2 ms·

> Broadly, yes, almost all NFC based access systems are insecure and pretty broken. This is like saying "almost all TLS/SSL versions are insecure and pretty br

by lxgr 2y ago

> Broadly, yes, almost all NFC based access systems are insecure and pretty broken. This is like saying "almost all TLS/SSL versions are insecure and pretty broken". Don't use the broken ones! > A big part of the reason why these Apple Wallet systems have taken so long to appear is because Apple seems to refuse to integrate with any system that isn’t built using secure cryptography. The reason Apple Pay actually took longer than Google's solutions is because Apple (presumably) co-developed the payment networks' tokenization solution, which was required to avoid the problem of every issuer having to individually integrate with Apple or issue a "proxy payments card", which significantly complicates the business side of things (which is what Google Pay originally did, when it was still called Google Wallet). It's definitely an impressive solution, but cryptography had little to do with it. Apple Pay uses the exact same cryptography as Google Pay and any physical credit/debit card issued in the past few years (in the US; decades elsewhere). If it wouldn't, you wouldn't be able to use it on any existing terminals! Don't believe it? Here's some "Apple-grade" security in action: https://practical_emv.gitlab.io/ https://practical_emv.gitlab.io/ – a vulnerability, unpatched for years, because Apple has to work with the same standards as everybody else, since even they don't have the power to make every merchant, transit agency, and fuel pump rip out their existing hardware (or even software update it).

arghwhat 2y ago
> The reason Apple Pay actually took longer than Google's solutions is because Apple (presumably) co-developed the payment networks' tokenization solution, Google Wallet launched with NFC-based mobile payments in 2011. Apple Pay launched in 2014. Neither solution is fully rolled out yet. Apple's "co-development" was all pre-launch, but not sure how much of this was Apple helping vs. Apple demanding. During this time, Apple demanded secrecy so that only select bank employees would know what was being developed/that it was being made for Apple. There's an article about what was going down back then: https://archive.nytimes.com/dealbook.nytimes.com/2014/09/11/banks-did-it-apples-way-in-payments-by-mobile/ https://archive.nytimes.com/dealbook.nytimes.com/2014/09/11/... Slow uptake afterwards is a matter of not only every issuer needing to integrate, but also every payment terminal/network needing to be upgraded. Apple in turn likely held back release in a region until enough banks and payment processors had done the legwork. These services are still rolling out - Google Pay added two more countries last week! Apple Pay came to Egypt last year. Samsung Pay came to Germany in 2020, Denmark, Finland and Norway in 2022 and Saudi Arabia in 2024. Doing anything with the financial sector anywhere is a bloody pain.
- lxgr 2y ago
  > Neither solution is fully rolled out yet. Sure, there's a long tail of banks/cards that don't support it yet, but I think it's fair to call Apple Pay and Google Pay massively deployed and successful solutions. > every payment terminal/network needing to be upgraded. Absolutely nothing needed to be upgraded in the payment terminals, or even the acquirers' systems. Tokenization involves only the network, the issuer, and the wallet provider (for POS/in-person payments). To a POS terminal, an iPhone looks indistinguishable from a regular old contactless card, unless it's explicitly looking at some of the new (and backwards-compatible) tags indicating otherwise.
  - arghwhat 2y ago
    > Sure, there's a long tail of banks/cards that don't support it yet, but I think it's fair to call Apple Pay and Google Pay massively deployed and successful solutions. Sure, but my point was that Google didn't have an easier time as a result of Apple putting in the legwork - Google was first, neither is done, and others are far behind. > Absolutely nothing needed to be upgraded in the payment terminals You need to upgrade to support contactless payments, which was not previously a requirement to accept a payment method and not at all widely rolled out - in Denmark, contactless payments launched a year after Apple Pay released in the US, and that's despite Denmark generally being cashless and far ahead of US on credit card security stuff. Contactless payment is still not universally supported, so upgrades are still pending.
avianlyric 2y ago
Erm, we’re discussing NFC/RFID used for access control systems. That has literally zero to do with Apple Pay, beyond using some of the same hardware. Just because you can perform a secure payment with your iPhone, doesn’t suddenly mean every crappy MiFare classic access control system has suddenly become secure.

by lxgr 2y ago

arghwhat 2y ago

> The reason Apple Pay actually took longer than Google's solutions is because Apple (presumably) co-developed the payment networks' tokenization solution, Google Wallet launched with NFC-based mobile payments in 2011. Apple Pay launched in 2014. Neither solution is fully rolled out yet. Apple's "co-development" was all pre-launch, but not sure how much of this was Apple helping vs. Apple demanding. During this time, Apple demanded secrecy so that only select bank employees would know what was being developed/that it was being made for Apple. There's an article about what was going down back then: https://archive.nytimes.com/dealbook.nytimes.com/2014/09/11/banks-did-it-apples-way-in-payments-by-mobile/ https://archive.nytimes.com/dealbook.nytimes.com/2014/09/11/... Slow uptake afterwards is a matter of not only every issuer needing to integrate, but also every payment terminal/network needing to be upgraded. Apple in turn likely held back release in a region until enough banks and payment processors had done the legwork. These services are still rolling out - Google Pay added two more countries last week! Apple Pay came to Egypt last year. Samsung Pay came to Germany in 2020, Denmark, Finland and Norway in 2022 and Saudi Arabia in 2024. Doing anything with the financial sector anywhere is a bloody pain.

lxgr 2y ago
> Neither solution is fully rolled out yet. Sure, there's a long tail of banks/cards that don't support it yet, but I think it's fair to call Apple Pay and Google Pay massively deployed and successful solutions. > every payment terminal/network needing to be upgraded. Absolutely nothing needed to be upgraded in the payment terminals, or even the acquirers' systems. Tokenization involves only the network, the issuer, and the wallet provider (for POS/in-person payments). To a POS terminal, an iPhone looks indistinguishable from a regular old contactless card, unless it's explicitly looking at some of the new (and backwards-compatible) tags indicating otherwise.
- arghwhat 2y ago
  > Sure, there's a long tail of banks/cards that don't support it yet, but I think it's fair to call Apple Pay and Google Pay massively deployed and successful solutions. Sure, but my point was that Google didn't have an easier time as a result of Apple putting in the legwork - Google was first, neither is done, and others are far behind. > Absolutely nothing needed to be upgraded in the payment terminals You need to upgrade to support contactless payments, which was not previously a requirement to accept a payment method and not at all widely rolled out - in Denmark, contactless payments launched a year after Apple Pay released in the US, and that's despite Denmark generally being cashless and far ahead of US on credit card security stuff. Contactless payment is still not universally supported, so upgrades are still pending.

avianlyric 2y ago

Erm, we’re discussing NFC/RFID used for access control systems. That has literally zero to do with Apple Pay, beyond using some of the same hardware. Just because you can perform a secure payment with your iPhone, doesn’t suddenly mean every crappy MiFare classic access control system has suddenly become secure.