8 ms·

Straight from the horse's mouth [1]: "On the data security side, the technology choices we’ve made take consumers’ security into account at every aspect of the

by jfb 12y ago

Straight from the horse's mouth [1]: "On the data security side, the technology choices we’ve made take consumers’ security into account at every aspect of their core functionality. We want to assure you, MCX does not store sensitive customer information in the app. Users’ payment information is instead stored in our secure cloud-hosted network. Removing this sensitive information from the mobile device significantly lowers the risk of it being inappropriately disclosed in a case that the mobile device is hacked, stolen or otherwise compromised." There are simply not enough faces to palm. [1] http://www.mcx.com/blog/answers-to-your-questions/ http://www.mcx.com/blog/answers-to-your-questions/

higherpurpose 12y ago
It's funny that they say that, considering that storing tens or hundreds of millions of credit card information or e-mail addresses in the "cloud" represents a much higher risk than storing everything locally, in a secure enclave in devices, with little to no exposure to the OS, the way Apple does it, in terms of potential for total damage.
- jfb 12y ago
  It's a lot simpler to steal a million people's identities in one shot than it is to mug a million people -- and that's not even getting into phone security.
- evanspa 12y ago
  Just being pedantic, but the more accurate term is: secure element. The SE has its own OS (JavaCard) and is usually directly wired to the NFC controller (no iOS in-between). http://globalplatform.org/mediaguideSE.asp http://globalplatform.org/mediaguideSE.asp
  - chrisdroukas 12y ago
    "Secure Enclave" was (is?) the term Apple was using for the "element" storing fingerprints for Touch ID. http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...
    - isamuel 12y ago
      The iPhone 6 has both a secure enclave, for Touch ID, and a secure element. "Every time you hand over your credit or debit card to pay, your card number and identity are visible. With Apple Pay, instead of using your actual credit and debit card numbers when you add your card to Passbook, a unique Device Account Number is assigned, encrypted, and securely stored in the Secure Element, a dedicated chip in iPhone." https://www.apple.com/iphone-6/apple-pay/ https://www.apple.com/iphone-6/apple-pay/
- jonknee 12y ago
  They worst part is that they aren't even going to store credit card details because they aren't launching with credit card support. They want to tie into your checking account and do ACH! (This being the big pitch to the retailers, not only can you track across stores but you can forget about credit card fees). This is an instant fail company.
  - meepmorp 12y ago
    > This is an instant fail company. This is a project largely driven by Walmart with some buy in from other merchants. Walmart has recently announced it'll provide low cost checking accounts to its customers[1]. Walmart's profits are basically driven by volume and beating up their vendors for low prices so they can in turn sell to customers at low prices - the margins are razor thin. Cutting out 2-3% from credit card fees has got to look attractive. I'd never touch this product, because it's got shitty implementation and security written all over it, but I'm not so sure if it'll be instant fail or not. If they offer a portion of what they save in credit card fees in flat discounts to people, they might be able to make it work. Of course, I don't really see what non-Walmart merchants are gonna get out of this. Helping them improve their margins seems like it'd only make things worse for places like Target or grocery stores. [1] http://www.nytimes.com/2014/09/24/business/finding-a-door-into-banking-walmart-to-offer-checking-accounts.html http://www.nytimes.com/2014/09/24/business/finding-a-door-in...
    - CamperBob2 12y ago
      So far, what I've heard about CurrentC reminds me of Circuit City's failed attempt to push their proprietary pay-per-view DVD scam. Like any number of similar schemes, up to and including Microsoft's attempt to force-feed Metro to desktop users, it's all about what the company wants, rather than what the consumer wants. That always works out so well for the company.
      - meepmorp 12y ago
        > it's all about what the company wants, rather than what the consumer wants. This is definitely true, but I'm not sure how much it matters. I, as a consumer, definitely prefer using credit cards because of the protection it affords me, plus I get rewards for what I buy - I never use a debit card to pay for things. I'm also a bit leery of the marketing surveillance state that's cropped up in the US over the past few years, and a scheme like this sets off alarm bells immediately. And I'm sufficiently well off that I'm unlikely to be enticed to try it out just to get some discounts. But I'm also not a typical consumer. I could see where - if properly and/or luckily done - this might appeal to a not insignificant number of people. If I'm getting a bank account at Walmart, it's likely because I have difficulty getting one somewhere else. Those discounts might seem more attractive to me. Maybe you could argue that's the type of consumer who's also less likely to pay with their phone (or have a phone capable of handling the payments). Dunno, but it seems like even though nobody particularly wants this, it could work because there's a lot of folks who might not dislike it enough to make a difference. DIVX failed because the idea of DVDs that are single use is just a blatant cash grab. It's less obvious here, from the consumer's perspective. My gut says clusterfuck, though. EDIT: added a sentence.
apike 12y ago
Disturbingly, this is even more dangerous than them storing credit cards on their servers, since the MCX system uses raw bank account information. If you think it's bad dealing with reversing charges and changing numbers when you get a credit card stolen, try dealing with ACH fraud.
- smackfu 12y ago
  Isn't that same "raw bank account information" on every check you write?
  - deleted 12y ago
    [deleted]
  - jfb 12y ago
    Well, sure, but it's a lot easier to steal a million of them from the "secure cloud technology" than in person.
  - Perdition 12y ago
    America is one of very few developed countries in which checks are not an anachronism for precisely this reason.

by jfb 12y ago

higherpurpose 12y ago

It's funny that they say that, considering that storing tens or hundreds of millions of credit card information or e-mail addresses in the "cloud" represents a much higher risk than storing everything locally, in a secure enclave in devices, with little to no exposure to the OS, the way Apple does it, in terms of potential for total damage.

jfb 12y ago
It's a lot simpler to steal a million people's identities in one shot than it is to mug a million people -- and that's not even getting into phone security.
evanspa 12y ago
Just being pedantic, but the more accurate term is: secure element. The SE has its own OS (JavaCard) and is usually directly wired to the NFC controller (no iOS in-between). http://globalplatform.org/mediaguideSE.asp http://globalplatform.org/mediaguideSE.asp
- chrisdroukas 12y ago
  "Secure Enclave" was (is?) the term Apple was using for the "element" storing fingerprints for Touch ID. http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...
  - isamuel 12y ago
    The iPhone 6 has both a secure enclave, for Touch ID, and a secure element. "Every time you hand over your credit or debit card to pay, your card number and identity are visible. With Apple Pay, instead of using your actual credit and debit card numbers when you add your card to Passbook, a unique Device Account Number is assigned, encrypted, and securely stored in the Secure Element, a dedicated chip in iPhone." https://www.apple.com/iphone-6/apple-pay/ https://www.apple.com/iphone-6/apple-pay/
jonknee 12y ago
They worst part is that they aren't even going to store credit card details because they aren't launching with credit card support. They want to tie into your checking account and do ACH! (This being the big pitch to the retailers, not only can you track across stores but you can forget about credit card fees). This is an instant fail company.
- meepmorp 12y ago
  > This is an instant fail company. This is a project largely driven by Walmart with some buy in from other merchants. Walmart has recently announced it'll provide low cost checking accounts to its customers[1]. Walmart's profits are basically driven by volume and beating up their vendors for low prices so they can in turn sell to customers at low prices - the margins are razor thin. Cutting out 2-3% from credit card fees has got to look attractive. I'd never touch this product, because it's got shitty implementation and security written all over it, but I'm not so sure if it'll be instant fail or not. If they offer a portion of what they save in credit card fees in flat discounts to people, they might be able to make it work. Of course, I don't really see what non-Walmart merchants are gonna get out of this. Helping them improve their margins seems like it'd only make things worse for places like Target or grocery stores. [1] http://www.nytimes.com/2014/09/24/business/finding-a-door-into-banking-walmart-to-offer-checking-accounts.html http://www.nytimes.com/2014/09/24/business/finding-a-door-in...
  - CamperBob2 12y ago
    So far, what I've heard about CurrentC reminds me of Circuit City's failed attempt to push their proprietary pay-per-view DVD scam. Like any number of similar schemes, up to and including Microsoft's attempt to force-feed Metro to desktop users, it's all about what the company wants, rather than what the consumer wants. That always works out so well for the company.
    - meepmorp 12y ago
      > it's all about what the company wants, rather than what the consumer wants. This is definitely true, but I'm not sure how much it matters. I, as a consumer, definitely prefer using credit cards because of the protection it affords me, plus I get rewards for what I buy - I never use a debit card to pay for things. I'm also a bit leery of the marketing surveillance state that's cropped up in the US over the past few years, and a scheme like this sets off alarm bells immediately. And I'm sufficiently well off that I'm unlikely to be enticed to try it out just to get some discounts. But I'm also not a typical consumer. I could see where - if properly and/or luckily done - this might appeal to a not insignificant number of people. If I'm getting a bank account at Walmart, it's likely because I have difficulty getting one somewhere else. Those discounts might seem more attractive to me. Maybe you could argue that's the type of consumer who's also less likely to pay with their phone (or have a phone capable of handling the payments). Dunno, but it seems like even though nobody particularly wants this, it could work because there's a lot of folks who might not dislike it enough to make a difference. DIVX failed because the idea of DVDs that are single use is just a blatant cash grab. It's less obvious here, from the consumer's perspective. My gut says clusterfuck, though. EDIT: added a sentence.

apike 12y ago

Disturbingly, this is even more dangerous than them storing credit cards on their servers, since the MCX system uses raw bank account information. If you think it's bad dealing with reversing charges and changing numbers when you get a credit card stolen, try dealing with ACH fraud.

smackfu 12y ago
Isn't that same "raw bank account information" on every check you write?
- deleted 12y ago
  [deleted]
- jfb 12y ago
  Well, sure, but it's a lot easier to steal a million of them from the "secure cloud technology" than in person.
- Perdition 12y ago
  America is one of very few developed countries in which checks are not an anachronism for precisely this reason.