apple pay not as secure as in iphone?

[H3rman]

We don't have Apple pay in the UK yet, but to me it seems just as secure as the current chip & pin system we use with all our bank cards in europe.

If a 4-digit pin is secure enough for the banks, I see no reason why a 4-digit pin/passcode is not secure enough for Apple Pay?

I believe in the US you guys don't even have chip & pin yet, so if you are still relying on the old method of checking signatures, then Apple Pay seems MUCH more secure than that.

 

[Tycho24]

If the OP that concerned/distrustful of passcode, he should switch to complex passcode. It's more secure than the 1 in 50,000 probability of finding a random matching fingerprint (there's a 1 in 10,000 odds of guessing a simple 4-digit passcode).

Lol, show me where to do this on the watch please!

I feel like I've never seen this much basic confusion on a macrumor thread before.

To use ApplePay on Apple Watch you MUST have set a four digit pin... then it only works as long as it is on your wrist. Yeah, yeah, yeah about "1 in 10,000". Worth noting that you'd have to get in in the first few guesses though, before you get locked out, right?? Care to recalculate the odds of guessing a passcode in the FIRST several guesses?

----------

If someone has your thumb print, they can (somewhat easily) create a latex copy that fools touch ID.

Hahahahahahahahahahaha........

 

[Julien]

Lol, show me where to do this on the watch please!........

Turn off Simple Passcode.

 

[jclardy]

So how would this person get your passcode? I enter my AW passcode once per day, in the morning, inside my house. If they manage to take my watch, get my passcode and use it before I can call the credit card company then they deserve the award for world's dumbest criminal as they could have just grabbed my wallet instead and not had to go through the hassle of figuring out a pin code and only making purchases at Panera Bread and the Apple Store.

 

[NT1440]

You don't need blood for Touch ID on iPhone. You just need the latex fingerprint.

https://www.macrumors.com/2013/09/22/chaos-computer-club-bypasses-apples-touch-id-system/

You sure that still applies to the improved TouchID on the 6 and 6+?

It was curious to me how the stories basically never came around again after that introduction.

 

[Tycho24]

Turn off Simple Passcode.

Image

Derp dee derp.
NO!!!!!!
The op in question was saying to switch to a complex passcode on Watch, INSTEAD of using the simple 4 digit passcode. I was being rhetorical when I said "show me how to do that on Apple Watch"... obviously it is not possible. Umm, thx for posting the toggle between no password & a four digit pin though, I guess... I haven't looked at that for a few days, I suppose. (*scratches head with confusion as to what you THOUGHT you were posting/proving*).
I mean even if neither you, nor the op in question have ever used an Apple Watch... surely you've at least seen pictures, right??
Where, precisely, is this keyboard on the Watch to enter complex passwords?? (note: this is rhetorical again... please do NOT send another unrelated settings image!) Lol, the "limitation" of 4 digit pin, coupled with having to continuously read your pulse is NOT Apple trying to somehow be less secure... it's because a row of numbers is all that fits on the screen. (Try to visualize it, if you can't find any pics online... it's a little 38mm/42mm square)

 

[orev]

And everyone is stuck with 4-digit passcode for ATM transactions and the like. I think the fear is a bit irrational.

We don't have Apple pay in the UK yet, but to me it seems just as secure as the current chip & pin system we use with all our bank cards in europe.

If a 4-digit pin is secure enough for the banks, I see no reason why a 4-digit pin/passcode is not secure enough for Apple Pay?

I believe in the US you guys don't even have chip & pin yet, so if you are still relying on the old method of checking signatures, then Apple Pay seems MUCH more secure than that.

A 4-digit PIN for a bank is generally only used at an ATM or point of sale location which are mostly very controlled locations with video surveillance, and a POS location typically has a person watching you. If you get the PIN wrong a few times, other measures will kick in (like them calling the police). Also, they are not in locations where one could setup any kind of machine to brute force guess all the PINs.

A phone/watch is something that can be stolen and taken to a private place where many more attacks can be performed against the device without anyone watching you, so a simple 4-digit PIN is not sufficient. You can configure the auto-wipe after too many failed tries, but even that has been circumvented in a controlled environment recently.

----------

However I do think that this whole thing is completely overblown and is more about generating page views than it being an actual security issue.

 

[JayLenochiniMac]

Derp dee derp.
NO!!!!!!
The op in question was saying to switch to a complex passcode on Watch, INSTEAD of using the simple 4 digit passcode. I was being rhetorical when I said "show me how to do that on Apple Watch"... obviously it is not possible. Umm, thx for posting the toggle between no password & a four digit pin though, I guess... I haven't looked at that for a few days, I suppose. (*scratches head with confusion as to what you THOUGHT you were posting/proving*).
I mean even if neither you, nor the op in question have ever used an Apple Watch... surely you've at least seen pictures, right??
Where, precisely, is this keyboard on the Watch to enter complex passwords?? (note: this is rhetorical again... please do NOT send another unrelated settings image!) Lol, the "limitation" of 4 digit pin, coupled with having to continuously read your pulse is NOT Apple trying to somehow be less secure... it's because a row of numbers is all that fits on the screen. (Try to visualize it, if you can't find any pics online... it's a little 38mm/42mm square)

No, you turn off simple passcode in order to set a passcode longer than 4 digits.

 

[Tycho24]

I do hope future revisions of the watch do have Touch ID.

Yuck!!!!!
You're on your own there...

Any of us that have used ApplePay on both Phone & Watch know how much smoother and easier it is on Watch.
Clerks have said to me "oh wow, that's much easier than the phone". TouchID is most finicky when you have damp fingers, or cold fingers... I dunno - like EVERY time I pick up a soda/beer at my local quickie mart & go to pay for it!
I want to have a smooth transaction & look cool (lol!) paying with my Phone, but instead look like a pompous db, as I'm trying three times, between wiping off my thumb on my shirt, desperately to get it to take my thumbprint. At least when it doesn't work on screen unlock, I can type my four digit pin instead. This is not an option when using ApplePay on Phone... you MUST get it to work, or use a different form of payment.
I absolutely LOVE that the Watch experience eschews this & requires my pulse, rather than my print.
I don't understand how, with this simple & elegant process... that anyone would actively be seeking it being a cumbersome two-handed cludgy experience, whereupon you'd use opposite hand of Watch, in conjunction with Watch to enter your TouchID on Watch. *shudder*
Also, I pay by tipping my screen towards the NFC reader until I hear the beep (as shown in every video I've seen of the process, as well) So...... how would I also be touching the front of my Watch during this scenario??
Ugh.... the whole idea just stinks to high heaven!!!
The idea is "if it ain't broke, don't fix it"
NOT "if it ain't broke... break it", lol.

----------

No, you turn off simple passcode in order to set a passcode longer than 4 digits.

Ahhhh, ok.
When you said "switch to complex passcode", you actually meant: "switch from 4 digit pin, to 5 digit pin". Got it.
Those are two very distinctly different things, fyi.

 

[fischersd]

Yuck!!!!!
You're on your own there...

Any of us that have used ApplePay on both Phone & Watch know how much smoother and easier it is on Watch.
Clerks have said to me "oh wow, that's much easier than the phone". TouchID is most finicky when you have damp fingers, or cold fingers... I dunno - like EVERY time I pick up a soda/beer at my local quickie mart & go to pay for it!
I want to have a smooth transaction & look cool (lol!) paying with my Phone, but instead look like a pompous db, as I'm trying three times, between wiping off my thumb on my shirt, desperately to get it to take my thumbprint. At least when it doesn't work on screen unlock, I can type my four digit pin instead. This is not an option when using ApplePay on Phone... you MUST get it to work, or use a different form of payment.
I absolutely LOVE that the Watch experience eschews this & requires my pulse, rather than my print.
I don't understand how, with this simple & elegant process... that anyone would actively be seeking it being a cumbersome two-handed cludgy experience, whereupon you'd use opposite hand of Watch, in conjunction with Watch to enter your TouchID on Watch. *shudder*
Also, I pay by tipping my screen towards the NFC reader until I hear the beep (as shown in every video I've seen of the process, as well) So...... how would I also be touching the front of my Watch during this scenario??
Ugh.... the whole idea just stinks to high heaven!!!
The idea is "if it ain't broke, don't fix it"
NOT "if it ain't broke... break it", lol.

heh. I DIDN'T say they have to change the behaviour that it isn't locked. I am saying I'd rather they replace the code with touch ID for when I do have to unlock the watch.

----------

You sure that still applies to the improved TouchID on the 6 and 6+?

It was curious to me how the stories basically never came around again after that introduction.

(Again, I'm not one that's paranoid about touch ID)

...but, if you want to see how it can be done:
http://www.tested.com/tech/ios/486967-testing-apples-touch-id-fake-fingerprints/

They have a 6+ there that they test it with. (these are the myth busters guys)

I'm surprised they didn't use a 3D printer to generate a mould from a 2D scan. Ah, well.

 

[Mac 128]

coupled with having to continuously read your pulse is NOT Apple trying to somehow be less secure...

It doesn't work that way.

It's already been shown that an Watch can be lifted off one person's wrist and transferred to another's, by simply placing your fingers under the sensors during the transfer, without the watch auto-locking and requiring re-initalization.

There's another thread that discusses a few hypotheticals, in which such a flaw can be exploited, although the likelihood of it happening is slim.

But in general I agree with you, the odds of someone guessing my 4-digit password in 10 attempts is highly unlikely depending on the numbers I choose. Lock boxes for keys is a very common way to allow car dealers and real estate agents access to cars and properties. Most of here only have 4-digits. If someon could easily guess those combinations in 10 tries, nobody would use them. Most bike locks only have 4-digits, and I know people who have had everything but the bike frame stolen ... Which certainly takes more time than correctly guessing a code in 10 attempts.

Just like a scenario where someone's watch is lifted off their wrist without the watch locking is highly unlikely, so is successfully unlocking the watch with a four digit passcode.

----------

I am saying I'd rather they replace the code with touch ID for when I do have to unlock the watch.

I agree with you, Touch ID is much simpler than punching in four numbers, especially with size of the screen, even if it is only once a day.

Some have speculated putting Touch ID in the digital crown button, which should work as I often unlock my iPhone with no more than the same area of my finger that the crown accommodates.

Also: I didn't realize that Touch ID could be defeated so easily. Some of the scenarios that could allow someone to take a watch unlocked off someone's wrist, would be just as effective in taking someone's fingerprints and using with their iPhone. All of which would make an Watch wearer a good target for such an unlikely crime, especially when Pay is far more common.

 

[Tycho24]

heh. I DIDN'T say they have to change the behaviour that it isn't locked. I am saying I'd rather they replace the code with touch ID for when I do have to unlock the watch.

Lol, I still can't get behind it!!!!
To me, as much as I adore my Apple Watch... it's at least twice as thick as I'd care for. My Movado is MUCH slimmer & imho looks better for it. Of all the things they could add to Watch, sensor wise... a TouchID scanner and other accompanying hardware would NOT be welcome to me. You're describing a LOT of trouble to go through to change the two second interaction you have with Watch, once per day... right as you put it on. I feel like, at this point, you're describing a solution in search of a nonexistent problem! =P

 

[JayLenochiniMac]

Lol, I still can't get behind it!!!!
To me, as much as I adore my Apple Watch... it's at least twice as thick as I'd care for. My Movado is MUCH slimmer & imho looks better for it. Of all the things they could add to Watch, sensor wise... a TouchID scanner and other accompanying hardware would NOT be welcome to me. You're describing a LOT of trouble to go through to change the two second interaction you have with Watch, once per day... right as you put it on. I feel like, at this point, you're describing a solution in search of a nonexistent problem! =P

I agree. People are simply being irrational and paranoid for no good reason. The only thing Apple needs to improve upon is the equivalent of having an activation lock on the Watch in case it gets stolen.

 

[Tycho24]

Also: I didn't realize that Touch ID could be defeated so easily. Some of the scenarios that could allow someone to take a watch unlocked off someone's wrist, would be just as effective in taking someone's fingerprints and using with their iPhone. All of which would make an Watch wearer a good target for such an unlikely crime, especially when Pay is far more common.

Lol, TouchID can NOT be easily defeated.
Genuine news sites have a variety of experts in the field stating that the Chaos hack was performed by someone with INCREDIBLY specialized forensic skill. None of us here could likely replicate it, even if we did have all that crazy equipment & supplies. Also, I've yet to see the Watch accept ApplePay with the phone not present. People here have claimed that, but to me it seems suspect... I was under the impression, that like almost every app so far- ApplePay was serving as a pass-through, getting info from your phone.

----------

I agree. People are simply being irrational and paranoid for no good reason. The only thing Apple needs to improve upon is the equivalent of having an activation lock on the Watch in case it gets stolen.

Yes!!!!
At the same time... a "find my phone" for other owned devices besides paired iPhone would rock (& bring parity with the iPad/iPhone app). Also, "find my friends" would be great on Watch!
I use these SO much since Family Sharing came out... at a glance, I can see where my son's iPhone, iPad, and Mac are & figure out, for example, if he brought his MacBook to the neighbor's and is likely doing homework... or whether my mother, 3,500 miles & three time zones away, has made it home from work yet! A "glances" for this would be SWEET!!!

 

[mightyjabba]

I've yet to see the Watch accept ApplePay with the phone not present. People here have claimed that, but to me it seems suspect... I was under the impression, that like almost every app so far- ApplePay was serving as a pass-through, getting info from your phone.

I have yet to try it since I never go anywhere without my phone, but the watch is definitely not acting as a pass-through for the phone when it comes to Apple Pay. That's why it needs to be set up separately from the phone. It has its own secure element and can make payments independently.

 

[Jason83]

This question doesn't make any sense to me. OP refers to someone having gotten around the passcode. Would be like me saying my safe isn't secure because I gave my key to a stranger.

 

[JayLenochiniMac]

Also, I've yet to see the Watch accept ApplePay with the phone not present. People here have claimed that, but to me it seems suspect... I was under the impression, that like almost every app so far- ApplePay was serving as a pass-through, getting info from your phone.

No, you can unlock it using the passcode without the iPhone and use ApplePay outside of the iPhone. That's why you enter the same cards again on the Watch as they have their own DANs (Device Account Numbers).

 

[fischersd]

Lol, TouchID can NOT be easily defeated.
Genuine news sites have a variety of experts in the field stating that the Chaos hack was performed by someone with INCREDIBLY specialized forensic skill. None of us here could likely replicate it, even if we did have all that crazy equipment & supplies. Also, I've yet to see the Watch accept ApplePay with the phone not present. People here have claimed that, but to me it seems suspect... I was under the impression, that like almost every app so far- ApplePay was serving as a pass-through, getting info from your phone.

Watch the video at the link I posted (it's in the Mythbusters lab and they prove it on a 6+). In their test, only the mould from the finger was successful, but they also didn't use a 3D printer.

Now, I don't think it likely at all that people would go through this much trouble - especially as there will be "find my iPhone" capabilities eventually for Watch. There will be counter-measures to keep peoples' credit safe.

As for Apple Pay without having your phone, yep, lots of people have done it here. The NFC tag for doing the charges is stored on the watch.