9 ms·

Seems to work amazingly although I'm a bit concerned about the security. A friend sent me $1. I get an email from square, link to website where I entered my deb

by meritt 13y ago

Seems to work amazingly although I'm a bit concerned about the security. A friend sent me $1. I get an email from square, link to website where I entered my debit #, expiry and postal. It deposited directly to my debit card (I didnt even know you could do that). The deposit already arrived! "Checking Card Adjustment POS Pin (Credit) $1.00" So I sent him $1 back (to: my friend, cc: cash@square.com, subject: $1). And it instantly sent it to him. I didn't have to verify my details or anything. I'd feel a lot more comfortable if there was a security blog explaining how they are validating that I indeed sent the email and it wasn't simply spoofed. Edit - I did this from Gmail which I presume authenticates all of the emails via dkim? I'm guessing this won't work as automatic for other providers? Edit2 - Just attempted with another friend and had to verify manually. The automatic-authorization appears to only apply when it's between two previously validated parties.

racbart 13y ago
So one day you get an email that you got $100 and all you need to do as a recipient is to click on a link and enter your full credit card details? Sounds like a phishing paradise.
- ds9 13y ago
  Not even a credit card - a debit card! In the US at least, these are not covered by the $50 limitation on losses on unauthorized transactions. In practice the banks often honor that anyway, but AFAIK they don't have to. In this case however, it appears the bank could argue that when you got phished, you gave access to a third party. Wow. I would never do this. It's a good practice never to use a debit card online, and it's unclear to me whether the service here offers any enforeceable assurances to participants.
  - genwin 13y ago
    I'd risk a debit card on this technology only if there was a small amount in the account and no overdraft capability.
jevinskie 13y ago
Thank you for taking the time to try it out and for reporting the results back to HN.
antirez 13y ago
Even if Gmail is the reason I hope they'll add an option to verify the transfer anyway. It looks like something that is easy to use other vulnerabilities to mount an attack.
- j_b_f 13y ago
  There's a pretty straightforward SMS confirmation thing you can enable by logging in to your Square account. Tested and it seems to work well. Also note that the weekly transfer limit is $250 if you don't verify yourself, so the risk is somewhat limited.
jacobbudin 13y ago
Out of curiosity: Do you know whether the $1 is listed as "available funds"? Some (all?) banks list pending transactions like check deposits and include those funds in your account total, but then have a separate header for "available funds" that are actually usable to spend or move.
- meritt 13y ago
  In my bank (Capital One 360, formerly ING Direct) the deposit is listed as cleared & available. The $1 I sent him back is in a pending status (and thus removed from my available balance)
nwh 13y ago
The issue is also that people will just squat on compromised accounts and then nick funds as they appear. Low probability I suppose, and that's what they're betting on.
downandout 13y ago
I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population. http://prntscr.com/1xm5le http://prntscr.com/1xm5le Another issue: if you make a mistake on the initial email, and want to send a different amount, you're out of luck. When you send a corrected email from the same address and go to the payment page, it adds any previously unfinished transactions from your email to the amount being sent, with no way to cancel the mistaken one. So just never make a mistake, and never do a test transaction you don't intend to finish, or you'll be required to finish and pay for all of it when you finally do have the correct amount and want to send a transaction (which you can only send with a small subset of the debit cards in existence). These payment companies are always introducing interesting new things and then they hobble them with basic oversights and fundamentally flawed policies. In the last hour I've gone from excitement to disappointment with this service. It had promise based on the description, but this particular service (probably not Square itself) will fail very quickly.
- bcx 13y ago
  Sounds like this is probably more of a security feature. Prepaid cards are harder to track, and would be more suspect to fraud.
  - thaumasiotes 13y ago
    You know what's at least as hard to track and prone to fraud? Actual cash. I really dislike the idea that e.g. children shouldn't be able to pay for things over the internet because their identity can't be verified. Let's see some more support for prepaid cards.
    - judk 13y ago
      Actual cash is nearly impossible to fraud/counterfeit. Are you a parent? I do not have want to my kid buying products unfettered.
cypherpunks01 13y ago
Email verification would be done with SPF and DKIM. I would sure hope that this is required!
deleted 13y ago
[deleted]
- judk 13y ago
  You mean email account, and not address, right? Prevention is less important than detection and reversal before withdrawal, which Square and other payment methods companies are pros at.
  - deleted 13y ago
    [deleted]
ghughes 13y ago
What are the verification steps for sending money to a previously unknown party? Is it SMS verification, or do you have to re-enter your card details?
IanCal 13y ago
> The automatic-authorization appears to only apply when it's between two previously validated parties. This doesn't feel quite right, as you describe it you'd validated that it's ok to receive money from them, not send it. I'd be more comfortable if it was validated in some way when you first send something to a person. Receiving money doesn't mean I trust a person. I could send you a dollar, and when you accept it I could fake an email back giving me 100. I hope this only happens with signed emails. About DKIM, does it stop someone from repeating an email? Could I fake an identical email that has been sent before? If so, that's something that normally wouldn't be an issue (duplicate emails aren't really a problem, you can't inject any information, change links to dodgy sites) but would be huge for sending money. EDIT - from the DKIM site > DKIM does not protect against re-sending (replay of) a message that already has a valid signature; therefore a transit intermediary or a recipient can re-post the message in such a way that the signature would remain valid, although the new recipient(s) would not have been specified by the originator. EDIT2 - Squares security page is brief and, well, sounds odd > detects suspicious behavior in real-time, and in many instances, even before it happens. How do you detect behaviour before it happens? Isn't that inherently impossible?
- meritt 13y ago
  You bring up an excellent point about simply replaying the same message. I'm curious what mechanisms are in place to prevent that. And yes, the exchange was B -> A which gave automatic authorization for an A -> B transmission, which I do agree is a bit presumptuous on their part.
- dragonwriter 13y ago
  > How do you detect behaviour before it happens? Didn't Minority Report answer that question?
- brongondwana 13y ago
  You're right, DKIM doesn't sign the message-id, which is the obvious de-duplication mechanism. What a half-arsed oversight.
arnoldwh 13y ago
It looks like how it lets you claim your money without your bank account details is by processing a refund. Don't know how they did it, but it's very cool.
ben174 13y ago
I agree that security could and should be a huge concern. With your credit card you're protected from fraudulent transactions. But this is not the case with ATM. If someone gets a hold of your ATM + PIN, you're just plain out of luck. Not sure how that translates to this service, but if something is compromised, you might just end up with an empty bank account.
charleyma 13y ago
I posted up a detailed screen flow of the entire process on my own site if anyone is interested: http://blog.charleyma.com/square-cash-initial-thoughts-screenshot-userflow/ http://blog.charleyma.com/square-cash-initial-thoughts-scree... Overall though, extremely impressed with Square's offering and it was also instantly debited to my account. Curious to see if the value increases to a somewhat significant amount if this "instant transfer" translates into 1-2 business days.
dobbsbob 13y ago
This is almost exactly the same system as Interac in Canada. Will work well until the fraudsters figure out they can steal with it then limits will happen. Wonder what the merchant fees are and if they seize accounts for receiving an arbitrary amount of payments
- weaksauce 13y ago
  There are no fees by the looks of it; it's completely free.
  - glesica 13y ago
    No it isn't, somebody is paying something to someone. Square is just not charging the people who exchange money... yet.
    - Thebigcheeze 13y ago
      That's like saying Facebook isn't charging people yet. There are monetization strategies which don't involve charging the end user anything for the service provided.
hiddensanctum 13y ago
I agree. Security is definitely a major concern for me. Still a cool concept though

by meritt 13y ago

racbart 13y ago

So one day you get an email that you got $100 and all you need to do as a recipient is to click on a link and enter your full credit card details? Sounds like a phishing paradise.

ds9 13y ago
Not even a credit card - a debit card! In the US at least, these are not covered by the $50 limitation on losses on unauthorized transactions. In practice the banks often honor that anyway, but AFAIK they don't have to. In this case however, it appears the bank could argue that when you got phished, you gave access to a third party. Wow. I would never do this. It's a good practice never to use a debit card online, and it's unclear to me whether the service here offers any enforeceable assurances to participants.
- genwin 13y ago
  I'd risk a debit card on this technology only if there was a small amount in the account and no overdraft capability.

jevinskie 13y ago

Thank you for taking the time to try it out and for reporting the results back to HN.

antirez 13y ago

Even if Gmail is the reason I hope they'll add an option to verify the transfer anyway. It looks like something that is easy to use other vulnerabilities to mount an attack.

j_b_f 13y ago
There's a pretty straightforward SMS confirmation thing you can enable by logging in to your Square account. Tested and it seems to work well. Also note that the weekly transfer limit is $250 if you don't verify yourself, so the risk is somewhat limited.

jacobbudin 13y ago

Out of curiosity: Do you know whether the $1 is listed as "available funds"? Some (all?) banks list pending transactions like check deposits and include those funds in your account total, but then have a separate header for "available funds" that are actually usable to spend or move.

meritt 13y ago
In my bank (Capital One 360, formerly ING Direct) the deposit is listed as cleared & available. The $1 I sent him back is in a pending status (and thus removed from my available balance)

nwh 13y ago

The issue is also that people will just squat on compromised accounts and then nick funds as they appear. Low probability I suppose, and that's what they're betting on.

downandout 13y ago

I just found a major limitation with this thing. It blocks payment from any prepaid Visa/Mastercard - even reloadable cards attached to virtual checking accounts that support ACH (payroll cards, Netspend, etc). That eliminates payments from a huge section of the population. http://prntscr.com/1xm5le http://prntscr.com/1xm5le Another issue: if you make a mistake on the initial email, and want to send a different amount, you're out of luck. When you send a corrected email from the same address and go to the payment page, it adds any previously unfinished transactions from your email to the amount being sent, with no way to cancel the mistaken one. So just never make a mistake, and never do a test transaction you don't intend to finish, or you'll be required to finish and pay for all of it when you finally do have the correct amount and want to send a transaction (which you can only send with a small subset of the debit cards in existence). These payment companies are always introducing interesting new things and then they hobble them with basic oversights and fundamentally flawed policies. In the last hour I've gone from excitement to disappointment with this service. It had promise based on the description, but this particular service (probably not Square itself) will fail very quickly.

bcx 13y ago
Sounds like this is probably more of a security feature. Prepaid cards are harder to track, and would be more suspect to fraud.
- thaumasiotes 13y ago
  You know what's at least as hard to track and prone to fraud? Actual cash. I really dislike the idea that e.g. children shouldn't be able to pay for things over the internet because their identity can't be verified. Let's see some more support for prepaid cards.
  - judk 13y ago
    Actual cash is nearly impossible to fraud/counterfeit. Are you a parent? I do not have want to my kid buying products unfettered.

cypherpunks01 13y ago

Email verification would be done with SPF and DKIM. I would sure hope that this is required!

deleted 13y ago

[deleted]

judk 13y ago
You mean email account, and not address, right? Prevention is less important than detection and reversal before withdrawal, which Square and other payment methods companies are pros at.
- deleted 13y ago
  [deleted]

ghughes 13y ago

What are the verification steps for sending money to a previously unknown party? Is it SMS verification, or do you have to re-enter your card details?

IanCal 13y ago

> The automatic-authorization appears to only apply when it's between two previously validated parties. This doesn't feel quite right, as you describe it you'd validated that it's ok to receive money from them, not send it. I'd be more comfortable if it was validated in some way when you first send something to a person. Receiving money doesn't mean I trust a person. I could send you a dollar, and when you accept it I could fake an email back giving me 100. I hope this only happens with signed emails. About DKIM, does it stop someone from repeating an email? Could I fake an identical email that has been sent before? If so, that's something that normally wouldn't be an issue (duplicate emails aren't really a problem, you can't inject any information, change links to dodgy sites) but would be huge for sending money. EDIT - from the DKIM site > DKIM does not protect against re-sending (replay of) a message that already has a valid signature; therefore a transit intermediary or a recipient can re-post the message in such a way that the signature would remain valid, although the new recipient(s) would not have been specified by the originator. EDIT2 - Squares security page is brief and, well, sounds odd > detects suspicious behavior in real-time, and in many instances, even before it happens. How do you detect behaviour before it happens? Isn't that inherently impossible?

meritt 13y ago
You bring up an excellent point about simply replaying the same message. I'm curious what mechanisms are in place to prevent that. And yes, the exchange was B -> A which gave automatic authorization for an A -> B transmission, which I do agree is a bit presumptuous on their part.
dragonwriter 13y ago
> How do you detect behaviour before it happens? Didn't Minority Report answer that question?
brongondwana 13y ago
You're right, DKIM doesn't sign the message-id, which is the obvious de-duplication mechanism. What a half-arsed oversight.

arnoldwh 13y ago

It looks like how it lets you claim your money without your bank account details is by processing a refund. Don't know how they did it, but it's very cool.

ben174 13y ago

I agree that security could and should be a huge concern. With your credit card you're protected from fraudulent transactions. But this is not the case with ATM. If someone gets a hold of your ATM + PIN, you're just plain out of luck. Not sure how that translates to this service, but if something is compromised, you might just end up with an empty bank account.

charleyma 13y ago

I posted up a detailed screen flow of the entire process on my own site if anyone is interested: http://blog.charleyma.com/square-cash-initial-thoughts-screenshot-userflow/ http://blog.charleyma.com/square-cash-initial-thoughts-scree... Overall though, extremely impressed with Square's offering and it was also instantly debited to my account. Curious to see if the value increases to a somewhat significant amount if this "instant transfer" translates into 1-2 business days.

dobbsbob 13y ago

This is almost exactly the same system as Interac in Canada. Will work well until the fraudsters figure out they can steal with it then limits will happen. Wonder what the merchant fees are and if they seize accounts for receiving an arbitrary amount of payments

weaksauce 13y ago
There are no fees by the looks of it; it's completely free.
- glesica 13y ago
  No it isn't, somebody is paying something to someone. Square is just not charging the people who exchange money... yet.
  - Thebigcheeze 13y ago
    That's like saying Facebook isn't charging people yet. There are monetization strategies which don't involve charging the end user anything for the service provided.

hiddensanctum 13y ago

I agree. Security is definitely a major concern for me. Still a cool concept though