14 ms·

CurrentC Has Been Hacked, Testers’ Email Addresses Stolen

331 points by Jeremy1026 12y ago

nav1 12y ago
They were hacked before even launching publicly. I suppose they're trying to build trust in their service early on.
higherpurpose 12y ago
We can only hope this uber-data mining [1] app has a swift death. [1] - http://techcrunch.com/2014/10/25/currentc/ http://techcrunch.com/2014/10/25/currentc/
Sonicmouse 12y ago
This is just the beginning. Anyone who has account information stored in their care should pull it now.
- tormeh 12y ago
  Not typically possible with such systems.
ilikemustard 12y ago
The fact that they've already had a data breach within the first week or so of launch is not exactly a strong argument for how secure their platform is.
- kmfrk 12y ago
  Probably from all the backlash. Reminds me of when Sony updated their PlayStations to not support Linux and subsequently got hacked.
  - kenrikm 12y ago
    CurrentC managed to piss off both iOS Users and Android Users + they are a payments platform. I don't know if you could paint a larger target on your back for blackhats.
    - kmfrk 12y ago
      Also all too reminiscent of the crap consumers have to endure with their ISPs and carriers.
- untog 12y ago
  I'm sure this is directly connected to the outrage at NFC payments being disabled in CVS, etc. - effectively, they've become a target. That said, they're supposed to be a payments provider. They should be able to cope with being a target.
  - mason55 12y ago
    I'm sure this is directly connected to the outrage at NFC payments being disabled in CVS, etc. - effectively, they've become a target. If they weren't a target because of the NFC stuff then they would have become a target because they're a payment platform. The only difference is probably how quickly the hack happened (or how public it became). If it had been the Chinese or Russians they possibly would have just pilfered and sold personal data.
  - ProCynic 12y ago
    They're not just supposed to be a payments provider. They're going to ask people to actually link their bank accounts so that the merchants don't have to pay credit card fees.
  - strict9 12y ago
    Hacking as retribution for personal data mining? Not likely. Sounds like an opportunity to get details from a financial transaction application while it's still green.
    - serge2k 12y ago
      Hacking to discredit and distrupt seems plausible.
- jobu 12y ago
  Apple won't ever admit it, but I'm sure they're loving this turn of events. Having potential competitor stumble before it's even launched is great publicity.
- x0x0 12y ago
  and the best bit -- the very best bit -- is should you be so stupid as to trust these idiots, you provide them direct access to your bank account. So when these morons donate your data to some smart hackers, instead of your credit cards getting drained, your checking account balance vanishes. It's not entirely clear what protections you have in that case. Tell your friends and family not to be stupid -- never use a payment method on the internet besides a credit card. It's really simple: by law, you have no more than $50 liability for a fraudulent credit card transaction, vs $500 for a debit card. Plus in the former case, no money vanishes from your checking account, while in the latter, it may take several weeks for your money to come back. And while you are protected, in theory, under nacha rules and regulation E from liability for fraudulent ach transfers, you may still be out the money for a very long time while you fight with your bank. Here's a useful summary: http://www.fatwallet.com/forums/finance/1023728/m15101053/#m15101053 http://www.fatwallet.com/forums/finance/1023728/m15101053/#m...
  - atonse 12y ago
    You don't have protections. With MCX + CurrentC, the customer is liable for all fraud. These idiot executives in MCX are so blind in their zeal to track customers everywhere, they never stopped to think of how reckless it is to make the customer liable.
    - meepmorp 12y ago
      > These idiot executives in MCX are so blind in their zeal to track customers everywhere, they never stopped to think of how reckless it is to make the customer liable. Do you mean reckless or potentially lucrative? My god! suddenly we don't have to eat fraud from credit card transactions (in increasingly large amounts come 2015 when liability gets pushed down to merchants by the card companies). They get extra customer data AND reduced liability. Sounds perfect.
DigitalSea 12y ago
Seems like CurrentC have a great product on their hands. Effectively they are cutting out the middle man and tying in a rewards program, not groundbreaking, but still a better deal than Apple's offering. If all else fails for them in the payments space, they have a great name that would allow them to pivot into the bottled juice market as well. The fact this thing has not even launched fully just yet, worries me they have already been hacked. Just wait until CurrentC is rolled out to more vendors and adoption increases (if it happens), it will just make them a bigger target. To some of those vendors supporting CurrentC, I bet Apple Payments is looking more appealing right about now. Pretty rookie error, lets hope they get their act together before a more widespread launch.
- kbar13 12y ago
  how is this a good product? It's essentially making the payment workflow even more complicated for users. NFC or chip+pin is the way to go, as it's more user-friendly.
  - calbear81 12y ago
    They expect CurrentC users to get discounts that you wouldn't get with using a normal credit card.
    - kbar13 12y ago
      Based on the fact that it will save merchants the credit card processing fee. They'll most likely pocket the difference instead of passing along the savings to the consumer, especially since there's no risk that their competitors will pass along the savings.
  - DigitalSea 12y ago
    I actually like the idea of cutting out the middle man and tying in a rewards program. It is not a new idea as it follows reward incentive programs that everyone from airlines to retail stores have had for years. While we can not be sure that the saved credit card fees will not be pocketed, if they are not, then CurrentC could become something great. The premise itself I am a fan of. Using QR codes however, not so much. The infrastructure can be changed though, if QR codes become too cumbersome, they have the power to change it. I was being partially sarcastic in my initial comment, but partially serious.
Pinn2 12y ago
I have more trust in Apple Pay and hope that wins.
iLoch 12y ago
Good riddance. Leave the difficult problems to capable companies and let this be a lesson.
- deleted 12y ago
  [deleted]
azdle 12y ago
Am I the only one that sees this as somewhat promising? They've become a massive target because of all the recent news with apple pay and whatnot, so it's not that surprising that there are people attacking them and all that was stolen (so far) was email addresses, but no actual important data. This is a pre-release system, it wouldn't be surprising to me if they just stole some logs off an under-protected email server that is being used to testing or something. Plus they're actually being open about it rather than just sweeping it under the rug like so many try. Yes, it's never good when any amount of personal info is stolen, but it's just email addresses and if you're not already getting spam, you just haven't been using that address long enough.
- mason55 12y ago
  They've become a massive target because of all the recent news with apple pay and whatnot They're a payments platform, they should expect to ALWAYS be a HUGE target no matter WHAT the news is. If it's not the Apple & Google fans it will be the Chinese & Russians. This is a pre-release system, it wouldn't be surprising to me if they just stole some logs off an under-protected email server that is being used to testing or something Why would a pre-prod system even be accessible to the outside world? It shows a lack of judgement and experience in security that they either made an known insecure pre-production system accessible by the outside world OR they were not competent enough to secure the server properly. They are either ignorant or incompetent, neither of which are good when talking about a payment processor.
  - jboy55 12y ago
    They're not just a payments platform that contains 16 digit CC#s, they also contain SSIDs, Drivers Licenses, Checking/Routing #s and the PID that goes along with that. My god, if you had that data, you could create all the 16 digits credit cards you would want, by forging those people's IDs. You could even create bank accounts in their name, and probably get a Passport. Not just a small target...
michaelt 12y ago
But then those retailers disabled NFC at their registers, ending their unofficial support for Apple Pay. The problem, apparently, stemmed from the fact that retailers’ contracts with MCX states they’re not supposed to accept rival mobile payment products. Interesting example of applied public relations here - you want to do foo but you don't want to be blamed for doing foo, so you create a scapegoat organisation and have them take the blame.
- otterley 12y ago
  The FAQ (http://www.mcx.com/blog/answers-to-your-questions/ http://www.mcx.com/blog/answers-to-your-questions/) has a very evasive answer to the question "Does MCX Require its Merchants to Only Offer CurrentC?": "MCX merchants make their own decisions about what solutions they want to bring to their customers; the choice is theirs. When merchants choose to work with MCX, they choose to do so exclusively and we’re proud of the long list of merchants who have partnered with us. Importantly, if a merchant decides to stop working with MCX, there are no fines." (emphasis mine) The important part here, that they've clearly buried, is that yes, if you go MCX, you have to go all the way. While merchants can choose whether to use MCX or not, they cannot choose to use MCX and NFC. Any implication that they can is absolutely false.
  - smackfu 12y ago
    The tricky bit is that MCX is owned by the merchants. It's not like some third-party payment processor. So if you pay for a share of MCX, it's not going to be something you want to walk away from.
  - michaelt 12y ago
    Any implication that they can is absolutely false. This is the brilliance of this PR tactic - it seems just like that, doesn't it? I mean, when you sign a cell phone contract the contract you can't negotiate it, it's offered to you take-it-or-leave-it, right? But MCX is retailer owned - and even if it wasn't, there is nothing stopping MCX from varying the contract at a retailer's request. If Wal-Mart came along and said they would sign a contract, but only if the exclusivity language was removed, do you think MCX would turn them down? Of course they wouldn't, they can and they would change the contract. The exclusivity clause is there because the retailers want it there.
MrDosu 12y ago
The entire cellphone based NFC payment system is retarded. Money needs to be free from electricity and endure the elements. I don't get it why they are not using proven NFC payment card systems like in japan...
- otterley 12y ago
  As far as I can tell, they work exactly the same way. I was able to use my iPhone 6 at an NFC terminal (built for MasterCard PayPass/VISA PayWave) at Dublin Airport where nobody had ever used it before in that fashion.
  - Glide 12y ago
    I suspect it's the same as well. I think CurrentC wanted to stop Apple Pay and the rest were just collateral damage. Which is stupid. Apple Pay is the most available way to pay for something that is as secure as chip & pin in the USA.
    - otterley 12y ago
      I have a feeling the MCX participants and card issuers are going to come to an impasse over their respective agreements. All the issuers have to do is require that terminals capable of NFC (for the purpose of accepting PayPass/PayWave) not have the functionality disabled. This will put the merchants in a bind and force them either to replace the terminals altogether, or re-enable NFC.
  - MrDosu 12y ago
    So what is the benefit of having it on a breakable heavy device with limited battery life? It doesnt sound very enticing to me that I can't pay that taxi when it's raining because my battery ran out.
    - otterley 12y ago
      Security and convenience; it's been covered ad nauseam elsewhere. And you can always use the plastic as a backup if you like.
jchmura 12y ago
Well at least this system is open with saying that it exists for the retailers to mine customer data. Looking at the technology, it seems it would just be faster to pay with a card than rely on my phones camera to make a payment.
steakejjs 12y ago
This is a big problem I've noticed with startups. Stupid web vulns are EVERYWHERE. I've reported so many serious web vulnerabilities to startups it isn't even funny (4-5 S14 YC batch alone). Account hijacks, XSS, SQLi. Everywhere. If you are starting a startup (or writing any web software software), PLEASE read OWASP to at least get an idea of what types of issues can exist in Web Applications. Their top 10 is a good place to start (https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10)
- wh-uws 12y ago
  Mcx is a publicly traded company http://en.m.wikipedia.org/wiki/Multi_Commodity_Exchange http://en.m.wikipedia.org/wiki/Multi_Commodity_Exchange
  - smackfu 12y ago
    Different MCX here: https://en.wikipedia.org/wiki/Merchant_Customer_Exchange https://en.wikipedia.org/wiki/Merchant_Customer_Exchange
- LesZedCB 12y ago
  While I totally agree this is important to know, CurrentC isn't a startup, it's a new program from an established company. These guys have made themselves a target, and it is very likely that no amount of good security would leave them totally invulnerable. The community's desire to make CurrentC look foolish is very high.
  - steakejjs 12y ago
    I don't see it as any different than "it's own thing". CurrentC is a new product built from scratch essentially. Building things from scratch means you end up having to worry about how your code is organized to make good secure programming decisions. I have no desire to make CurrentC look foolish, only to help people write better software which they currently aren't doing
kreek 12y ago
CurrentC will not fail because of this, they will fail because they use QR codes. An old lady could probably write a check faster than most people can scan a QR code.
- kin 12y ago
  I completely agree with this. QR codes are cumbersome and I refuse to allow any app using with QRCs at its core to touch any of my money.
- smackfu 12y ago
  The MCX org can always pivot to some other payment system, that is still not Apple Pay.
  - meepmorp 12y ago
    Like what? Sure, they don't have to re-do the backend, but there's still figuring out how to actually effect the transaction between the customer and merchant. They're already talking a 2015 launch date for this, possibly longer (can't find the article, but people involved in the project are shooting to get it done within 2 years). Changing out the front end app and store support hardware/software would just make the thing more likely to fail.
    - smackfu 12y ago
      For instance, they could use a proprietary NFC solution. Works just like Apple Pay, just instead of a credit card number, it's a CurrentC account number. Sure it doesn't too well on iPhones, but I bet they could pay Samsung, etc. to include native support in their hardware, and that's a good chunk of the market.
      - meepmorp 12y ago
        Sure, but that's also adding several years and a huge amount of development time/risk - it's creating a whole new spec, implementing it in both handsets and payment terminals, and deploying those updates. During which time, the non-halfassed standard will be chugging along just fine, increasing marketshare and generally not sucking. It's technically possible, but one of those things that's deeply unlikely to happen, particularly given the lead that Apple (and, very likely, Android in the near future) and the credit card companies have in rolling out a solution. EDIT: added a missing word
coldcode 12y ago
Perhaps it's a new feature where everyone can mine user's information.
- astrodust 12y ago
  It's part of their new open data platform?
coldpie 12y ago
You know what works every time, is accepted everywhere, has no processing fees, and won't leak your personal data? Cash.
- VLM 12y ago
  "Currency" would have been a better answer.
- huxley 12y ago
  * Plenty of online retailers won't take cash * Both coins and high-denomination bills can be and have been refused by brick-n-mortar stores (not all or most but they are within their rights to refuse it as payment).
- zrail 12y ago
  Has no processing fees for the customer. Business banks charge dearly for cash handling.
- colmvp 12y ago
  It takes up more space in my wallet. If my wallet gets stolen then that money I'll never get back. And sometimes it takes up more time when making a transaction. I always prefer cards. It's nice that all the transactions are recorded for when I'm reviewing taxes and my budgets. When I had moved to SF my biggest annoyance was how my bank only had a few locations in the entire city. To escape ATM transaction fees I'd either have to haul my ass to one of these faraway ATM locations or get cash back from a store. I could've applied with another bank or credit union, but mostly didn't have to because the convenience of a credit card made mostly solved this issue as I never have to be concerned about how much cash I had on hand. Furthermore, getting % back on my card is better through rewards than 0% using cash.
- smackfu 12y ago
  In reality, as a consumer, I average 3% back on credit cards. I probably average 2% fees on cash, between ATM fees and driving to free ATMs.
  - 12y ago
deleted 12y ago
[deleted]
mikestew 12y ago
MCX's privacy policy is a hoot, and worth a read if you like picking such things apart: http://currentc.com/50D6A97C-4B72-44D6-9021-BE0884ED2F8D/privacy-policy/ http://currentc.com/50D6A97C-4B72-44D6-9021-BE0884ED2F8D/pri... Where you see "enhance services", read it as "mine the hell out of your data and sell it". Amongst all of that "service enhancement", there's this gem: We do not respond to web browser “do not track” signals at this time. They'll also track which pharmacy you go to, and the time and frequency of when you get your prescriptions. And so on, and so on. Apple and the rest of the NFC stakeholders could have a lot of fun with this. But I think they'll wisely just sit back for now and watch the whole thing blow up on its own.
NN88 12y ago
Courtesy of Apple
joeblau 12y ago
Since CurrentC blocked NFC technology at the terminal, it would be funny if Apple and Google blocked CurrentC from their app stores.
- hk__2 12y ago
  Isn’t CurrentC a “physical-only” payment system, i.e. not supported for online transactions?
  - Jeremy1026 12y ago
    Yes, but they need to have their payment apps on the devices to make those physical transactions.
  - joeblau 12y ago
    You're correct, but like Jeremy said, they have mobile apps in both the Apple [1] and Google [2] Store. Funny enough, they both have over 2000 ratings at 1 star. [1] - https://itunes.apple.com/us/app/currentc/id912922036?mt=8 https://itunes.apple.com/us/app/currentc/id912922036?mt=8 [2] - https://play.google.com/store/apps/details?id=com.currentc https://play.google.com/store/apps/details?id=com.currentc
  - deleted 12y ago
    [deleted]
- jdminhbg 12y ago
  I don't think there's any point to this. It's going to fail on its own, why give them a place to point fingers?
- drawkbox 12y ago
  It would be funny for about a day, then you'd realize that the new Kings (Apple/Google) are being bad platform owners. They do enough of the blocking apps game on the sharecroppers. With that said, CurrentC should go away but it isn't too bad to have some competition right now as this is such a huge change for the US finally. Paying from your phone will be the norm in 1-2 years and it will seem strange before that. We are finally joining the rest of the world, Finland has been doing it since the 90's. Whoever wins the riches should have to work for it a bit. I just hope it is the consumer friendly version that wins out.
jfb 12y ago
Straight from the horse's mouth [1]: "On the data security side, the technology choices we’ve made take consumers’ security into account at every aspect of their core functionality. We want to assure you, MCX does not store sensitive customer information in the app. Users’ payment information is instead stored in our secure cloud-hosted network. Removing this sensitive information from the mobile device significantly lowers the risk of it being inappropriately disclosed in a case that the mobile device is hacked, stolen or otherwise compromised." There are simply not enough faces to palm. [1] http://www.mcx.com/blog/answers-to-your-questions/ http://www.mcx.com/blog/answers-to-your-questions/
- higherpurpose 12y ago
  It's funny that they say that, considering that storing tens or hundreds of millions of credit card information or e-mail addresses in the "cloud" represents a much higher risk than storing everything locally, in a secure enclave in devices, with little to no exposure to the OS, the way Apple does it, in terms of potential for total damage.
  - jfb 12y ago
    It's a lot simpler to steal a million people's identities in one shot than it is to mug a million people -- and that's not even getting into phone security.
  - evanspa 12y ago
    Just being pedantic, but the more accurate term is: secure element. The SE has its own OS (JavaCard) and is usually directly wired to the NFC controller (no iOS in-between). http://globalplatform.org/mediaguideSE.asp http://globalplatform.org/mediaguideSE.asp
    - chrisdroukas 12y ago
      "Secure Enclave" was (is?) the term Apple was using for the "element" storing fingerprints for Touch ID. http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...
abhishekmdb 12y ago
However no personal data or payment card data was breached http://www.techworm.net/2014/10/currentc-hacked.html http://www.techworm.net/2014/10/currentc-hacked.html
ufmace 12y ago
Considering the already known issues with CurrentC, where the customer is liable for any type of fraud and they want to connect directly to your bank account, not to mention potential issues with health information, I was already feeling roughly hell no on having anything to do with these guys. Having a data breach in like the first week only makes it look more dangerous. I know it's just email addresses - this time. Sounds like next time, the hackers might be able to clear out the connected bank account, and you'll bear full liability.
grandma876234 12y ago
5.) Walmart is like a monopoly. Tax deals as well as real estate location. CVS, Walgreen are like a monopoly. Especially in Florida where 1/3 of population is older, retired or using Medicare. 6.)Identity theft is rising due to Affordable Health Care LAW, aka 'Obamacare.' 7.)Try to open an independent pharmacy in Florida and compete with the 24 hour, cut throat pricing of CVS, Walgreens. Like an EFFECTIVE monopoly. 8.)Your Grandma is NOT tech smart and lists her phone number in the phone book EXPOSED. She uses her name in her e-mail address. I use mail redirectors like 33mail and others as well as 'changing configurations.' 9.)As a non-public USA Citizen, it is AMAZING how many ROBOT phone calls I get on an unlisted phone number and how much spam and malware oritented stuff. 10.)why? The easiest and richest WHO OWN A HOUSE AND a BANK ACCOUNT that is public rrecord are the SAND STATES. 11.)why? why? the Sand States are fast growing and have retirees like Florida, Carolinas, Arizona (think Senator John McCain). and even California. Not a lot of folks who love to LIVE IN North Dakota Winter. Unless you are a oil drilling FRACKER who is making 250 thousand a year and living in a trailer. 18.) SUMMARY: Attitude - CurrentC hires security codes for 'close to minium wage' - SO THE QUALITY IS FAR ABOVE THAT OF GOOGLE???? note: alleged and even stupidity can be relative in context. Top Management Stupidity - the top are marketers of HIGH END Soda. CVS pharmacy competes head to head against Publix Shopping Chain. The BIG FLASHING SIGN marquee says 'special deal on Coca Cola Soda. If Target and Home Depot Top Management have Never heard of BSD OS or even linux command [ lsof -i ], then there is little hope for the KEY PHARMACY SUPPLY CHAINS of the USA, in my opinion. Add in the screens of the hospital waiting rooms that SHOW WINDOWS XP or old version Windows NT which can cause some of HN to laugh out loud. New chaos + Monopoly + Attitude + Rise of Botnets + Testers= YOUR Grandma + Old White Hair Consultant (think Captain Crunch) + Top Manager Stupidity == No Surprise Do I expect the SWAT RAIDS on Grandma's house?... errr no rare that someone would borrow her identity as a 'tester' and where are you hiding 'the pills' grandma? *all respect to Grandma, she is used as a generalization. 1st amendment. fiction, no specialized mention of YOUR GRANDMA's name and no animals were hurt in the making of this message.
showsover 12y ago
And then you read what they show with just email addresses: http://www.imore.com/depth-look-currentc-and-personal-data-they-want-collect http://www.imore.com/depth-look-currentc-and-personal-data-t...

331 points by Jeremy1026 12y ago

nav1 12y ago

They were hacked before even launching publicly. I suppose they're trying to build trust in their service early on.

We can only hope this uber-data mining [1] app has a swift death. [1] - http://techcrunch.com/2014/10/25/currentc/ http://techcrunch.com/2014/10/25/currentc/

Sonicmouse 12y ago

This is just the beginning. Anyone who has account information stored in their care should pull it now.

tormeh 12y ago
Not typically possible with such systems.

ilikemustard 12y ago

The fact that they've already had a data breach within the first week or so of launch is not exactly a strong argument for how secure their platform is.

kmfrk 12y ago
Probably from all the backlash. Reminds me of when Sony updated their PlayStations to not support Linux and subsequently got hacked.
- kenrikm 12y ago
  CurrentC managed to piss off both iOS Users and Android Users + they are a payments platform. I don't know if you could paint a larger target on your back for blackhats.
  - kmfrk 12y ago
    Also all too reminiscent of the crap consumers have to endure with their ISPs and carriers.
untog 12y ago
I'm sure this is directly connected to the outrage at NFC payments being disabled in CVS, etc. - effectively, they've become a target. That said, they're supposed to be a payments provider. They should be able to cope with being a target.
- mason55 12y ago
  I'm sure this is directly connected to the outrage at NFC payments being disabled in CVS, etc. - effectively, they've become a target. If they weren't a target because of the NFC stuff then they would have become a target because they're a payment platform. The only difference is probably how quickly the hack happened (or how public it became). If it had been the Chinese or Russians they possibly would have just pilfered and sold personal data.
- ProCynic 12y ago
  They're not just supposed to be a payments provider. They're going to ask people to actually link their bank accounts so that the merchants don't have to pay credit card fees.
- strict9 12y ago
  Hacking as retribution for personal data mining? Not likely. Sounds like an opportunity to get details from a financial transaction application while it's still green.
  - serge2k 12y ago
    Hacking to discredit and distrupt seems plausible.
jobu 12y ago
Apple won't ever admit it, but I'm sure they're loving this turn of events. Having potential competitor stumble before it's even launched is great publicity.
x0x0 12y ago
and the best bit -- the very best bit -- is should you be so stupid as to trust these idiots, you provide them direct access to your bank account. So when these morons donate your data to some smart hackers, instead of your credit cards getting drained, your checking account balance vanishes. It's not entirely clear what protections you have in that case. Tell your friends and family not to be stupid -- never use a payment method on the internet besides a credit card. It's really simple: by law, you have no more than $50 liability for a fraudulent credit card transaction, vs $500 for a debit card. Plus in the former case, no money vanishes from your checking account, while in the latter, it may take several weeks for your money to come back. And while you are protected, in theory, under nacha rules and regulation E from liability for fraudulent ach transfers, you may still be out the money for a very long time while you fight with your bank. Here's a useful summary: http://www.fatwallet.com/forums/finance/1023728/m15101053/#m15101053 http://www.fatwallet.com/forums/finance/1023728/m15101053/#m...
- atonse 12y ago
  You don't have protections. With MCX + CurrentC, the customer is liable for all fraud. These idiot executives in MCX are so blind in their zeal to track customers everywhere, they never stopped to think of how reckless it is to make the customer liable.
  - meepmorp 12y ago
    > These idiot executives in MCX are so blind in their zeal to track customers everywhere, they never stopped to think of how reckless it is to make the customer liable. Do you mean reckless or potentially lucrative? My god! suddenly we don't have to eat fraud from credit card transactions (in increasingly large amounts come 2015 when liability gets pushed down to merchants by the card companies). They get extra customer data AND reduced liability. Sounds perfect.

DigitalSea 12y ago

Seems like CurrentC have a great product on their hands. Effectively they are cutting out the middle man and tying in a rewards program, not groundbreaking, but still a better deal than Apple's offering. If all else fails for them in the payments space, they have a great name that would allow them to pivot into the bottled juice market as well. The fact this thing has not even launched fully just yet, worries me they have already been hacked. Just wait until CurrentC is rolled out to more vendors and adoption increases (if it happens), it will just make them a bigger target. To some of those vendors supporting CurrentC, I bet Apple Payments is looking more appealing right about now. Pretty rookie error, lets hope they get their act together before a more widespread launch.

kbar13 12y ago
how is this a good product? It's essentially making the payment workflow even more complicated for users. NFC or chip+pin is the way to go, as it's more user-friendly.
- calbear81 12y ago
  They expect CurrentC users to get discounts that you wouldn't get with using a normal credit card.
  - kbar13 12y ago
    Based on the fact that it will save merchants the credit card processing fee. They'll most likely pocket the difference instead of passing along the savings to the consumer, especially since there's no risk that their competitors will pass along the savings.
- DigitalSea 12y ago
  I actually like the idea of cutting out the middle man and tying in a rewards program. It is not a new idea as it follows reward incentive programs that everyone from airlines to retail stores have had for years. While we can not be sure that the saved credit card fees will not be pocketed, if they are not, then CurrentC could become something great. The premise itself I am a fan of. Using QR codes however, not so much. The infrastructure can be changed though, if QR codes become too cumbersome, they have the power to change it. I was being partially sarcastic in my initial comment, but partially serious.

Pinn2 12y ago

I have more trust in Apple Pay and hope that wins.

iLoch 12y ago

Good riddance. Leave the difficult problems to capable companies and let this be a lesson.

deleted 12y ago
[deleted]

azdle 12y ago

Am I the only one that sees this as somewhat promising? They've become a massive target because of all the recent news with apple pay and whatnot, so it's not that surprising that there are people attacking them and all that was stolen (so far) was email addresses, but no actual important data. This is a pre-release system, it wouldn't be surprising to me if they just stole some logs off an under-protected email server that is being used to testing or something. Plus they're actually being open about it rather than just sweeping it under the rug like so many try. Yes, it's never good when any amount of personal info is stolen, but it's just email addresses and if you're not already getting spam, you just haven't been using that address long enough.

mason55 12y ago
They've become a massive target because of all the recent news with apple pay and whatnot They're a payments platform, they should expect to ALWAYS be a HUGE target no matter WHAT the news is. If it's not the Apple & Google fans it will be the Chinese & Russians. This is a pre-release system, it wouldn't be surprising to me if they just stole some logs off an under-protected email server that is being used to testing or something Why would a pre-prod system even be accessible to the outside world? It shows a lack of judgement and experience in security that they either made an known insecure pre-production system accessible by the outside world OR they were not competent enough to secure the server properly. They are either ignorant or incompetent, neither of which are good when talking about a payment processor.
- jboy55 12y ago
  They're not just a payments platform that contains 16 digit CC#s, they also contain SSIDs, Drivers Licenses, Checking/Routing #s and the PID that goes along with that. My god, if you had that data, you could create all the 16 digits credit cards you would want, by forging those people's IDs. You could even create bank accounts in their name, and probably get a Passport. Not just a small target...

michaelt 12y ago

But then those retailers disabled NFC at their registers, ending their unofficial support for Apple Pay. The problem, apparently, stemmed from the fact that retailers’ contracts with MCX states they’re not supposed to accept rival mobile payment products. Interesting example of applied public relations here - you want to do foo but you don't want to be blamed for doing foo, so you create a scapegoat organisation and have them take the blame.

otterley 12y ago
The FAQ (http://www.mcx.com/blog/answers-to-your-questions/ http://www.mcx.com/blog/answers-to-your-questions/) has a very evasive answer to the question "Does MCX Require its Merchants to Only Offer CurrentC?": "MCX merchants make their own decisions about what solutions they want to bring to their customers; the choice is theirs. When merchants choose to work with MCX, they choose to do so exclusively and we’re proud of the long list of merchants who have partnered with us. Importantly, if a merchant decides to stop working with MCX, there are no fines." (emphasis mine) The important part here, that they've clearly buried, is that yes, if you go MCX, you have to go all the way. While merchants can choose whether to use MCX or not, they cannot choose to use MCX and NFC. Any implication that they can is absolutely false.
- smackfu 12y ago
  The tricky bit is that MCX is owned by the merchants. It's not like some third-party payment processor. So if you pay for a share of MCX, it's not going to be something you want to walk away from.
- michaelt 12y ago
  Any implication that they can is absolutely false. This is the brilliance of this PR tactic - it seems just like that, doesn't it? I mean, when you sign a cell phone contract the contract you can't negotiate it, it's offered to you take-it-or-leave-it, right? But MCX is retailer owned - and even if it wasn't, there is nothing stopping MCX from varying the contract at a retailer's request. If Wal-Mart came along and said they would sign a contract, but only if the exclusivity language was removed, do you think MCX would turn them down? Of course they wouldn't, they can and they would change the contract. The exclusivity clause is there because the retailers want it there.

MrDosu 12y ago

The entire cellphone based NFC payment system is retarded. Money needs to be free from electricity and endure the elements. I don't get it why they are not using proven NFC payment card systems like in japan...

otterley 12y ago
As far as I can tell, they work exactly the same way. I was able to use my iPhone 6 at an NFC terminal (built for MasterCard PayPass/VISA PayWave) at Dublin Airport where nobody had ever used it before in that fashion.
- Glide 12y ago
  I suspect it's the same as well. I think CurrentC wanted to stop Apple Pay and the rest were just collateral damage. Which is stupid. Apple Pay is the most available way to pay for something that is as secure as chip & pin in the USA.
  - otterley 12y ago
    I have a feeling the MCX participants and card issuers are going to come to an impasse over their respective agreements. All the issuers have to do is require that terminals capable of NFC (for the purpose of accepting PayPass/PayWave) not have the functionality disabled. This will put the merchants in a bind and force them either to replace the terminals altogether, or re-enable NFC.
- MrDosu 12y ago
  So what is the benefit of having it on a breakable heavy device with limited battery life? It doesnt sound very enticing to me that I can't pay that taxi when it's raining because my battery ran out.
  - otterley 12y ago
    Security and convenience; it's been covered ad nauseam elsewhere. And you can always use the plastic as a backup if you like.

jchmura 12y ago

Well at least this system is open with saying that it exists for the retailers to mine customer data. Looking at the technology, it seems it would just be faster to pay with a card than rely on my phones camera to make a payment.

steakejjs 12y ago

This is a big problem I've noticed with startups. Stupid web vulns are EVERYWHERE. I've reported so many serious web vulnerabilities to startups it isn't even funny (4-5 S14 YC batch alone). Account hijacks, XSS, SQLi. Everywhere. If you are starting a startup (or writing any web software software), PLEASE read OWASP to at least get an idea of what types of issues can exist in Web Applications. Their top 10 is a good place to start (https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10)

wh-uws 12y ago
Mcx is a publicly traded company http://en.m.wikipedia.org/wiki/Multi_Commodity_Exchange http://en.m.wikipedia.org/wiki/Multi_Commodity_Exchange
- smackfu 12y ago
  Different MCX here: https://en.wikipedia.org/wiki/Merchant_Customer_Exchange https://en.wikipedia.org/wiki/Merchant_Customer_Exchange
LesZedCB 12y ago
While I totally agree this is important to know, CurrentC isn't a startup, it's a new program from an established company. These guys have made themselves a target, and it is very likely that no amount of good security would leave them totally invulnerable. The community's desire to make CurrentC look foolish is very high.
- steakejjs 12y ago
  I don't see it as any different than "it's own thing". CurrentC is a new product built from scratch essentially. Building things from scratch means you end up having to worry about how your code is organized to make good secure programming decisions. I have no desire to make CurrentC look foolish, only to help people write better software which they currently aren't doing

kreek 12y ago

CurrentC will not fail because of this, they will fail because they use QR codes. An old lady could probably write a check faster than most people can scan a QR code.

kin 12y ago
I completely agree with this. QR codes are cumbersome and I refuse to allow any app using with QRCs at its core to touch any of my money.
smackfu 12y ago
The MCX org can always pivot to some other payment system, that is still not Apple Pay.
- meepmorp 12y ago
  Like what? Sure, they don't have to re-do the backend, but there's still figuring out how to actually effect the transaction between the customer and merchant. They're already talking a 2015 launch date for this, possibly longer (can't find the article, but people involved in the project are shooting to get it done within 2 years). Changing out the front end app and store support hardware/software would just make the thing more likely to fail.
  - smackfu 12y ago
    For instance, they could use a proprietary NFC solution. Works just like Apple Pay, just instead of a credit card number, it's a CurrentC account number. Sure it doesn't too well on iPhones, but I bet they could pay Samsung, etc. to include native support in their hardware, and that's a good chunk of the market.
    - meepmorp 12y ago
      Sure, but that's also adding several years and a huge amount of development time/risk - it's creating a whole new spec, implementing it in both handsets and payment terminals, and deploying those updates. During which time, the non-halfassed standard will be chugging along just fine, increasing marketshare and generally not sucking. It's technically possible, but one of those things that's deeply unlikely to happen, particularly given the lead that Apple (and, very likely, Android in the near future) and the credit card companies have in rolling out a solution. EDIT: added a missing word

coldcode 12y ago

Perhaps it's a new feature where everyone can mine user's information.

astrodust 12y ago
It's part of their new open data platform?

coldpie 12y ago

You know what works every time, is accepted everywhere, has no processing fees, and won't leak your personal data? Cash.

VLM 12y ago
"Currency" would have been a better answer.
huxley 12y ago
* Plenty of online retailers won't take cash * Both coins and high-denomination bills can be and have been refused by brick-n-mortar stores (not all or most but they are within their rights to refuse it as payment).
zrail 12y ago
Has no processing fees for the customer. Business banks charge dearly for cash handling.
colmvp 12y ago
It takes up more space in my wallet. If my wallet gets stolen then that money I'll never get back. And sometimes it takes up more time when making a transaction. I always prefer cards. It's nice that all the transactions are recorded for when I'm reviewing taxes and my budgets. When I had moved to SF my biggest annoyance was how my bank only had a few locations in the entire city. To escape ATM transaction fees I'd either have to haul my ass to one of these faraway ATM locations or get cash back from a store. I could've applied with another bank or credit union, but mostly didn't have to because the convenience of a credit card made mostly solved this issue as I never have to be concerned about how much cash I had on hand. Furthermore, getting % back on my card is better through rewards than 0% using cash.
smackfu 12y ago
In reality, as a consumer, I average 3% back on credit cards. I probably average 2% fees on cash, between ATM fees and driving to free ATMs.
- 12y ago

deleted 12y ago

[deleted]

mikestew 12y ago

MCX's privacy policy is a hoot, and worth a read if you like picking such things apart: http://currentc.com/50D6A97C-4B72-44D6-9021-BE0884ED2F8D/privacy-policy/ http://currentc.com/50D6A97C-4B72-44D6-9021-BE0884ED2F8D/pri... Where you see "enhance services", read it as "mine the hell out of your data and sell it". Amongst all of that "service enhancement", there's this gem: We do not respond to web browser “do not track” signals at this time. They'll also track which pharmacy you go to, and the time and frequency of when you get your prescriptions. And so on, and so on. Apple and the rest of the NFC stakeholders could have a lot of fun with this. But I think they'll wisely just sit back for now and watch the whole thing blow up on its own.

NN88 12y ago

Courtesy of Apple

joeblau 12y ago

Since CurrentC blocked NFC technology at the terminal, it would be funny if Apple and Google blocked CurrentC from their app stores.

hk__2 12y ago
Isn’t CurrentC a “physical-only” payment system, i.e. not supported for online transactions?
- Jeremy1026 12y ago
  Yes, but they need to have their payment apps on the devices to make those physical transactions.
- joeblau 12y ago
  You're correct, but like Jeremy said, they have mobile apps in both the Apple [1] and Google [2] Store. Funny enough, they both have over 2000 ratings at 1 star. [1] - https://itunes.apple.com/us/app/currentc/id912922036?mt=8 https://itunes.apple.com/us/app/currentc/id912922036?mt=8 [2] - https://play.google.com/store/apps/details?id=com.currentc https://play.google.com/store/apps/details?id=com.currentc
- deleted 12y ago
  [deleted]
jdminhbg 12y ago
I don't think there's any point to this. It's going to fail on its own, why give them a place to point fingers?
drawkbox 12y ago
It would be funny for about a day, then you'd realize that the new Kings (Apple/Google) are being bad platform owners. They do enough of the blocking apps game on the sharecroppers. With that said, CurrentC should go away but it isn't too bad to have some competition right now as this is such a huge change for the US finally. Paying from your phone will be the norm in 1-2 years and it will seem strange before that. We are finally joining the rest of the world, Finland has been doing it since the 90's. Whoever wins the riches should have to work for it a bit. I just hope it is the consumer friendly version that wins out.

jfb 12y ago

Straight from the horse's mouth [1]: "On the data security side, the technology choices we’ve made take consumers’ security into account at every aspect of their core functionality. We want to assure you, MCX does not store sensitive customer information in the app. Users’ payment information is instead stored in our secure cloud-hosted network. Removing this sensitive information from the mobile device significantly lowers the risk of it being inappropriately disclosed in a case that the mobile device is hacked, stolen or otherwise compromised." There are simply not enough faces to palm. [1] http://www.mcx.com/blog/answers-to-your-questions/ http://www.mcx.com/blog/answers-to-your-questions/

higherpurpose 12y ago
It's funny that they say that, considering that storing tens or hundreds of millions of credit card information or e-mail addresses in the "cloud" represents a much higher risk than storing everything locally, in a secure enclave in devices, with little to no exposure to the OS, the way Apple does it, in terms of potential for total damage.
- jfb 12y ago
  It's a lot simpler to steal a million people's identities in one shot than it is to mug a million people -- and that's not even getting into phone security.
- evanspa 12y ago
  Just being pedantic, but the more accurate term is: secure element. The SE has its own OS (JavaCard) and is usually directly wired to the NFC controller (no iOS in-between). http://globalplatform.org/mediaguideSE.asp http://globalplatform.org/mediaguideSE.asp
  - chrisdroukas 12y ago
    "Secure Enclave" was (is?) the term Apple was using for the "element" storing fingerprints for Touch ID. http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...

abhishekmdb 12y ago

However no personal data or payment card data was breached http://www.techworm.net/2014/10/currentc-hacked.html http://www.techworm.net/2014/10/currentc-hacked.html

ufmace 12y ago

Considering the already known issues with CurrentC, where the customer is liable for any type of fraud and they want to connect directly to your bank account, not to mention potential issues with health information, I was already feeling roughly hell no on having anything to do with these guys. Having a data breach in like the first week only makes it look more dangerous. I know it's just email addresses - this time. Sounds like next time, the hackers might be able to clear out the connected bank account, and you'll bear full liability.

grandma876234 12y ago

5.) Walmart is like a monopoly. Tax deals as well as real estate location. CVS, Walgreen are like a monopoly. Especially in Florida where 1/3 of population is older, retired or using Medicare. 6.)Identity theft is rising due to Affordable Health Care LAW, aka 'Obamacare.' 7.)Try to open an independent pharmacy in Florida and compete with the 24 hour, cut throat pricing of CVS, Walgreens. Like an EFFECTIVE monopoly. 8.)Your Grandma is NOT tech smart and lists her phone number in the phone book EXPOSED. She uses her name in her e-mail address. I use mail redirectors like 33mail and others as well as 'changing configurations.' 9.)As a non-public USA Citizen, it is AMAZING how many ROBOT phone calls I get on an unlisted phone number and how much spam and malware oritented stuff. 10.)why? The easiest and richest WHO OWN A HOUSE AND a BANK ACCOUNT that is public rrecord are the SAND STATES. 11.)why? why? the Sand States are fast growing and have retirees like Florida, Carolinas, Arizona (think Senator John McCain). and even California. Not a lot of folks who love to LIVE IN North Dakota Winter. Unless you are a oil drilling FRACKER who is making 250 thousand a year and living in a trailer. 18.) SUMMARY: Attitude - CurrentC hires security codes for 'close to minium wage' - SO THE QUALITY IS FAR ABOVE THAT OF GOOGLE???? note: alleged and even stupidity can be relative in context. Top Management Stupidity - the top are marketers of HIGH END Soda. CVS pharmacy competes head to head against Publix Shopping Chain. The BIG FLASHING SIGN marquee says 'special deal on Coca Cola Soda. If Target and Home Depot Top Management have Never heard of BSD OS or even linux command [ lsof -i ], then there is little hope for the KEY PHARMACY SUPPLY CHAINS of the USA, in my opinion. Add in the screens of the hospital waiting rooms that SHOW WINDOWS XP or old version Windows NT which can cause some of HN to laugh out loud. New chaos + Monopoly + Attitude + Rise of Botnets + Testers= YOUR Grandma + Old White Hair Consultant (think Captain Crunch) + Top Manager Stupidity == No Surprise Do I expect the SWAT RAIDS on Grandma's house?... errr no rare that someone would borrow her identity as a 'tester' and where are you hiding 'the pills' grandma? *all respect to Grandma, she is used as a generalization. 1st amendment. fiction, no specialized mention of YOUR GRANDMA's name and no animals were hurt in the making of this message.

showsover 12y ago

And then you read what they show with just email addresses: http://www.imore.com/depth-look-currentc-and-personal-data-they-want-collect http://www.imore.com/depth-look-currentc-and-personal-data-t...