From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking.
I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.
It’s already easy enough now however it doesn’t work in reality.
It doesn’t scale due to limits.
And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business.
Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred.
They can also be used to buy physical goods which can then be resold.
Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable.
If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila.
The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
Comments
From a user's point of view this seems great. No need to wait for congested LTE to download an app in order to pay for a scooter or parking.
I'm curious about the security implications of this though. Seems like it would be easy to make a NFC sticker "skimmer" that you sticker over the official sticker.
It’s already easy enough now however it doesn’t work in reality.
It doesn’t scale due to limits.
And it doesn’t work as easily as credit cards as you will have to go trough the Apple Pay merchant KYC process for these to be billable which means you will have to verify your business.
Credit card skimming works because the stolen details can be used anywhere in the world and the cash is pretty much immediately transferred.
They can also be used to buy physical goods which can then be resold.
You can’t do the same with NFC tags.
I assume will only work with approved partners not with any nfc sticker.
When the universe of approved partners is large enough, the security considerations will be non-trivial.
Not really because the Apple Pay KYC process as well as the restrictions that can be put into place would make this attack non viable.
If I skim your card in Chicago I can bill $2000 in a “coffee place” in Manila.
The same doesn’t work with NFC tags which not only can and likely will be geofenced but there’s no details to skim and the payment goes through Apple Pay not the credit card network which anyone can access.
Apple Pay is not giving away any shared secrets over the air that are useful to steal.
I think the attack would be to place a sticker that causes unsuspecting users to pay you instead of the intended merchant.
Which doesn’t work because you’ll have to pass Apple KYC’s process, and it doesn’t scale since the NFC payment is much more limited than your credit card limit.
My best guess is that you'll have to pay and register with Apple to create NFC tags which will be attached to the payment.
Essentially as soon as somebody reports you to Apple your account will be burned.
Of course, it's up to Apple to implement and administrate it, they are generally pretty sensible about this kind of stuff.
You still have to double-tap the device hardware button in a manner that software cannot emulate to accept the NFC attempt.
You’d think if it was that important they have accepted visa by now then.
But I agree this is nice. convenient.