Apple Restricting Use of NFC Antenna in iPhone 6 and 6 Plus to Apple Pay

[roadbloc]

most of the stores i visit, the cashier will call the cops if you try to use someone's severed finger to pay with a phone. but i'm sure a few bodegas here in NYC will let it slide if you pay them a little extra

I don't suppose you could sly it? Make it look like your finger?

Anyway, my point isn't that touch-ID is insecure. I'm just having a hard time seeing how it is any more secure than a good password. Nobody can chop my password off, nobody can use it on the sly when I'm asleep, nodody has anyway of knowing what it is unless I leave post-it-notes around with it written down.

 

[chrisbru]

The coffin in Apple Pay?

What? If you're implying that Apple Pay won't catch on, you're going to eat those words.

 

[Journification]

What on Earth are Odeon going to do with iBeacons? Tell me where the screen is? I'd prefer it if they tried to do something useful, like let me book tickets and add them to PassBook, but they just used it to give us a 30% voucher two years ago, and haven't done jack since.

If you consider the transit patterns in a cinema, the entire process is monetised apart from the exit...

iBeacons and NFC can plug this gap, giving consumers the opportunity to book tickets for upcoming films, buy products and share real-time reviews.

The opportunities in this example are immense, commercially!

 

[ptb42]

using chip-pin is 100% safe, and by that I mean (trying to be as short as I can)...

ALL merchants here in Sweden use online-authorization (same as ApplePay)

pay is not any different, as far as the merchants are concerned.

a few things to consider here are:
we already have a safe system, and all actors have their responsibility...
IF an ATM is compromised (mag-reader) and accounts are emptied - the bank will return all your money (the reason is the ATM:s are the Banks responsibility)
IF a terminal at a merchant is compromised (which has yet to happen) the bank will return your money (the responsibility here is paid by the merchant to security companies like VeriFone.. and if compromised all money is paid by named Sec Corp.)

And this is where pay is a bit different. If any part of the merchant or transaction processing systems are compromised, the information gathered is useless. So, it eliminates this vector for fraud, and that's why the bank is willing to pay 15 cents per $100 to avoid it.

sooo ApplePay will have to compete with the already established "safe-terminal providing companies"
none of these companies have any interest in what you are buying, who you are, and why you´re buying...

Apple isn't competing with these companies. They are offering the banks an extra layer of security on top of the card processing services. Apple doesn't replace them -- they are simply offering an extra level of abstraction that is transparent to the card processing services, but resolvable by the bank.

 

[joshuarayer]

That won't last long once some company files a lawsuit saying it is anti-competitive.

 

[iGal83]

If you consider the transit patterns in a cinema, the entire process is monetised apart from the exit...

iBeacons and NFC can plug this gap, giving consumers the opportunity to book tickets for upcoming films, buy products and share real-time reviews.

The opportunities in this example are immense, commercially!

Have you seen Odeon's app? They don't strike me as a company that is looking to use technology to improve things. At all. Like most UK companies.

Maybe it's just the UK though. Even Apple stores here are rubbish. Take a look at one, the staff use iPad 2's, the Smart Signs are iPad 2's, and the revolutionary payment devices the staff carry? 4th gen iPod Touches running iOS6. All things that Apple don't even make anymore. Yet they expect other companies to upgrade and support their new initiatives?

 

[ptb42]

The US doesn't have any mainstream implementations of contactless payments, and doesn't have any meaningful transaction security around cards at all - that's the only reason Apple has a chance in the US market, because the operators view Apple's work as an opportunity to get someone to pay for the terminal switchover costs and reduce the rampant fraud.

NFC contactless payments are not widely deployed in the US, but they are the same implementation as used elsewhere in the world.

And, the switchover to EMV is already happening in the US. The liability shift to merchants (that don't use EMV) is on 10/2015, except for fuel dispensers. If a merchant hasn't already invested in an EMV terminal, they would be doing so soon, even without pay. All Apple has done is give them an additional incentive to add the NFC option to their new EMV terminal.

 

[gnasher729]

Fabricman, you are very optimistic. If you look a few posts up, there have been hacked Chip&Pin terminals. They were hacked at the supplier. Not where they were installed. A god honest Swedish company could be renting a terminal that is already hacked before it is installed and never know about it.

BTW. When you say "safe" what you really mean is "the customer gets their money back". From the bank's point of view, that's not safe. They'd prefer something where the scammers don't get your money in the first place and there is nothing to pay back, and Apple Pay helps with that.

 

[DEMinSoCAL]

I see another Samsung ad mocking the new iPhone in our future

Wow, only three posts before the first anti-Samsung post. Go figure. Someone in another thread argued that people here aren't anti-Samsung.

 

[bigandtasty]

well that's a bummer. Cool for Apple pay but why restrict it to only Apple pay… With iPhones now having NFC, this is the game changer in mobile payments. How am I supposed to leave my wallet at home if my iPhone only works in places where Apple pay is offered?

 

[JerZyT28]

When you use NFC, you have to have the data (in my case, a picture) and i have to tap to approve to send it. So what are you talking about that you don't have control?

Considering that it's very very easy to make naive NFC systems that are terribly insecure, I think this is a good call. I disable NFC on my android device explicitly because I don't have very good control over what gets squawked out to anyone who initiates an NFC handshake. I want to know that NFC is *only* being used for things I directly approve of, and *only* being used in an anonymised token manner. Right now, forcing everyone through the Apple Pay system, is worth it.

Look at what happened with badly designed transit passcards that leaked personal information by NFC. Look at the downsides of how it's gone on Android. An NFC app could be broadcasting anything at all in cleartext, you don't know. Google don't check, and without an NFC scanner of your own to test an average consumer doesn't know what their android device is shouting out to the world via NFC. Google of course do not care, it's up to the user or the device seller to sort that out, because Google don't really consider Android users to be customers they have a direct relationship with. This is why I have NFC turned off on my Android device. Android's NFC is a gimmick that opens me up to security and privacy exploits.

Forcing everyone through Apple Pay means that Apple can maintain a respectable relationship with their customer, the owner of the iDevice. It says "Yes we have NFC, but NFC is a risky technology, and we limit how apps can use it to protect our customers privacy". And this is exactly the kind of thing the *have* to do now that they get letters from Senate Committees when new devices are released asking about the privacy concerns. Google get the same letters, they just don't appear to care enough till someone takes them to court about something, or simply view it as the hardware device makers problem not theirs.

TLDR: I do *not* want NFC being trivialised and everything uses it to start squawking stuff because "why not, it's there!". It should be very limited to secure use. NFC is something that for security and privacy reasons, certainly belongs in the walled-garden not the wild-west.

 

[BDIs]

"and that's why the bank is willing to pay 15 cents per $100 to avoid it"

It's a liability avoidance. Apple is now the party liable for all fraud. This is why banks are willing to pay the 15 cents. Shifting the liability to Apple is a cost avoidance.


On a side note. I have been using touch-less pay ever since VISA started the service years ago.

Apple is NOT revolutionizing anything here. They are simply Marketing its availability way more effectively than anyone has to this point.

 

[Journification]

Have you seen Odeon's app? They don't strike me as a company that is looking to use technology to improve things. At all. Like most UK companies.

Maybe it's just the UK though. Even Apple stores here are rubbish. Take a look at one, the staff use iPad 2's, the Smart Signs are iPad 2's, and the revolutionary payment devices the staff carry? 4th gen iPod Touches running iOS6. All things that Apple don't even make anymore. Yet they expect other companies to upgrade and support their new initiatives?

I am very aware of the Odeon app, yes!

As for the broader position of UK based retailers, your observations are correct... they are entirely resistant to NFC and iBeacons but it's not the technology that concerns them, it's first-mover syndrome! In the UK the psychology is mostly to 'follow' the pack not lead it.

In the US, NFC and iBeacon will be 'gambled' upon, while in the UK businesses will wait for case history and not gamble BUT that doesn't mean they won't. Apple is great at introducing new / re-imagined tech but they can't change the embedded culture!

I guarantee, things are moving slowly and you will see an new Odeon and many other apps very shortly - well, after these companies have observed how Macy's, NFL, MLB navigate the roadbumps!

 

[Woodcrest64]

I think this is going to piss people off at first but in the long run is what's going to make their system stick and what's going to separate them from the others, Google Wallet, and the like. It's all about exclusivity at first, to show that their way is the way that works, that it's the only way, and this isn't the first time Apple (and many other companies, for that matter) has done it. That's how you get people's attention, and that's how you get the market and industry to follow (or in Samsungs case, rip off shamelessly.) I'm not saying that it's going to seem like the greatest idea to offer those restrictions in an immediate sense, but long term, it's what's going to weed out all the half-assed efforts that have fallen by the way side and establish NFC as a legitimate tool of this day and age. Once that happens, others will be able to implement similar systems into their devices, and it will be what it already should have been on a global scale.

I agree with you. Though for a retailer will they have to offer two NFC terminals one for ApplePay and the other for Android NFC users?

 

[BDIs]

I agree with you. Though for a retailer will they have to offer two NFC terminals one for ApplePay and the other for Android NFC users?

No

 

[The Phazer]

I am very aware of the Odeon app, yes!

As for the broader position of UK based retailers, your observations are correct... they are entirely resistant to NFC and iBeacons but it's not the technology that concerns them, it's first-mover syndrome! In the UK the psychology is mostly to 'follow' the pack not lead it.

In the US, NFC and iBeacon will be 'gambled' upon, while in the UK businesses will wait for case history and not gamble BUT that doesn't mean they won't. Apple is great at introducing new / re-imagined tech but they can't change the embedded culture!

I guarantee, things are moving slowly and you will see an new Odeon and many other apps very shortly - well, after these companies have observed how Macy's, NFL, MLB navigate the roadbumps!

Thousands of large mainstream UK retailers already accept NFC payments from contactless cards.

Heck, you can't find a coffee shop or chain eatery in London that doesn't take NFC today if you try.

----------

NFC contactless payments are not widely deployed in the US, but they are the same implementation as used elsewhere in the world.

Therefore not mainstream...

And, the switchover to EMV is already happening in the US. The liability shift to merchants (that don't use EMV) is on 10/2015, except for fuel dispensers. If a merchant hasn't already invested in an EMV terminal, they would be doing so soon, even without pay. All Apple has done is give them an additional incentive to add the NFC option to their new EMV terminal.

EMV without chip and pin isn't worth much, which is precisely why Apple have an opportunity in the US.

 

[GRSM-IE]

I agree with you. Though for a retailer will they have to offer two NFC terminals one for ApplePay and the other for Android NFC users?

I don't think so - it seems to me that Apple will be using HCE

http://www.paymentssource.com/news/...ity-responsibility-for-issuers-3019134-1.html

since it's purely software solution I think one terminal may work with both OSs

 

[terraphantm]

"and that's why the bank is willing to pay 15 cents per $100 to avoid it"

It's a liability avoidance. Apple is now the party liable for all fraud. This is why banks are willing to pay the 15 cents. Shifting the liability to Apple is a cost avoidance.


On a side note. I have been using touch-less pay ever since VISA started the service years ago.

Apple is NOT revolutionizing anything here. They are simply Marketing its availability way more effectively than anyone has to this point.

The tech isn't revolutionary, but Apple's negotiations are. To date, they're the only ones who have been able to convince retailers to commit to an NFC platform. Apple has always been good at using existing technology to create an ecosystem -- like Tim Cook said, this is the kind of problem they love.

I think the benefits will be beyond apple users too. Google wallet will probably go from being hit/miss to actually working. And carriers may cave in and allow it to be enabled on android handsets.

 

[Journification]

Thousands of large mainstream UK retailers already accept NFC payments from contactless cards.

Heck, you can't find a coffee shop or chain eatery in London that doesn't take NFC today if you try.

----------



Therefore not mainstream...



EMV without chip and pin isn't worth much, which is precisely why Apple have an opportunity in the US.

Agreed but that was an infrastructure decision made for them, by the banks!

Where the resistance comes in, is when they have to make a commercial decision on their own... that is very different and speaks of why NFC and iBeacons aren't prolific yet.

Take payments out of the equation, NFC hasn't achieved any kind of traction and iBeacons are in the same decision cycle. It just takes time in the UK.

 

[iGal83]

I am very aware of the Odeon app, yes!

As for the broader position of UK based retailers, your observations are correct... they are entirely resistant to NFC and iBeacons but it's not the technology that concerns them, it's first-mover syndrome! In the UK the psychology is mostly to 'follow' the pack not lead it.

In the US, NFC and iBeacon will be 'gambled' upon, while in the UK businesses will wait for case history and not gamble BUT that doesn't mean they won't. Apple is great at introducing new / re-imagined tech but they can't change the embedded culture!

I guarantee, things are moving slowly and you will see an new Odeon and many other apps very shortly - well, after these companies have observed how Macy's, NFL, MLB navigate the roadbumps!

I hope so! Just signed up for a bpay band, so at least some companies are trying things out, and that means people like me can try it out!

 

[BDIs]

The tech isn't revolutionary, but Apple's negotiations are. To date, they're the only ones who have been able to convince retailers to commit to an NFC platform. Apple has always been good at using existing technology to create an ecosystem -- like Tim Cook said, this is the kind of problem they love.

Not entirely true. If that were the case I wouldn't have already been using it. It is NOT mainstream yet. But it IS out there.

 

[Fabricman112]

pay is not any different, as far as the merchants are concerned.



And this is where pay is a bit different. If any part of the merchant or transaction processing systems are compromised, the information gathered is useless. So, it eliminates this vector for fraud, and that's why the bank is willing to pay 15 cents per $100 to avoid it.



Apple isn't competing with these companies. They are offering the banks an extra layer of security on top of the card processing services. Apple doesn't replace them -- they are simply offering an extra level of abstraction that is transparent to the card processing services, but resolvable by the bank.

you totally missed my point... the banks´s responsibility are the ATM:s... the merchant-terminals noone cares about... VISA doesnt care nor does your bank...
the MERCHANT pays the cardreader/terminal-provider an amount of money (basically making the merchant free of responsibility)...
in HERE lies ´s competitors... say VeriFone (we will provide a terminal with support of VISA/MasterCard for 100$/month... if you want AmEx 50$ extra/month...) and we (VeriFone in this case) guarantee a problemfree/safe-card-transfer 24/7... IF something goes wrong, we will pay...
again your bank,cc does not care about where, why you make a purchase (they both like it if you do many though)

pay attention to the fact that if you´re in the CC-business... it´s all about the money (noone does anything for free)
Apple is not your bank, it´s not even your credit/debit-card... the ONLY thing Apple brings to the table is a "safe" moneytransfer... and sure it is safe, meaning I would not have a problem taking responsibility of the money transfer
the transaction is quite "easy" making 100% safe... if you use MY method I will guarantee the transaction is safe...
now will people/merchants adopt to the apple-way?!?... over here NO, there is NOTHING for ANYONE to be gained with another step in our moneytransfers...
if Apple were to have a bonus system... say 2% back of all our payments, well then everyone would jump aboard

 

[ptb42]

It's a liability avoidance. Apple is now the party liable for all fraud. This is why banks are willing to pay the 15 cents. Shifting the liability to Apple is a cost avoidance.

I'd be surprised if Apple is assuming any liability. They aren't even participating in the transaction. But, I haven't seen the actual agreement.

Apple is NOT revolutionizing anything here. They are simply Marketing its availability way more effectively than anyone has to this point.

No, the proxy account number is a big deal, especially to the banks. Google was apparently doing a variation of it with Wallet, but at some point they were substituting the real account number. With pay, the proxy account number is used from end-to-end.

 

[terraphantm]

Not entirely true. If that were the case I wouldn't have already been using it. It is NOT mainstream yet. But it IS out there.

I've used it too. But it was very hit or miss. My success rate was about 50% at the few terminals that exist. Apple making the infrastructure mainstream is part of the revolution

 

[doelcm82]

Well they wouldn't be able to buy a TV anyway since NFC transactions are capped at £20. It works exactly the same on my BlackBerry except there is no fingerprint scanner (because I didn't want one). To access my card details they need a second password, one that I wouldn't be typing in front of CCTV in a hurry.

I'm just having a hard time seeing what is actually more secure about 'Apple's way' other than there is a fingerprint involved if you want. I can remote wipe my BlackBerry just fine long before a phone thief will be able to either 1. crack my flash storage encryption or 2. figure out both my device and BlackBerry account password.

It's clear that you're having a hard time seeing it, but many of us do see how Apple's system is more secure.
Moreover, the banks can see it, too. The fingerprint scan (severed fingers excepted) will be accepted as authentication and fingerprints harder to forge than a signature (and harder to capture than a PIN) there likely won't be an arbitrary cap on transactions. As far as I know, no cap has been announced. For very large purchases, or when you buy alcohol, tobacco, marijuana, or other controlled substances, vendors may still ask to see photo ID.