Apple Pay will support NFC tags(twitter.com)
twitter.com
Apple Pay will support NFC tags
https://twitter.com/SteveMoser/status/1127949077432426496
85 comments
It’s already easy enough now however it doesn’t work in reality.
It doesn’t scale due to limits.
And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business.
Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred.
They can also be used to buy physical goods which can then be resold.
You can’t do the same with NFC tags.
It doesn’t scale due to limits.
And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business.
Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred.
They can also be used to buy physical goods which can then be resold.
You can’t do the same with NFC tags.
You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.
You’d think if it was that important they have accepted visa by now then.
But I agree this is nice. convenient.
But I agree this is nice. convenient.
I assume will only work with approved partners not with any nfc sticker.
When the universe of approved partners is large enough, the security considerations will be non-trivial.
Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable.
If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila.
The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila.
The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
Apple Pay is not giving away any shared secrets over the air that are useful to steal.
I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment.
Essentially as soon as somebody reports you to Apple your account will be burned.
Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
Essentially as soon as somebody reports you to Apple your account will be burned.
Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
92% of people in China use WeChat pay as their primary payment method. Why can't/doesn't the US adopt a QR code payment system?
https://www.businessinsider.com/alipay-wechat-pay-china-mobi...
https://www.businessinsider.com/alipay-wechat-pay-china-mobi...
Why not use NFC instead? You don't have to get your phone out and focus the camera, just hold it near the sensor. Works with wearables too like Apple Watch. NFC is just better.
The cost of adoption of payees is drastically lower with QR codes. Anyone who wants to receive payments just has to print out a 10c laminated QR code and they're on the network. This helped bootstrap the network and drive mass adoption.
The terminals are not expensive, maybe in developing countries but merchants in the US can afford one easily.
The hot dog stand might not want it but they’re the rare case. In others NFC is just better in every way.
The hot dog stand might not want it but they’re the rare case. In others NFC is just better in every way.
Japan has had mobile NFC payments for over a decade now (back to the dumbphone era), and while it's heavily adopted by chain stores; smaller shops, restaurants and bars have never really adopted it due to the onerous setup, hardware, etc.
In the past 6 months or so (so basically overnight), a QR payment system (PayPay) has gotten massive adoption. They did this in two ways: a massive expensive signup campaign (20% cashback on all purchases deal), and the fact that any tiny back-alley bar can just install the app, link their bank account, and print out a QR code and now they're accepting payments.
The big advantage for QR is the quick and cheap deployment process.
In the past 6 months or so (so basically overnight), a QR payment system (PayPay) has gotten massive adoption. They did this in two ways: a massive expensive signup campaign (20% cashback on all purchases deal), and the fact that any tiny back-alley bar can just install the app, link their bank account, and print out a QR code and now they're accepting payments.
The big advantage for QR is the quick and cheap deployment process.
Ok but it’s a worse experience for the customer.
NFC is a superior technology regardless.
NFC is a superior technology regardless.
Because cameras are cheap, ubiquitous, and pretty much just as fast.
If you rely on NFC, then on Apple devices you need Apple's blessing - and for financial transactions that means Apple Pay only, you don't get access to install applications in the secure element of the NFC chip in the phone.
eg my bank installed a virtual contactless Visa/Mastercard on my Android device that worked with everything long before Google/Android Pay was a thing, and without Google getting a slice of the transaction. Transit systems can install their own virtual transit card on Android too.
If you rely on NFC, then on Apple devices you need Apple's blessing - and for financial transactions that means Apple Pay only, you don't get access to install applications in the secure element of the NFC chip in the phone.
eg my bank installed a virtual contactless Visa/Mastercard on my Android device that worked with everything long before Google/Android Pay was a thing, and without Google getting a slice of the transaction. Transit systems can install their own virtual transit card on Android too.
Not just as fast, significantly slower. I double tap my watch and then move it near the payment terminal. Then I walk out.
With wechat I have to pull out my phone, unlock it, open the app, navigate to the payments part and open the camera, point it at the QR code.
What’s the relevance of Apple here? What’s to stop Android doing this with wearables? We’re taking about NFC not a particular brand of phone.
With wechat I have to pull out my phone, unlock it, open the app, navigate to the payments part and open the camera, point it at the QR code.
What’s the relevance of Apple here? What’s to stop Android doing this with wearables? We’re taking about NFC not a particular brand of phone.
[deleted]
[deleted]
We have no functional equivalent where one platform controls most of the consumer internet. The closest would be Facebook, but most people wouldn’t like the idea of doing payments through the platform (for now). In addition, Venmo has pretty board reach.
Google actually demoed the same approach three years ago. [1] Hopefully now that Apple is doing it, Android developers will finally implement it as well.
[1] https://www.greenbot.com/article/3072233/zip-pow-google-show...
[1] https://www.greenbot.com/article/3072233/zip-pow-google-show...
I wonder if NFC chip implants people usually put in their hands can be rewritten to work with this. That would be pretty dope to accept payments from people just by asking them to tap your hand :)
You can use NFC to trigger the shortcuts app, so I'm sure Square cash could add the functionality into it.
Interesting. I remember doing experiments with this on my Nokia C7 (one of their last Symbian 3 phones) back in 2011. The vision of tapping nfc stickers / POS systems hasn’t really materialized since, but hopefully this helps. From my discussions with various store owners, the adoption has been difficult because changing your POS system is really painful. Hopefully this introduces an option where the problem is sidestepped entirely.
> The vision of tapping nfc stickers / POS systems hasn’t really materialized
In the US. Many other countries are using NFC payments on their phones for years.
In the US. Many other countries are using NFC payments on their phones for years.
What are some of the non-payment applications of this new found support?
None, iPhones already can read (but not write due to lack of apple providing an API for it) NFC tags. This announcement is that Apple Pay will support it as well.
Two obvious location-based things that could benefit from NFC:
- event registration
- punching a time clock
I'd argue that Apple's lack of NFC support effectively stifled any would-be innovators from even exploring the possibilities.
I'd argue that Apple's lack of NFC support effectively stifled any would-be innovators from even exploring the possibilities.
I vaguely remember that Yubikeys with NFC cannot be used with iPhones (only with Android phones) because of some limitation related to NFC tags. So perhaps after this update, it will be possible.
Any kind of “attach this physical device to your application/service/account on your phone”
What is written:
> Imagine tapping your phone on a scooter or a parking-meter and paying for it without signing up or downloading an app first.
What I read:
> Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking.
Basically, the entire planet is now 'fair game' as a skimmer.
What I read:
> Imagine putting your phone down on the bar and being charged $1000 by some anonymous dude that hid a NFC tag there while noone was looking.
Basically, the entire planet is now 'fair game' as a skimmer.
As others said, chances are the phone will still show you a payment takes place, allowing you to reject it, presumably while showing the amount to be paid and the payee.
I would also guess that:
- the first payment to a new payee to have a bit more UI.
- the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction.
- those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags.
- Apple acting as an intermediary between iOS user and payee to protect their user’s privacy.
It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments.
If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient.
For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up.
I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.
I would also guess that:
- the first payment to a new payee to have a bit more UI.
- the phone’s setting to contain settings such as max amount to be paid per week or month, and max amount to be paid in one transaction.
- those tags to have some cryptographic signature with Apple vetting those wanting to get a key. A service like this can be highly successful if only a limited number of companies (¿a few hundred?) can produce such tags.
- Apple acting as an intermediary between iOS user and payee to protect their user’s privacy.
It also is possible that Apple will withhold payment for a few days or even weeks, to give time to detect and correct fraudulent transactions, and give its customers time to challenge payments.
If such challenges are handled by always repaying the iOS user, this won’t be more dangerous than allowing selected companies to withdraw money from your bank account whenever they see fit, something that millions of people in the world do because it is so convenient.
For example, if Londoners enable auto top up for their Oyster card (https://oyster.tfl.gov.uk/oyster/link/sso/0002.do), transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up.
I would even expect that they can do that from any bank account even if it’s owner hasn’t applied for auto top up, or even has an Oyster card. This system is built on trust.
>if Londoners enable auto top up for their Oyster card, transport for London could transfer £1000 from their bank account the next day, even if they destroy that card seconds after signing up
This statement is sensationalist and not true, as the maximum load on a Oyster Card is £90.
This statement is sensationalist and not true, as the maximum load on a Oyster Card is £90.
Yes, that £1000 is a bit sensationalist, but the limit on an Oyster card doesn’t matter. Apart from a trust chain, there is no link between Oyster cards and bank accounts. If they were fraudulent, they could withdraw money from your bank account without topping up any card.
London transport must send thousands of payment requests to banks each day. Banks will honor them without checking anything, as there’s no way (apart from contacting the customer) for them to verify that London transport has the right to request those transfers of money to them (“here’s the form this customer signed last year” doesn’t say anything about whether the customer withdrew permission later)
The contract between the bank and London Transport likely says something about the amount of money they can request to be transferred to them each week, month or year, _may_ limit the amount per item, and says the contract will end if London Transport misuses the trust the banks give them, but that will be about it.
London transport must send thousands of payment requests to banks each day. Banks will honor them without checking anything, as there’s no way (apart from contacting the customer) for them to verify that London transport has the right to request those transfers of money to them (“here’s the form this customer signed last year” doesn’t say anything about whether the customer withdrew permission later)
The contract between the bank and London Transport likely says something about the amount of money they can request to be transferred to them each week, month or year, _may_ limit the amount per item, and says the contract will end if London Transport misuses the trust the banks give them, but that will be about it.
Huh? Apple pay requires double-tapping the power button and then authenticating with Face ID before the payment gets processed. Where did you get the idea that you can get charged automatically by "some anonymous dude"?
I imagine they will have thought of this — there's probably an authorization step like Face/Touch ID or entering your Apple ID password.
You still agree on the built in dialog, and sign with your finger/face id. You just don't need a special app for it.
Can it write to NFC? That's the golden goose for me. I have to use an android phone to write to NFC so my iPhone can read them and do things.
No, there exists no public API to do this.
This is essentially just a fancy QR code.
The tag contains the data who the payment is for and how much the payment is. You could do the exact same thing with QR, but with more fussing and aiming and worrying about the amount of light and whether the image is dirty or not.
The tag contains the data who the payment is for and how much the payment is. You could do the exact same thing with QR, but with more fussing and aiming and worrying about the amount of light and whether the image is dirty or not.
QR code requires at least one more step which is using the camera. Hopefully this will be just a single tap and confirm.
It’s not, you have to double tap the power button to invoke Apple Pay.
Apple Pay is invoked automatically whenever the phone is near a point of sale.
And since the nfc tags will have a predetermined, set payment amount associated with them, even biometrics shouldn’t be necessary.
And since the nfc tags will have a predetermined, set payment amount associated with them, even biometrics shouldn’t be necessary.
> Apple Pay is invoked automatically whenever the phone is near a point of sale.
That only works with active NFC readers though. Presumably these tags are passive and aren't emitting a signal that would wake up the iPhone
That only works with active NFC readers though. Presumably these tags are passive and aren't emitting a signal that would wake up the iPhone
I think the key is proximity, I believe. Like with a QR code, you could hypothetically take a picture of it and have that QR code be used anywhere. With this, you have to actually be in proximity to use it, I believe, which adds value in some contexts.
Is it not possible to clone NFC tags?
There's likely a secure element in these NFC devices, more sophisticated than the common NFC tags. My guess is something similar to the chips in bank cards.
Just in time for NYC subway electronic payments!
bsder(2)
I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.