Germany Passes Law Forcing Apple to Open Up iPhone's NFC Chip to Apple Pay Rivals, But Loophole May Exist

[vladi]

Perhaps the US government should force BMW to open up their software so independent shops can do things that are only possible by dealers.

BMW enjoys the ability to keep certain components of their vehicles (security related ones) locked down. Yet the German government says Apple should open up their security related components.

How hypocritical.

1. You can buy official BMW equipment both new or used and access all the features dealers can access.

2. You can buy for less unofficial equipment and access some or most of the features using guess what third party Windows software

3. BMW doesn't charge you interest everytime you use it's ECU services

4. ECU unlocking is equal to jailbreaking not to letting 3rd party apps access on board hardware like infotainment for Apple CarPlay

5. NFC poises security threat as much as Bluetooth. Claiming that allowing others to access NFC is security threat is equal to saying that you cannot use non Apple Bluetooth device to pair with iPhone or even better you need Apple wireless router to connect your iPhone to WiFi cause it's a potential security threat.

 

[spazzcat]

You know, NFC has other uses than just payment.

And Apple has open NFC for other uses.

 

[cocky jeremy]

Freedom of choice is great, even if Apple Pay is the best choice right now. It creates competition and drives innovation.

You shouldn't be able to complete with someone using their own technology. Make your own and survive off of that.

 

[Websnapx2]

You know, most people here in Germany do indeed prefer cash. And for those who don't (like me), Apple Pay is extremely limited and mostly works with credit cards only. It doesn't even allow PayPal.
And who tf pays for groceries with their credit cards? I never head from anyone here besides Tourists pay with their credit cards for groceries or gasoline.
If we use electronic payments, we expect it to be withdrawn from our bank accounts the next day, not accumulate on a credit card waiting to be paid next month with fees.
With my android device however, I can use Google Pay or Paypal with NFC and choose where they payment comes from.... girocard, credit card, paypal credit...
Some banks do promise to introduce Apple Pay in 2020, but until then, let's see. And even though iPhones are quite popular here in Germany, Apple Pay is not interesting to most because it's so limited here.

Here in Canada, I am able to use my Debit card, not just CCs. The limitations are actually set by the banks issuing the cards. You have a valid point with PayPal. I don't know why it's not supported but Apple has Made PayPal a valid option for payment for it's own service. Maybe they couldn't come to an agreement on fees.

That I can honestly say I don't know.

 

[SDJim]

This is just silly. If you add a credit/debit card to Apple Pay today, the issuing bank can of course already track your purchases since they are processing the transactions. This is about the transaction fees that banks have to pay to Apple to be allowed onto Apple Pay, as well as the inability of alternative payment providers to be on iPhones.

I'm not that worried about the banks having the info. It's the retailers and their clients

- Be me
- Never buy anything from Nixon in my life
- Buy a Nixon watch two weeks ago online from ShopBop for my wife
- Get a Nixon catalog yesterday in the mail addressed to me
- Confirm that ShopBop definitely pads their margins by selling consumer data to manufacturers

Because they also processed my actual credit card number, instead of tokenized Apple Pay, they can sell my data to aggregate data companies and link me up by credit card number to all my other activities. This is the same reason Sign In With Apple hasn't taken off, and companies have instead not offered alternative login options (you just have to create an account with them), because they are making a lot of money off of selling your data, and if they can't get your email, it becomes much more difficult to make a simple connection. Phone numbers work pretty well, which is what rewards systems do, but a lot of services don't require that, so they miss out on a lot of my privacy.
[automerge]1573844934[/automerge]

If Apple opened up the NFC chip on the iPhone, the options are endless for loads of different products and functionality.

Already open.

 

[Rigby]

Android Pay is terrible for security because all you need to do is turn the phone on to use it: it has no biometric requirements and thus if your phone gets stolen anyone can still make payments on your card whilst you try to find a branch or pay phone to cancel your cards. To get around this banks require you to make a PIN purchase once and while with your card which defeats the point of phone payments because you then need to take your wallet with you!

It's no less secure than a contactless card. And it is actually possible to set up fingerprint authentication if the phone supports it.

Apple Pay is by far the most secure way of paying for anything and the way it works with wallet is seamless and unmatched on Android. The recent tap-to-pass for transit cards is a fantastic add-on and the implementation with Apple Watch is also really good.

Yes, but it requires transit providers to adopt Apple's specific approach of doing it, which is cost-prohibitive for many of them.
[automerge]1573845398[/automerge]

I'm not that worried about the banks having the info.

Well, you specifically mentioned banks in your post.

It's the retailers and their clients
- Be me
- Never buy anything from Nixon in my life
- Buy a Nixon watch two weeks ago online from ShopBop for my wife
- Get a Nixon catalog yesterday in the mail addressed to me
- Confirm that ShopBop definitely pads their margins by selling consumer data to manufacturers

Because they also processed my actual credit card number, instead of tokenized Apple Pay, they can sell my data to aggregate data companies and link me up by credit card number to all my other activities.

This has nothing to do with tokenization. First they can link your Apple Pay DAN to your activities just like the primary account number (it does not change between transactions). And if a retailer has a way to obtain personal information for the primary account number, they can also obtain it for the tokenized ones (which are managed by the issuing bank, not Apple). Apple Pay has a minor advantage over physical cards in that it doesn't transmit your name to the retailer's POS, but nothing keeps other payment providers from doing the same.

 

[itsmilo]

I heard people in Germany prefer using cash over credit/debit cards and certainly over Apple/Google/Samsung Pay. Is that true?

i am afraid so. Most people I know, who actually do have a credit card only have it for traveling abroad.

 

[PugMaster]

The limitations are actually set by the banks issuing the cards.

Yes, that's right, but since the introduction of Apple Pay in Germany around a year ago, not so much has happened in this regard. Many banks have sophisticated banking apps that also allow mobile payments and I guess most banks have just hoped they could use it on the iPhone/Apple Watch the same way as on Android. So people see that their banks/cards are not supported by apple pay and don't bother to look any further. NFC/contactless payments only started to get more popular in the last two years as many banks decided to put NFC on the debit cards. I think mobile payments will still take a good while to gain traction here. Also, another point is that people don't trust corporations as they trust their bank. There are a few very big and very established banks and many people are loyal clients because their parents and even grandparents were. So, before trusting a big company like apple with their money, they would prefer to pay with an app from "Sparkasse" or "Volksbank", because, well, these are their well trusted banks for years.

I guess this is how countries differ.... I went to Denmark a few weeks ago and you could even use paypal for ice cream on the beach. It will still take a looooooong time until this happens in Germany ;-)
[automerge]1573845771[/automerge]

Most people I know, who actually do have a credit card only have it for traveling abroad.

Or for online shopping outside of Germany....

 

[Rigby]

You know, most people here in Germany do indeed prefer cash. And for those who don't (like me), Apple Pay is extremely limited and mostly works with credit cards only. It doesn't even allow PayPal.
And who tf pays for groceries with their credit cards? I never head from anyone here besides Tourists pay with their credit cards for groceries or gasoline.
If we use electronic payments, we expect it to be withdrawn from our bank accounts the next day, not accumulate on a credit card waiting to be paid next month with fees.

You can also add debit cards to Apple Pay, which behave exactly like that. But the German phobia of credit cards is a bit irrational anyway. There are no fees if you pay your bill in full every month, and credit cards are actually safer precisely because they do not immediately withdraw money from your Girokonto and have generally stronger consumer protections.

 

[farewelwilliams]

I find it kind of humorous that my list of blocked users regularly chimes in with asinine comments like the one you responded to.

he does have some of the wackiest comments which is sometimes fun to respond to. so i haven't put him on my blocklist (yet). sometimes i think he's a bot.

 

[PugMaster]

No, most banks here don't have debit cards working with Apple Pay yet. I know Comdirekt does support debit cards but not many others do. Sparkasse did announce they plan to do so in 2020, but so far, only credit cards do work. And I don't think it's "phobia" of credit cards, we just like our debit cards more.

Here you can see the choice is still very limited:

Apple Pay

Mit Apple Pay zahlst du einfach in Geschäften, online und in Apps. Es ist sicher und privat. Setup und Nutzung sind ganz leicht. So bezahlt man heute.

www.apple.com

 

[Rogifan]

Who exactly forces you to install anything? Those who want to use alternative payment systems (for whatever reason) will do it. That's it.

You would be forced to if your bank or merchant decided not to use Apple Pay. I’m assuming if they want access to the NFC chip in the phone it’s so they don’t have to integrate with Apple Pay.

This is tricky.

On the one hand, giving Apple the exclusive authority (a quasi-monopoly) over NFC-based payments on an iPhone isn't great. What if you want to found a startup that has a better approach to payments, but also uses NFC? No-can-do on iPhones, which have enough market share that it essentially means no-can-do at all.

On the other hand:

• these "concerns" mostly don't come from independent watchdogs, but from competitors. Banks want a bigger slice of the pie. (See also, as the article mentions, Australia.) So their argument is at least biased.
• you may not want those third parties to have access to the data. Payment providers are increasingly notorious for abusing it. Apple, OTOH, has no financial interest in doing so, and to the contrary advertises on offering a privacy-friendly alternative.

I do think Apple (mostly) has the right intentions here.

Still, ultimately, Apple should probably stand down and just turn it into another "This app would like to use blah blah blah" warning.

I double tap the side button on my watch and hold it up to the pos terminal. In like 2 seconds the transaction goes through. What is a better approach than the standard contactless payment Apple Pay uses right now? If this is just about banks or merchants or whomever not wanting to give Apple a tiny sliver of the transaction what does that have to do with benefiting consumers? The price of goods are not more expensive because of Apple Pay and they’re not cheaper when using a different payment method.

 

[MacLawyer]

I don't know enough to say if this is good or bad. I will say that I think this is the first time I've heard where a government has ordered a company to share a trade secret. Without compensation? (Other than something like a patent found be of the FRAND variety.). I stand ready to be corrected by those more in the know.

 

[Rigby]

No, most banks here don't have debit cards working with Apple Pay yet. I know Comdirekt does support debit cards but not many others do.

The ING-Diba Visa debit card that I still have from when I lived in Germany works with Apple Pay too. I actually used it quite a bit when I was recently visiting.

And I don't think it's "phobia" of credit cards, we just like our debit cards more.

I think it's absolutely a phobia. Many Germans still equate credit cards with loan sharks or something. But when used responsibly, they have a lot of advantages.

 

[macfacts]

This is just going to lead to a mess of having to install 57 different apps to be able to pay at all the stores using NFC.

Why the fork can't these companies just get on board with Apple Pay? It's based on an open standard (Contactless payments) and is plenty secure. It's frustrating to need to install a bunch of different apps to pay for things.

Are you currently shopping at 57 different stores?

 

[Rogifan]

Better question, why would anyone be against having the option of using something other than Apple Pay?

And what would this option be giving you that Apple Pay doesn’t? Is there something you could do that you can’t do now with Apple Pay? Or is this just about someone else wanting to collect the pennies Apple gets per transaction?

 

[Solomani]

The future isn’t government micro-regulating the tech industry either.

Let's just wait and see. The next trend would be for the Government of Germany to demand and issue a law forcing Apple to share all of their IP, copyrights and patents to Samsung and the Chinese Communist Party.

 

[PugMaster]

The ING-Diba Visa debit card that I still have from when I lived in Germany works with Apple Pay too.

Yep, credit cards do work. I could use it with my Visa Card, but I - as the typical German - just prefer my debit card which doesn't work ;-)

I will say that I think this is the first time I've heard where a government has ordered a company to share a trade secret.

Why sharing a trade secret? It shouldn't be a problem to use the NFC chip with, f. e., PayPal or Google Pay app. It's not like apple needs to give away all their secret methods of their transactions. The NFC chip would "talk" to the payment app without having anything to do with Apple pay. If you want to keep on using Apple Pay, you can. But if you would rather pay with PayPal on your iPhone, wouldn't it be a good thing if you have the choice to do so? I mean, if you don't like Apple Maps, you can download Google Maps. If you don't like Safari, you can use Chrome. Apple pay will not suddenly become unsafe just because you can ALSO use another app for payments.
[automerge]1573847542[/automerge]

The next trend would be for the Government of Germany to demand and issue a law forcing Apple to share all of their IP, copyrights and patents to Samsung and the Chinese Communist Party.

Do you really thing this is an adequate comparison? 😑

 

[Rigby]

Yep, credit cards do work. I could use it with my Visa Card, but I - as the typical German - just prefer my debit card which doesn't work ;-)

The ING-Diba Visa card *is* a debit card. Just because a card says Visa doesn't mean it's a credit card.

 

[realtuner]

1. You can buy official BMW equipment both new or used and access all the features dealers can access.

2. You can buy for less unofficial equipment and access some or most of the features using guess what third party Windows software

3. BMW doesn't charge you interest everytime you use it's ECU services

4. ECU unlocking is equal to jailbreaking not to letting 3rd party apps access on board hardware like infotainment for Apple CarPlay

5. NFC poises security threat as much as Bluetooth. Claiming that allowing others to access NFC is security threat is equal to saying that you cannot use non Apple Bluetooth device to pair with iPhone or even better you need Apple wireless router to connect your iPhone to WiFi cause it's a potential security threat.

Not true.

Irrelevant.

Also irrelevant.

Again, irrelevant.

Wrong. NFC is integrated into the Secure Enclave on Apple devices. It’s not some “add-on“ component like a Bluetooth or WiFi chip.
[automerge]1573847807[/automerge]

Are there really people asking for this...? So much so that a government felt the need to get involved?

Nobody (consumers) is asking for this.

Banks are pushing for this because they want to maintain control of how customers do their banking.

 

[LorenK]

The NFC chip was not invented by Apple. All Apple did was put a lock on it and say "this hardware you paid for can only be used for the benefit of Apple's profit".

No, all Apple is saying is that the NFC chip on our product can only be used for purposes which Apple approves. If you don't like that, then you don't have to buy their product. There are all sorts of other payment products that are closed systems, so complaining about Apple doing what everyone else does is ludicrous.

 

[shplock]

Why would anyone want to use anything other than apple apps.
[automerge]1573837207[/automerge]
Apple isn't as good at security as google. Android phones can handle google pay and Samsung pay at the same time.

I would argue that it is the other way round. Google is lousy at security, they had to call a specialist security firm into sort out the overwhelming amount of apps on play store that are malware.
Apple have had no such issues.

 

[Khedron]

What if Apple stops using the term "NFC" in the specification for iPhone/Apple Pay? In that case, customers would never be told that it is NFC-capable, hence have no standing to demand access to NFC features.

Not saying this is likely - just an interesting thought

Apple doesn't care about misleading customers with specifications.

They advertise the HomePod as "Bluetooth 5.0". They don't say users are locked out of using it to stream music from non-Apple devices and it's only there to help with Apple-only setup.

HomePod

HomePod mini takes up no space yet delivers room-filling sound. HomePod is a breakthrough high-fidelity speaker. Both help you multitask with Siri.

www.apple.com

 

[LorenK]

Yep I don’t see the Germans rushing to force their car industry to unlock parts of their manufacturing processes or car management systems so Jaguar could put its infotainment system on a BMW.

The EU who love to randomly fine tech companies Billions to fill their coffers have been strangely silent... maybe it’s because they can’t overrule or disagree with Germany.

And we see how well Germany polices its companies, remember that Volkswagen faked its diesel pollution results for years. Yep, the Germans will make sure that Apple iPhones will remain secure.

 

[shplock]

Not true at all. The hardware can also be compromised. Look at Intel.

I think Apple should comply. Let consumers decide which payment solution they prefer. Just have a very strict API that must be implemented by developers to access NFC.

Sadly that can not be done without compromising the security of the Secure Enclave.
I do not see why Apple should create a product like Apple Pay and pay for it's development, advertising, upkeep and it's advancement only then to have to allow other pay wallets or Australian banks to get a free ride and make money without any effort or actually competing with a product of their own that is good enough.
It is akin to owning a restaurant and having to allow a rival to advertise their restaurant in yours and use your kitchen to create their dishes without paying you for it.