Apple Restricting Use of NFC Antenna in iPhone 6 and 6 Plus to Apple Pay

[roadbloc]

Nice friends you have. They wait until you fall asleep and then take your phone and your finger. But they still don't have access to all your money. They won't be able to see your stored credit card numbers, as those aren't visible on the phones. When you wake up (assuming they haven't drugged you), you can wipe the phone or simply turn off Apple Pay. You don't even have to cancel your credit cards. Imagine their shock when they try to buy that big-screen TV at Target using your iPhone and your severed finger, and it doesn't work! Those same security cameras that record people entering their BlackBerry passwords will register the look of surprise and disappointment on your friends' faces.

Well they wouldn't be able to buy a TV anyway since NFC transactions are capped at £20. It works exactly the same on my BlackBerry except there is no fingerprint scanner (because I didn't want one). To access my card details they need a second password, one that I wouldn't be typing in front of CCTV in a hurry.

I'm just having a hard time seeing what is actually more secure about 'Apple's way' other than there is a fingerprint involved if you want. I can remote wipe my BlackBerry just fine long before a phone thief will be able to either 1. crack my flash storage encryption or 2. figure out both my device and BlackBerry account password.

 

[AppleHater]

It doesn't matter to me. I've had NFC app for my galaxy note 2 with NFC stickers. I've used it zero time. In a long run, it'll be nice to use the feature for something other than ApplePay but I'm in no hurry for it.

 

[gnasher729]

As of yesterday, Macys have rolled out iBeacons across their estate... it's a technology that's gathering momentum in the US.

Meanwhile, in the UK many companies are adopting iBeacons and they are deployed in some Apple stores already.

FYI payments can be triggered and taken via iBeacons too - another reason not to open up NFC!

I doubt that iBeacons can trigger payments. iBeacons can easily be forged. They are not secure. Their purpose isn't to be secure.

 

[DMVillain]

Nice friends you have. They wait until you fall asleep and then take your phone and your finger. But they still don't have access to all your money. They won't be able to see your stored credit card numbers, as those aren't visible on the phones. When you wake up (assuming they haven't drugged you), you can wipe the phone or simply turn off Apple Pay. You don't even have to cancel your credit cards. Imagine their shock when they try to buy that big-screen TV at Target using your iPhone and your severed finger, and it doesn't work! Those same security cameras that record people entering their BlackBerry passwords will register the look of surprise and disappointment on your friends' faces.

This scenario is pretty hilarious.

 

[macfacts]

They might be fine-tuning third party App 'use' or 'access' restrictions from a security standpoint. If that's the case, a 'go slow' policy is only prudent.

Are you thinking that way because of all the stories youve read about security problems with NFC on android? Because I've not seen one report of security problems with NFC on android.

Stop trying to make it sound like Apple is doing something good by restricting NFC use on iphones. Apple is doing this so they have something to sell for iPhone 6S.

 

[Jimrod]

Image​

Nope, nothing new for the US. But, I never actually used Google Wallet until after last week's Keynote. Since I first used it last week, I love it. But before, I didn't even realize that everywhere this symbol is accepts it, even if it doesn't have the Google Wallet logo.

The whole NFC thing has been promoted terribly, it's like it's gradually crept in everywhere but everyone I know only realised it when they've seen someone else use it... Next to no promotion as far as I can tell.

 

[gnasher729]

No you don't. Because any devices you have don't use apples patented secure enclave or apples patented tokenization system. Both of these are unique and protect privacy in ways existing systems cannot. I've analyzed both of these and written articles on the patents.

I think the banks have a hand in the secure enclave and the tokenisation system as well. At least in the requirements, what an iPhone with secure enclave can do and what it can't do. And the requirements are the hard thing.

 

[Journification]

I don't know of a single UK company using iBeacons. Tesco (large UK store) haven't even updated their app to iOS7 yet. If the biggest supermarket can't even do that, why would they use iBeacons or ApplePay?

I would love to use this tech, but the UK doesn't get it.

Tesco, in their Chelmsford store are trailing iBeacons.

House of Fraser have iBeacons located in mannequins, triggering marketing messaging.

French Connection have iBeacons in their stores.

VUE and Odeon cinemas are both integrating them as I type!

These are just the tip of the iceberg - we are consulting with over 30 companies, across 4 vertical markets. If anything, the UK is taking its time to roll them out publicly but it's more a case of taking their time. Whereas in the US they are more bullish...

 

[ptb42]

"Hey european banks! We're Apple and even though you were all one step ahead of the US implementing an NFC payment system and the rest of the smartphone industry adopted how you made it it just okay, we'd like you to change all that to our system. And pay us a cut for it."

Apple isn't changing the NFC payment system. It will still work just fine for credit cards, Google Wallet, etc.

Apple is offering is an extra level of security: giving the bank nearly absolute control over the financial account information. During the transaction, the user's account number is not disclosed at any point. The transaction info is only valid once, and can't be used again.

This would have prevented several high-profile compromises in the US, where PoS terminals had a monitor that captured card account info in memory during the brief period while it was unencrypted. It would have also prevented this one:

http://www.telegraph.co.uk/news/ukn...as-netted-millions-from-British-shoppers.html

In exchange for eliminating this vector for fraud, US banks have been willing to pay Apple 15 cents on every $100. I'll wager that at least some of the European banks will be willing to do something similar. The only question is how long the others will hold out, or how many customers they will lose.

 

[Jimrod]

I just saw this and it reminded me of everything over the last couple of weeks...

 

[alent1234]

Touch-ID is just a password replacement. As far as I'm concerned it makes things less secure. It is easier for a thief to force/trick you to unlocking your phone with a thumbprint. And if they were really desperate they'd just take your finger from you.

With friends like mine, Touch-ID is very insecure. They'd just wait until I fell asleep and then unlock my phone. All my messages, contacts and money available for them super easy.

Touch-ID changes nothing. It is just an alternative to a password, which are often much more secure.

most of the stores i visit, the cashier will call the cops if you try to use someone's severed finger to pay with a phone. but i'm sure a few bodegas here in NYC will let it slide if you pay them a little extra

 

[gnasher729]

A couple of things make this a bit different:

1. The Device Acccount Number is in a secure area of the A8 chip. So, if the device is somehow compromised, the DAN isn't available.
2. The Device Account Number isn't the financial account number. If someone captures the DAN between the device and the issuing bank, it can't be used for fraudulent purposes.

Google Wallet apparently does something similar, but the transaction goes to Google Servers, who then translates the number to your credit card number and submits the transaction. pay transactions go directly to the issuing bank.

So that means even if the NFC terminal at the shop is hacked, it never knows your credit card number and cannot send it to some crook who uses it for fraud. All the NFC terminal ever sees is a number that can be used only once, for that transaction.

This would have prevented several high-profile compromises in the US, where PoS terminals had a monitor that captured card account info in memory during the brief period while it was unencrypted.

Sorry, just noted you posted exactly that!

 

[Fabricman112]

No you don't. Because any devices you have don't use apples patented secure enclave or apples patented tokenization system. Both of these are unique and protect privacy in ways existing systems cannot. I've analyzed both of these and written articles on the patents.

using chip-pin is 100% safe, and by that I mean (trying to be as short as I can)...

ALL merchants here in Sweden use online-authorization (same as ApplePay)
if you wanna steal my money... you need my numbers right... the online auth. is "impossible" to fiddle with, for a couple of reasons
the chipreader/terminal is (comparing this with your iPhone 6) a device the merchants rent (and it´s "safe") communicates to certain IP:s, changes keys etc.
it is also very difficult to copy your unique ID.. first of all the terminals are very public, even if all employees tries to copy the chip.. well they can not, second point is (as an example) VeriFone provides you with the terminals/IP´s, codes etc. <- which they change on a non-regular schedule
I have much more info here but moving on...

our debit/credit-cards here HAS the magnetic strip (which basically renders all modern safety measures "useless") because we do travel out of the country sometimes...
even though our mag-strip is the golden one (containing info telling the ATM: hey this card uses a chip, sooo use that )

we do have skimming... if all ATM:s in Sweden would only accept chip, well you see the problem with tourists
but if you own a card from any Swedish bank, you´ll get your money back within 2-3 days... I´m not sure how the banks reason here, but a guess would be a number of people tell their bank: I withdrew money from ATM-X at so and so time.. and this happened, if 10+ people say the same, well it´s a fact

a few things to consider here are:
we already have a safe system, and all actors have their responsibility...
IF an ATM is compromised (mag-reader) and accounts are emptied - the bank will return all your money (the reason is the ATM:s are the Banks responsibility)
IF a terminal at a merchant is compromised (which has yet to happen) the bank will return your money (the responsibility here is paid by the merchant to security companies like VeriFone.. and if compromised all money is paid by named Sec Corp.)

sooo ApplePay will have to compete with the already established "safe-terminal providing companies"
none of these companies have any interest in what you are buying, who you are, and why you´re buying...

I absolutely love ApplePay, also USA is a good country... my point is more that in this case Apple has teamed up with VeriFone: https://twitter.com/VeriFone

I have a very criminal past life... I´m now on the good side (security) so I know way too much on howto bypass security

If this is posted in the wrong forum (too much applejuice that is) trust me in that Apple has no intention of making your payments "safer" ...
has seen an opportunity to make a shi*load of money... that is it

a major reason for this is in USA you still don´t have a law, making the merchant financially viable in case of fraud-suspicion (copying the card.. that is) and if we can provide a safe transfer (which is quite easy really) WE will pay back any money WE are responsible of...

good timing, but still f´n greedy (personal opinion)
take care MR´s

 

[AdonisSMU]

Flipping hell. Enclosed OS.

This makes sense as Apple needs to work out the kinks in the base service.

 

[iLLUMI]

I just saw this and it reminded me of everything over the last couple of weeks...

Image

LOL
Love it!

 

[Melodeath]

Hope this doesn't turn into another FaceTime.

Can you elaborate? Are you referring to how it was WiFi only at first? I actually can't remember at this point haha

 

[Bubba Satori]

Good. Opening it up to other NFC payment solutions just increases the security risk for Apple and its customers.

Yes and it should be restricted to Apple approved products and services.

 

[macfacts]

I really do hope this is the future of payment. But, obviously Apple can't get the whole world and all its devices to use Apple Pay meaning that Google and other brands are gonna have to come up with their own 'Pay' system. Even then, would those other systems be as secure as Apple Pay? God forbid Samsung half arsed something like that and creates something really unstable and insecure - I would never trust Samsung with my payment details!

That all being said, I'm hoping people on other OSes will see us iPhone uses using our phone to pay and they'll want to jump ship!

Android phones already have NFC and tap to pay in some countries (Canada is one) for about a year and I have not read about any security problems. Almost all the world has tap to pay with chip and pin cards.

 

[iLLUMI]

This makes sense as Apple needs to work out the kinks in the base service.

Yes, very good point!
As this tech is new to iPhone and Apple then it makes sense they would be restricting it to a singular environment. It's kinda like beta testing in a way.
So perhaps once they're confident in the abilties of their NFC tech then they can broaden its usage.

 

[mbrannon47]

Except NFC isn't closed off like this article says. They showed developers using it during the keynote - for instance to open doors at Starwood hotels.

 

[The Phazer]

Nice try at Apple and US bashing, but the US has had "contactless payments" for a long time, too. I don't even know how many years ago it was at this point -- at least four or five -- that I received a replacement credit card with this sideways wifi (NFC) symbol on it. You can hold that card up against card readers all over the US and make payments. That's what Apple Pay will be using, and it's pretty widespread.

I'm with the people that think, at least for now, this is a good thing. Get Apple Pay working and then open up the NFC API.

The US doesn't have any mainstream implementations of contactless payments, and doesn't have any meaningful transaction security around cards at all - that's the only reason Apple has a chance in the US market, because the operators view Apple's work as an opportunity to get someone to pay for the terminal switchover costs and reduce the rampant fraud.

Europe already has EMV and chip and pin. Fraud isn't unheard of, but it's a fraction of that in the US, and hence banks have virtually no incentive to hand over any power in this regard.

 

[iGal83]

Tesco, in their Chelmsford store are trailing iBeacons.

House of Fraser have iBeacons located in mannequins, triggering marketing messaging.

French Connection have iBeacons in their stores.

VUE and Odeon cinemas are both integrating them as I type!

These are just the tip of the iceberg - we are consulting with over 30 companies, across 4 vertical markets. If anything, the UK is taking its time to roll them out publicly but it's more a case of taking their time. Whereas in the US they are more bullish...

What on Earth are Odeon going to do with iBeacons? Tell me where the screen is? I'd prefer it if they tried to do something useful, like let me book tickets and add them to PassBook, but they just used it to give us a 30% voucher two years ago, and haven't done jack since.

 

[The Phazer]

Lol.
Awww. How adorably myopic!

Sooooo..... umm, you've seen the future in your mind & contactless cards win out over NO CARD AT ALL?!
There isn't enough lol in my keyboard to describe how silly that assertion sounds to me.

Contactless cards win over a device that frequently runs out of battery, yes.

 

[kdarling]

This really sucks , especially for Aussies, where using tap & pay for anything under $100 is the norm throughout the country for MANY years. I was ecstatic when they announced NFC for the iPhone 6 and was one of the major reasons why I bought a iP6+ to switch back from Android.

Some Aussie banks already have android apps that allow tap & pay using any NFC enabled android phone (e.g. Commonwealth Bank, Westpac, CUA etc). I was hoping that NFC enabled iPhone apps would finally be rolled out by the banks, but since Apple decided to lock this functionality down this won't be happening soon.

NFC can be used for more than just financial transactions. Some examples where I use NFC:

• Auto pair my phone to my camera to create a wifi connection to send photos wirelessly from camera (Sony RX100m3) to phone . Also can use my phone as a external viewfinder and take photos wirelessly.
• Museums and art galleries use NFC stickers to display information about an artifact/artwork
• Ticketing for public transport, e.g. Oyster Card in the UK, GoCard/Opal/Myki in Australia
• Ticketing for events/movies, e.g. No need for a physical ticket, just add a concert/festival ticket to an app similar to passbook
• Opening doors, such as at hotels.

Apple could have restricted any app used for NFC based financial transactions and opened up the way for other more creative uses for NFC. Instead, they've taken the extremely conservative option and limited innovation.

THIS. NFC has lots of uses:

Card emulation for other than direct CC payments - Transit systems can write apps to emulate their prepaid transit cards. Tickets. Door locks. Security cards. Etc.

RFID tag reader - Read custom RFID tags, which people use to trigger preset functions. E.g. turning on Bluetooth when they enter their car, setting WiFi passwords. Get coupons from ad posters. Etc.

Peer to peer commmunications. NFC equipped devices can talk to each other, using a standard request format. E.g. bring two devices together to share web page, photo, video and other links, contacts, share map directions, etc... without having to do any comm setup.

The US has had NFC payments for a while here, as well. It's just not widely deployed. Only one of my credit cards has it. And I don't see a lot of merchants with point-of-sale terminals that support it.

But, that will probably change in the next year. The liability for fraud shifts to the merchant in 10/2015 if they aren't using an EMV chip reader. So, there is a big upgrade/replacement cycle coming. The announcement of pay just gave them a big incentive to include the NFC option.

USA retailers already had more incentive than anywhere else.

Unlike the previous switch to EMV in other countries, VISA added the requirement in the USA to support NFC payments to get all the extra merchant benefits.

 

[Journification]

Except NFC isn't closed off like this article says. They showed developers using it during the keynote - for instance to open doors at Starwood hotels.

Starwood have been working with bluetooth for access control. They have also been working on a token system, via NFC.