to interact with a backend service to be used for payment? Maybe it doesn't -- I don't know how these services actually work in this regard -- but typically you need to use an app and register your accounts in order to be able to do payments, correct? A dumb phone wouldn't do any of that stuff.
    - vel0city 4y ago
      It doesn't necessarily need to be online for that kind of payment workflow. It could just directly emulate a payment card, which those definitely do not have internet connectivity. It would probably take some kind of app to add/remove payment cards, but theoretically this could just be something built-in to the device instead of being some kind of app you'd get from an app store. Dumb phones still run applications, they're not mechanical devices, at least anymore.
      - JohnFen 4y ago
        > this could just be something built-in to the device instead of being some kind of app you'd get from an app store. Yes, I wasn't asking about where the app came from. Preinstalled or user-installed doesn't matter. So what I hear you saying is that the app doesn't need to communicate with anything, either to add/drop accounts or to make payments. Is that correct?
        vel0city 4y ago
        Ah ok, I think I get what you're talking about -- you're talking about the initial provisioning. I do imagine that would need some kind of communication. But it might not necessarily be some kind of internet connection on the device itself. It could be logging into your bank's website from your computer and putting in some kind of fixed identifier of the device or like a smart card transaction with the website by a USB cable, or registering the device at some physical bank branch, putting in some kind of SIM-card like device, etc. There would probably have to be some way of pairing the device to your account, but there's probably many potential ways it could be done with some theoretical "dumb phone".
        JohnFen 4y ago
        Yes, I understand better now. I don't use these sorts of things, so I've never needed to really know how they work practically. I do understand the cryptographic underpinnings. So, a feature phone could be used for this. Good to know!
cheeselip420 4y ago
We microchip our pets. Let me walk into the DMV and get microchipped. Then I can force-wave to pay for goods, go through security checkpoints, etc. People will freak the fuck out about it... but personally I'm 100% for it.
- zoklet-enjoyer 4y ago
  I'm all for this. I've had a chip in my hand since 2014
  - atlasunshrugged 4y ago
    Did you do it yourself or use a service? What do you use it for?
    - zoklet-enjoyer 4y ago
      I had a local body mod artist implant it. He ordered it from dangerousthings.com I just have my contact card on it so when I meet people I can have them scan my hand with their phone to give them my number.
BiteCode_dev 4y ago
If you have to own a specific device to exist administratively, I'd rather use something that: - doesn't cost hundred of dollars - doesn't live track me every seconds - isn't holding also the rest of my entire life - isn't a good target for stealing, ceasing or hacking The wonderful thing about the payment card is that it's just that: a payment card. It's small, cheap to replace, doesn't require a battery, doesn't share my GPS position at every second, can't show me ads, and if it gets stolen, I don't also lose my entire list of contacts and my browser favorites. I can easily have many in my pocket, and only use one when I want. If I lose it, I can cancel it quickly, it doesn't affect anything else, and it's swiftly replaced. It's also super simple to use, yet not that easy to abuse. The phone is already too many things at once. Too many eggs on the same baskets.
- f38zf5vdt 4y ago
  Yes, a government or corporate issued device like a Yubikey with NFC is my ideal. Just tap to the phone to verify. Payment cards got it right, everyone else is just catching up.
- acomjean 4y ago
  We used to have a little key ring fob that would display a number that would change from time to time. That +password was all we needed. If my phone breaks, I can’t get onto my work network now…
- WastingMyTime89 4y ago
  Contrarian opinion: I’m never going back to using a card now that I’m used to paying with my phone. I always have my phone with me anyway. Paying with it is perfect. I don’t even carry a wallet anymore. Plus, things are frictionless. Changing card is easy. It’s fast and doesn’t require a pin most of the time. I have been moving more and more things to my smartphone as time goes on. It’s already my 2FA anyway so it will be a major hassle if it’s stolen (but stealing modern smartphone is useless as they can’t be reactivated anyway).
aaomidi 4y ago
The main problem is, PKI is hard and banks and DMV aren’t known for their appreciation of technical complexity. we have highly technical CAs for https that have wild problems. A well functioning PKI system for banking, identity might work - but it needs to actually be well functioning and transparent.
jollyllama 4y ago
You're assuming the post-2001 security state assumptions remain the same or don't ease. Which is probably true, but a lot of us would rather ditch them.

JohnFen 4y ago

> Most phones support NFC communications these days There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous. Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.

f38zf5vdt 4y ago
Yes, I phrased this badly. I meant that instead of using the phone's NFC for verification, we can use a small NFC device that we tap to the phone and which the phone reads via NFC to verify our identities. Just like we tap our cards to payment terminals.
kwhitefoot 4y ago
There is no reason why simple non-smart phones should not support NFC. > watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment. It seem more like 50% here in central Norway, perhaps more.
- JohnFen 4y ago
  But doesn't the phone need to interact with a backend service to be used for payment? Maybe it doesn't -- I don't know how these services actually work in this regard -- but typically you need to use an app and register your accounts in order to be able to do payments, correct? A dumb phone wouldn't do any of that stuff.
  - vel0city 4y ago
    It doesn't necessarily need to be online for that kind of payment workflow. It could just directly emulate a payment card, which those definitely do not have internet connectivity. It would probably take some kind of app to add/remove payment cards, but theoretically this could just be something built-in to the device instead of being some kind of app you'd get from an app store. Dumb phones still run applications, they're not mechanical devices, at least anymore.
    - JohnFen 4y ago
      > this could just be something built-in to the device instead of being some kind of app you'd get from an app store. Yes, I wasn't asking about where the app came from. Preinstalled or user-installed doesn't matter. So what I hear you saying is that the app doesn't need to communicate with anything, either to add/drop accounts or to make payments. Is that correct?
      - vel0city 4y ago
        Ah ok, I think I get what you're talking about -- you're talking about the initial provisioning. I do imagine that would need some kind of communication. But it might not necessarily be some kind of internet connection on the device itself. It could be logging into your bank's website from your computer and putting in some kind of fixed identifier of the device or like a smart card transaction with the website by a USB cable, or registering the device at some physical bank branch, putting in some kind of SIM-card like device, etc. There would probably have to be some way of pairing the device to your account, but there's probably many potential ways it could be done with some theoretical "dumb phone".
        JohnFen 4y ago
        Yes, I understand better now. I don't use these sorts of things, so I've never needed to really know how they work practically. I do understand the cryptographic underpinnings. So, a feature phone could be used for this. Good to know!

cheeselip420 4y ago

We microchip our pets. Let me walk into the DMV and get microchipped. Then I can force-wave to pay for goods, go through security checkpoints, etc. People will freak the fuck out about it... but personally I'm 100% for it.

zoklet-enjoyer 4y ago
I'm all for this. I've had a chip in my hand since 2014
- atlasunshrugged 4y ago
  Did you do it yourself or use a service? What do you use it for?
  - zoklet-enjoyer 4y ago
    I had a local body mod artist implant it. He ordered it from dangerousthings.com I just have my contact card on it so when I meet people I can have them scan my hand with their phone to give them my number.

BiteCode_dev 4y ago

If you have to own a specific device to exist administratively, I'd rather use something that: - doesn't cost hundred of dollars - doesn't live track me every seconds - isn't holding also the rest of my entire life - isn't a good target for stealing, ceasing or hacking The wonderful thing about the payment card is that it's just that: a payment card. It's small, cheap to replace, doesn't require a battery, doesn't share my GPS position at every second, can't show me ads, and if it gets stolen, I don't also lose my entire list of contacts and my browser favorites. I can easily have many in my pocket, and only use one when I want. If I lose it, I can cancel it quickly, it doesn't affect anything else, and it's swiftly replaced. It's also super simple to use, yet not that easy to abuse. The phone is already too many things at once. Too many eggs on the same baskets.

f38zf5vdt 4y ago
Yes, a government or corporate issued device like a Yubikey with NFC is my ideal. Just tap to the phone to verify. Payment cards got it right, everyone else is just catching up.
acomjean 4y ago
We used to have a little key ring fob that would display a number that would change from time to time. That +password was all we needed. If my phone breaks, I can’t get onto my work network now…
WastingMyTime89 4y ago
Contrarian opinion: I’m never going back to using a card now that I’m used to paying with my phone. I always have my phone with me anyway. Paying with it is perfect. I don’t even carry a wallet anymore. Plus, things are frictionless. Changing card is easy. It’s fast and doesn’t require a pin most of the time. I have been moving more and more things to my smartphone as time goes on. It’s already my 2FA anyway so it will be a major hassle if it’s stolen (but stealing modern smartphone is useless as they can’t be reactivated anyway).

aaomidi 4y ago

The main problem is, PKI is hard and banks and DMV aren’t known for their appreciation of technical complexity. we have highly technical CAs for https that have wild problems. A well functioning PKI system for banking, identity might work - but it needs to actually be well functioning and transparent.

jollyllama 4y ago

You're assuming the post-2001 security state assumptions remain the same or don't ease. Which is probably true, but a lot of us would rather ditch them.