Comment by oneJob | Hacker News Reader

Comment by oneJob | Hacker News Reader

All these "Company"Pay systems are horrible for the consumer. Sure they may give a particular consumer a particular benefit at a particular point in time, but on balance they are the Facebook of currencies.

One of PayPal's initial strategies was to maximize transactions for which both the payer and payee were PayPal customers. This decreased PayPal's operating costs and reduced fraud by a large amount. Sounds like everyone wins, right?

That's simply not what currency is. Currency is an transferable i.o.u. worth whatever the creditor says it's worth. The most pervasive currency is currently the greenback. Every additional party or layer between you and the U.S. government increases credit risk and transaction costs everytime you make a transaction outside the pay network your currency is held in.

Visa is so convenient because they try to be everywhere, because that's their business. Apple is not a payment network. Walmart is not a payment network. Walmart Pay is simple one part of Walmart's portfolio. Since it's not their core product, they will by necessity make compromises that negatively affect their Walmart Pay from time to time in order to benefit some other part of their business. Look to GE Capital for a case study of what can go wrong there.

Just as Facebook is a walled garden for communities, these pay networks are walled gardens for currencies. Some are actually really great, just as Facebook is actually a really great community site. But at the end of the day it's not your garden. With other options such as Visa or cash, I find it difficult to justify turning over yet another critical apect of my daily life to a profit driven corporation according to the limiting and onerous terms and conditions they set.

Phew. Now I can go back to watching Wes Craven's "Shocker".

Apple Pay is just a nice frontend for Visa, AmEx, etc., with better security - disposable credit card numbers to defeat merchant tracking and leaks.

Also faster.

Double-tap watch or iPhone button, wave device near register, done. Fast.

That vs Walmart Pay tap iPhone button, [swipe to find icon,] tap icon, wait for app, tap scan button, position camera for QR code, wait for focus & recognize, done. Too long.

I tried Walmart's Scan-and-Go app. Idea was you could scan all your stuff before reaching the register, scan one QR code, pay, and leave. Took an inordinately long time. Walmart dumped it.

Edit: actually there has been a "tap to pay" available at many places. All too often it was turned off, and mildly confusing which cards had it (I had one that did, then its replacement card didn't, so there I was waving a non-tap card at a tap reader). The whole tech fizzled.

My AmEx card has had tap-to-pay functionality for years now. I keep it in my wallet where it is nearest the outside and can use without removing from my wallet. Easy. No buttons. No QR codes. And it's old tech. Still not seeing the obvious argument for throwing such an important piece of my public persona (personal finances and credit) into the same basket as my cell phone.

> Still not seeing the obvious argument for throwing such an important piece of my public persona (personal finances and credit) into the same basket as my cell phone.

Having it as part of your cell phone makes it much more secure (Apple Pay requires your fingerprint for it to work).

Contactless cards can get skimmed:

http://www.theguardian.com/money/2015/jul/23/contactless-car...

Your cell phone's data is protected by a fingerprint reader or arbitrary-length passcode, while your wallet's data is protected by the other person not having a knife.

Your wallet is protected by the other person not having a knife. Your cell phone's data is protected by the other person not being willing to use their knife to cut off one of your fingers. ;-)

Muggers are still stealing iOS devices, which people can just permanently brick via iCloud now, so I wouldn't expect that level of foresight!

Parts are parts and iOS devices have a lot of non-commodity parts that can't get "bricked".

I was under the impression we don't have international blacklisting, so there's still money to be made shipping handsets abroad?

Nope. TouchID doesn't work with a dead finger. Has to be alive.

http://www.engadget.com/2013/09/16/why-a-disembodied-finger-...

I wasn't really being serious. But in practice such liveness sensors are incredibly easy to defeat.

Can you prove that for TouchID specifically? You have to defeat both capacitance and RF sensors, btw. And remember, it needs to be "incredibly easy" by the standards of random unhinged violent criminals stupid enough to commit two felonies in order to secure a phone which will be completely useless within the 60 seconds or so it takes the victim to sign in with his Apple ID and brick the phone. Any bank accounts present on the device would also be nearly-instantly disabled.

By the time you defeat TouchID, the device will be useless anyway. It's more than secure enough.

https://blog.lookout.com/blog/2014/09/23/iphone-6-touchid-ha...

To be fair, if I've just lost a finger, it will take me considerably longer than 60 seconds to disable the phone.

Except for when it works with glue

http://arstechnica.com/apple/2013/09/chaos-computer-club-hac...

careful doing that, i know someone who had 2 cards with nfc and was getting charged double - surprised the system somehow allowed it

Edit: actually there has been a "tap to pay" available at many places. ... I had one that did, then its replacement card didn't, so there I was waving a non-tap card at a tap reader. The whole tech fizzled.

Argh. I had the same thing happen. Just after getting used to using the tap-to-pay card, my bank replaced it with a "dumb" card and I was back to swiping it.

Apple blocks 3rd party apps from using NFC. It's literally only usable in Apple Pay. Walmart can't implement it in an iOS app even if they wanted to.

What would implementing it in an iOS app even mean? If Walmart wants to support Apple Pay, they just need to use credit card terminals that can do NFC. Is the idea that if Walmart could implement it in their app, they could allow you to pay with some custom Walmart account instead of a credit card?

The point of companies having their own service like this, is so that the kickback to the charge company goes to them instead.

So instead of 1% of all mobile purchases going to Apple, it goes to walmart instead. With the scale of business Walmart had that can be upwards of a billion dollars a year.

Tesco in the UK have Scan-as-you-Shop, which sounds similar to your Scan-and-Go, the prime difference would be that you are given a dedicated device for doing the scanning rather than requiring you phone.

I've used this regularly for the past few months and had no real issues with it.

"Apple (AAPL, Tech30) gets just 15 cents for every $100 in Apple Pay transactions, according to Gillis."[1]

In addition to the minor surcharge, there is the (opportunity) cost of Apple's hardware, the costs to vendors of supporting (yet) another platform, the consumer provides value to Apple in the form of consumer information, the consumer now has their fingerprint tied to payments, and then there is everything that goes along with the terms and conditions. Regarding the security, I'm not sure what the details are, but it seems that the attack surface is increased substantially. I'd personally prefer to have Visa, AmEx, etc reviewing and resolving fraud and other claims, seeing as how they've been doing it for decades and their bottom line depends on it, whereas Apple is relatively new to the game and Apple's bottom line does not depend on it.

Apple Pay might be awesome. Idk. But it's not "just a nice frontend for Visa, AmEx, etc., with better security".

[1]http://money.cnn.com/2015/01/26/technology/apple-pay/

You are very misinformed about Apple Pay, and the poster you are replying to is correct. CC networks pay the Apple Pay surcharge, not customers or vendors. To vendors, Apple Pay looks like a regular NFC transaction, except with a one-time card number, so there is no danger of the kind of hacks that happened to Target, Home Depot, and many other retailers. Apple has nothing at all to do with "reviewing and resolving fraud and other claims." The CC networks still do this.

When I buy a burrito and then look at a receipt (as I always do after buying a burrito) I do not see the visa surcharge, or any others. I see tax but that's it. At the end of the day, the consumer pays, because there is no free lunch, there are no free burritos.

I may have made an incorrect assumption regarding claims handling, though I'm not sure how that translates me to being "very misinformed".

I wasn't speaking only from the vendor perspective (idk what it looks like to them) or the Apple Pay customer's perspective (I'm not one of their customers) but I highly doubt it's worth my time to research to confirm that adding Apple Pay into the mix does not somehow increase the attack surface or how it does not somehow increase the amount of my personal information that is with Apple.

Nearly everything in your original comment is wrong. You say there's a "minor surcharge" but the cost to the vendor is the same as any other credit card. You mention the cost of supporting yet another platform, but the platform is just NFC, there's nothing special needed to support Apple Pay specifically. You say the consumer has their fingerprint tied to payments, but the fingerprint data never leaves the device. You say the attack surface is increased substantially, but Apple Pay is much more secure than using a credit card directly. (Not that consumers need to care, since fraud protection is 100%.) You imply that credit card companies aren't involved in resolving fraudulent Apple Pay transactions, but they are. You close by saying that Apple Pay isn't just a nice frontend for the card companies with better security, but that's precisely what it is.

I personally think this can rightly be described as "very misinformed."

>> there's nothing special needed to support Apple Pay specifically.

Yes, there is. NFC enabled terminals may be the norm at major chain stores but they do not have widespread adoption in smaller retail outlets.

The merchant pays for those terminals and they are not inexpensive. Sometimes $1000 or more. That tradeoff (making it slightly easier for you to pay) just isn't worth it to most merchants right now. As EMV adoption grows and merchants have to update their terminals to support that as well, NFC will grow.

Also, it may seem as if ApplePay is more secure for the banks as it prevents issues with data breaches but to date, it has not prevented any, will continue to only lessen the impact and is absolutely wrought with card fraud as there isn't any validation that you own the card you are loading into ApplePay. Once it's loaded it isn't checked by the merchant (if the merchant even pays attention these days) and is implicitly trusted by the network.

It took the UK a few years since contactless cards were launched around 2010. Everyone already had chip+pin terminals, and at first it was mostly coffee shops in London, but now many merchants have upgraded to contactless ones. It's not just national chains, but local shops too. It's much faster paying by contactless in a busy pub than paying cash.

It's possible there's pressure/support from Visa and MasterCard for small, local retailers to accept contactless payments. It's part of their advertising that you can buy a newspaper using the system, and most newsagents are local, independent shops.

A basic chip+pin (not contactless) terminal is available for £100 (or £3/month), I can't find a price for a contactless one.

The key word there is "specifically." Apple Pay may require technology that isn't 100% deployed, but it is a generic and standardized technology that long predates Apple Pay, not some new Apple-only technology that the boys in Cupertino came up with and foisted on the world.

I don't understand your security point at all. It hasn't prevented any breaches? How do you know? It doesn't validate cards you enter into Apple Pay? If you possess the card (or can make one from having possession of the card data) then you can already use it fraudulently, loading it into an iPhone is just an extra unnecessary step for the thief. The security advantage is that malicious terminals can't steal card data, and stealing your method of payment doesn't confer the ability to pay. It's not perfect by any means (and again, not something us consumers need to even care about), merely better than a regular plastic card.

> the consumer now has their fingerprint tied to payments

FUD. This is not how Touch ID works. Fingerprint data, which is not a fingerprint image to begin with, more of a hash, is stored on the iPhone's A_ chip itself. It cannot leave the device, ever.

Other posters have addressed the remainder of your incorrect claims.

I was not under the impression that Apple Pay users have an imprint of their finger print next to the transaction information and time and date stamp somewhere. That would be ridiculous. If the user validates a transaction using their fingerprint, somewhere it probably say something along the lines of "verified with user's fingerprint, which is not stored here." This creates what we call, linkages. It's not all in one place. That would, again, be ridiculous. But, the more linkages you have the better picture you can draw.

If you authorize your transactions with a PIN or a signature you're doing the same thing, but in a much less secure manner.

Indeed, and *Pay / CurrentC / Venmo / Square Cash / Dwolla are all just nice frontends for ACH.

I think this is a common misperception regarding Apple Pay - it actually does not use disposable credit card numbers. Apple Pay generates a Device Account Number (DAN) once when you add a card to your phone's wallet. Thereafter, the same DAN is reused on that device for all transactions with that card.

So it actually does not do much to defeat merchant tracking, assuming you consistently use Apple Pay where it is available.

> That's simply not what currency is. Currency is an transferable i.o.u. worth whatever the creditor says it's worth. The most pervasive currency is currently the greenback. Every additional party or layer between you and the U.S. government increases credit risk and transaction costs everytime you make a transaction outside the pay network your currency is held in.

The root problem with traditional currency is all the trust required to make it work. -- Not that justified trust is a bad thing, but trust makes systems brittle, opaque, and costly to operate. Trust failures result in systemic collapses, trust curation creates inequality and monopoly lock-in, and naturally arising trust choke-points can be abused to deny access to due process. Through the use of cryptographic proof and decentralized networks there is a way to minimize and replace these trust costs.

(Just something that's been floating around in my head lately... Carry on.)

The cryptographic proof strictly verifies whether or not the currency is authentic or counterfeit. There is no implicit value in the proof. In fact, there is a cost to calculating the proof.

The value is in the willingness of the person holding the i.o.u. to honor that i.o.u.

A "perfect" cryptocurrency provides two of the three requirements of currency (a means of transferring value, and a unit of measurement of that value) but it does not (as no tangible or conceptual thing ever will) provide intrinsic value for the exchange. Value is subjective. Gold is useful today, not so much tomorrow. Gunpowder is useful to you, but not so much to me. Given that it has been debunked that currency arose out of trade and barter (i.e. currency with intrinsic value has replaced items with trade specific value so as to be more fungible), well, where is the value then?

Trust is the value. You trust you can, once your currency is verified, exchange it for something you value from someone. If that person does not trust that the currency you are offering will be able to be tendered elsewhere,,, then no exchange, because the currency is of no value to them.

What if everyone stops using U.S. dollar bills tomorrow? Does my bank account morph into some other value that I can use? Is it tied up in some vault of gold at the US Treasury? No. It becomes a worthless number on a register somewhere. But, the bartender at my local watering hole might vouch for me that I had that much or that I made that much money or that my credit was good. Trust = Credit

Without trust there is only trade and barter. Without the ability to trust that the future will have value in it, I'm only going to go with what is right in front of me right now. And a proof, it's interesting (I loves me some math), but, most of the time, I'm not going to say it has some sort of intrinsic worth that I'd trade, say, you a burrito for it.

I disagree. Trust is what makes systems efficient and effective. People who trust each other can cooperate together without expending resources on protecting themselves.

Consider Bitcoin - the cost of that trustless system that barely works is mind-boggling waste of electricity. Or look at layers and layers of bureaucracy people create; a lot of it exists to mitigate the problems of lack of trust by creating a system that doesn't depend on actors to be benevolent.

It's true that systems based on trust are fragile - malicious actors can abuse them, and if there are enough of them, the public trust will collapse and the system will go to hell. But that's only an argument for why should we fight for ensuring trust. Why we should punish defectors - the liars, the cheaters, the abusers. Because we need this to be efficient.

> People who trust each other can cooperate together without expending resources on protecting themselves.

This is not how security works. You need to consider the adversarial case, not the average case.

> Consider Bitcoin - the cost of that trustless system that barely works is mind-boggling waste of electricity

The "waste" is actually for the purpose of putting a floor on the cost to trick someone into believing a non-consensus history.

The problem with your argument is that "Company"Pay services are not gardens but conduits. You keep your money in the "garden" of your actual bank account and can extract it with whatever proprietary system you wish, because at the end of the day they're all just wrappers around the ACH network kept open by the federal government. There's no lock in when you can use all the proprietary systems at the same time with no negative effects.

I have a debit card, credit card, Venmo, Square Cash, and a checkbook and I use them all concurrently as I please, because at the end of the day they all interface over ACH with my credit union.

Reply on news.ycombinator.com