Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Am I the only one that feels that this will impede the adoption of NFC-style payments?


You're probably not the only who feels that way but it's as likely that this could speed it up. NFC is just a fancy way to communicate a number which is the easiest part of a credit card transaction. Square will be well-positioned to serve the long tail when/if NFC gains traction.


I watched a documentary showing how hackers can get your CC number (and basic info I think) simply by using an NFC enabled device and standing next to someone with such credit card. I think the Square method is safer, for now.


You watched a documentary?

I come to HN for expertise because there are so many knowledgeable people that know a great deal about things in which I'm interested, but am only a beginner. I've come to expect expertise on this site in almost any category. As such, my only expertise is payment processing and mag stripe/ smart card/ contactless (NFC), both the technology and the business.

In short, your documentary was incorrect, and considering the technical nature of this site, this topic needs more color.

NFC is a very low-level protocol, security is determined by the overlaying pieces. Two of the most prominent security implementations (FeliCa by Sony, and MiFare by NXP semi) operate by "security by obscurity." The contactless national passports support FIPS 140 security (based on PKI). This is the best security you can get, As long as the developer has access to the secure element on the device, it should be straightforward how to implement good security. Think of it as SSL, but the issue is doing it well with a data rate so low (424kbps, typically, with 848kbps at most).

NFC technology has been at a stand still for 3+ years because everyone is fighting over who has control. The carriers aren't going to sell phones with their secure NFC elements "open." The carriers will extract some revenue from phone payment transaction unless someone makes a nice NFC "phone sled."


It is possible to be an expert on payment processing without being rude and obnoxious.

If you don't like what you find on this or any other web site, no one is forcing you to visit.


Maybe I'm old, but 424kbps does not seem like a low data rate, particularly for a passively powered RF device.


And your expertise gives you the confidence to make a statement about the fallacy of a documentary you haven't watched? I can only say "Ok".

Edit: Here is what someone who watched it and is "also" an industry expert like you has to say http://abcnews.go.com/2020/story?id=2129328&page=1




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: