Germany Passes Law Forcing Apple to Open Up iPhone's NFC Chip to Apple Pay Rivals, But Loophole May Exist

[Khedron]

Ok, let's say someone in the black market invents a portable NFC scanner to extract payments from unwitting pedestrians in crowded places. Apple pay takes a handful of security measures to prevent such hacks. Should Apple also open up its FaceID/touch ID interface to secure others' payments over its phone? Should it make the "secure enclave" open? Should it write software and hardware to allow third party payments to thrive on its own closed platform?

It's about how it has the potential to get exploited and how they don't want to be responsible for securing other companies third party payments. People specifically pay Apple money for a predictable, secure experience. App store has at least some quality controls in place that prevent malicious apps from getting released. In my mind, the NFC chip follows the same principle. Why should Apple open it up for anyone to do anything with it?

Sorry but you obviously don't have a clue what NFC is.

 

[Websnapx2]

that is a feature if you ask me

that is a feature that apple created. while i am happy with it doesnt mean apple should charge for it... they charge enough for the device and it should be included. should u be charged if apple charged u for storing you web passwords in safari in a more secure way? or analogy apple devices can only connect to the internet with modem/routers made by apple & no others should be allowed because of security. ...everything these days needs some level of security incorporated this is just an excuse...
I use my cc card in various ways physical card, paypal, apple pay, direct debit and so on... I dont think tokanization benefits me that much...most of my apple pay use is actually in brick n mortar stores.

I really don't think you understand how that works.

When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers, and when you pay your card numbers are never shared by Apple with merchants.

When you pay with a debit or credit card, Apple Pay doesn’t keep transaction information that can be tied back to you.

That is tokenization. it keeps the purchase information on-device so that not only does the merchant and apple not know your banking information (just a binary validation from the bank) but if someone gets your device, they couldn't pull info out of it. Advances like that cost to develop and apple isn't actually charging you to use it so I don't know what you mean about Apple charging for it — it isn't.

I dont think tokanization benefits me that much...most of my apple pay use is actually in brick n mortar stores.

you really don't know what it is or how it works — it has nothing to do with that at all. Tokenization just means that account info and merchant details are done in such a way that no information can be tied to you and can be kept private from everyone but you and your bank. Are you saying you gain no benefit from a merchant or third party being blocked from your account information?

 

[toohectic]

apple really wants it's 30% cut of each sale

Apple does not get 30% of each ApplePay transaction. They get a maximum of 0.15% in the US, and much lower in the EU. That’s equivalent to a maximum of $1.50 for every $1000 transaction.

 

[Khedron]

Here in the UK there was an issue recently with EU citizens who wished to apply to stay post Brexit and you had to use the NFC chip in your phone to scan your passport to apply. Problem was that you had to have an Android device or similar, no iPhone user was able to use the NFC to read something.

If Apple opened up the NFC chip on the iPhone, the options are endless for loads of different products and functionality.

Similar issue when I used to travel with a public transport card. With my iPhone, I had to travel 3 miles to a central station to load up credit (and hope the machine was actually working) whereas anyone with an Android phone could pay with the app and transfer the credit to their card with NFC.

 

[Websnapx2]

Here in the UK there was an issue recently with EU citizens who wished to apply to stay post Brexit and you had to use the NFC chip in your phone to scan your passport to apply. Problem was that you had to have an Android device or similar, no iPhone user was able to use the NFC to read something.

If Apple opened up the NFC chip on the iPhone, the options are endless for loads of different products and functionality.

that's already been done with iPhones 7 and later running iOS13

 

[realtuner]

Probably because Apple is a US company, so it makes sense for a foreign country like Germany to pass legislation that favours its own companies rather than one which would strengthen the leverage a foreign company has own its own local ones.

Perhaps the US government should force BMW to open up their software so independent shops can do things that are only possible by dealers.

BMW enjoys the ability to keep certain components of their vehicles (security related ones) locked down. Yet the German government says Apple should open up their security related components.

How hypocritical.

 

[Si Vis Pacem]

„Not all merchants support Apple Pay“ :

Yes, they do.

Every NFC-enabled POS can handle Apple Pay UNLESS it is disabled by choice.

EU dislikes not being able to track your purchases -> taxes

 

[Plutonius]

This may be a play for them to force Apple to open a backdoor

That's what I was thinking.

Could this be the first step towards requiring Apple to have a backdoor ?

 

[gaximus]

Why would anyone want to use anything other than apple apps.
[automerge]1573837207[/automerge]
Apple isn't as good at security as google. Android phones can handle google pay and Samsung pay at the same time.

You could say Apple is better at security than Google because it doesn't support multiple pay methods. A building with fewer doors is easier to secure.

Also only Samsung phones support Samsung pay, not Android phones.

 

[Khedron]

I think you're confusing the secure enclave and NFC. NFC has been opened. The secure enclave has not (to my knowledge).

Try reading the article, or at least the headline.

 

[nightflight82]

I really don't think you understand how that works.



That is tokenization. it keeps the purchase information on-device so that not only does the merchant and apple not know your banking information (just a binary validation from the bank) but if someone gets your device, they couldn't pull info out of it. Advances like that cost to develop and apple isn't actually charging you to use it so I don't know what you mean about Apple charging for it — it isn't.



you really don't know what it is or how it works — it has nothing to do with that at all. Tokenization just means that account info and merchant details are done in such a way that no information can be tied to you and can be kept private from everyone but you and your bank. Are you saying you gain no benefit from a merchant or third party being blocked from your account information?

first of all apple is charging the banks for every transaction u make with apple pay a small fee but a fee.
and 2nd of all if it comes to opening NFC chip for the sake of merchant knowing my bank or apple for that matter I d be ok with that....hey amazon and paypal already know most of my purchases....I was using normal tap n go credit card for ages and I still do...dont see a problem with that...

 

[Adysubman]

Next:
- Pass a law to force Coca Cola to open their secret formula to other manufacturers.
- Pass a law to force Apple to allow macOS to run on PCs.
- Pass a law to force Apple to let users install Android on iPhones and iPads.

...are we going insane!?

Yep I don’t see the Germans rushing to force their car industry to unlock parts of their manufacturing processes or car management systems so Jaguar could put its infotainment system on a BMW.

The EU who love to randomly fine tech companies Billions to fill their coffers have been strangely silent... maybe it’s because they can’t overrule or disagree with Germany.

 

[justperry]

Here in the UK there was an issue recently with EU citizens who wished to apply to stay post Brexit and you had to use the NFC chip in your phone to scan your passport to apply. Problem was that you had to have an Android device or similar, no iPhone user was able to use the NFC to read something.

If Apple opened up the NFC chip on the iPhone, the options are endless for loads of different products and functionality.

Guess what, I just used my iPhone XS NFC chip to register my ID on DigiD in the Netherlands, on iOS 13.3b

 

[Metrosey]

So if it's anti-competitive that Apple locks down the chip, is it now anti-competitive that Intel/AMD are only allowed the x86 license, how IOS is only available on IPhones, how Google applications are automatically installed on an Android phone, etc? Honestly, the EU just needs a budget bump.

Edit - Oh, people have similar ideas ha. I didn't read the comments yet. Could you imagine if a group of technology businesses (large and many) got together and just said "no" to the EU.

 

[bbednarz]

Are there really people asking for this...? So much so that a government felt the need to get involved?

 

[Kabeyun]

iOS is next. Thanks.

 

[freedomlinux]

It's a NFC chip the customer paid for

What if Apple stops using the term "NFC" in the specification for iPhone/Apple Pay? In that case, customers would never be told that it is NFC-capable, hence have no standing to demand access to NFC features.

Not saying this is likely - just an interesting thought

 

[Metrosey]

I think it's nice that NFC will be opened up more but Apple was doing this anyway in a more efficient and better manner.

 

[x34]

so many silly comments in this thread. but great move by german government. about time!

 

[RickDEGH]

Dear Bundestag, i demand to be able to use my debit card from HypoVereinsBank to withdraw money from my citibank account.
also, how anticompetitive is that i can withdraw money from an ATM of a different bank only if i pay 5-10EUR extra fee?
no one wants to regulate that?

I’ve learned hard lessons never to withdraw from any ATM apart from the ones from my bank. The charges are ridiculous. Then again, I’m trying Apple Pay as much as I can, even in the Backerei

 

[Websnapx2]

first of all apple is charging the banks for every transaction u make with apple pay a small fee but a fee.
and 2nd of all if it comes to opening NFC chip for the sake of merchant knowing my bank or apple for that matter I d be ok with that....hey amazon and paypal already know most of my purchases....I was using normal tap n go credit card for ages and I still do...dont see a problem with that...

But they aren't charging us — you said they charged us for the device and then for the service and they are not. Banks get charged a processing fee for CCs anyway so this is something they are used to — it's their cost for using an established system they don't need to maintain, no different than Visa or MC.

Secondly — that's your choice to have your personal information open like that — not mine, that's why I use this service. If it behaved like what you are willing to accept I wouldn't be using it. I don't use PayPal and Amazon only know my Amazon purchases (if I didn't want that I wouldn't be using them either) however Amazon doesn't need to know what and where I had lunch, what I did at a brick and mortar store, or my account information. I should have the right to keep that private and Apple is providing that. If you would prefer weaker service, use something else — however, just because you accept a low bar doesn't mean everyone else needs to be dragged down too. You have a choice — you can not use it.

 

[chucker23n1]

I heard people in Germany prefer using cash over credit/debit cards and certainly over Apple/Google/Samsung Pay. Is that true?

Yes and no.

Credit cards are nowhere near as popular in Germany as in some other countries.

Debit cards are quite widespread, though not the standard form of payment at, say, the restaurant. (But increasingly the standard form at the grocery store.)

PayPal is a thing.

And, quite unlike the US, we've basically abandoned checks a long time ago. Most bills just get withdrawn directly from the bank account (there's a process where each creditor gets their own unique token, so you can also revoke later on), or wired manually.

 

[RadioHedgeFund]

This is a good thing. Android shows that it can be implemented securely, and customers will probably get faster access to local payment providers and perhaps others such as transit cards (unbelievable that we still can't add Clipper cards to Apple Wallet even though we're in Apple's backyard).

According to the Finanz-Szene article there was apparently a lot of lobbying by German banks on one hand, and Apple on the other. Reportedly even the US ambassador to Germany got involved. Given that the EU received a lot of complaints about this, I wouldn't be surprised if there was EU-wide legislation at some point.

Android Pay is terrible for security because all you need to do is turn the phone on to use it: it has no biometric requirements and thus if your phone gets stolen anyone can still make payments on your card whilst you try to find a branch or pay phone to cancel your cards. To get around this banks require you to make a PIN purchase once and while with your card which defeats the point of phone payments because you then need to take your wallet with you!

Samsung pay at the very least requires biometric authentication but isnt supported by any major banks.

Apple Pay is by far the most secure way of paying for anything and the way it works with wallet is seamless and unmatched on Android. The recent tap-to-pass for transit cards is a fantastic add-on and the implementation with Apple Watch is also really good.

And Apple Watch is still more secure because it requires the Watch to be on your wrist so if that gets nicked it is locked by your pass code.

 

[Metrosey]

so many silly comments in this thread. but great move by german government. about time!

Yes, a so called nice move? Now, let's start forcing businesses to do other things now. Next we need to force Google to remove any Google applications that are installed by default on their Pixel phone or Android phones. After that, remove Microsoft Edge from Windows, as that's anti-competitive, after that, SAP could be considered anti-competitive too. Also what about the default camera application on phones, that's anti-competitive. Every single default application installed where an alternative is available on the application store could be considered anti-competitive. I guess Germany/EU better get busy, I'm sure there's several trillion they can make which should boost Germany's economy.

 

[PugMaster]

You know, most people here in Germany do indeed prefer cash. And for those who don't (like me), Apple Pay is extremely limited and mostly works with credit cards only. It doesn't even allow PayPal.
And who tf pays for groceries with their credit cards? I never head from anyone here besides Tourists pay with their credit cards for groceries or gasoline.
If we use electronic payments, we expect it to be withdrawn from our bank accounts the next day, not accumulate on a credit card waiting to be paid next month with fees.
With my android device however, I can use Google Pay or Paypal with NFC and choose where they payment comes from.... girocard, credit card, paypal credit...
Some banks do promise to introduce Apple Pay in 2020, but until then, let's see. And even though iPhones are quite popular here in Germany, Apple Pay is not interesting to most because it's so limited here.