Hacker News Reader

Comment by c0g | Hacker News Reader

That's what apple claims[1]:

"Providing simple access to the NFC antenna by banking applications would fundamentally diminish the high level of security Apple aims to have on our devices"

[1] http://fortune.com/2016/08/11/apple-pay-tech-banks-security/

View on HN

I do not understand what the attack vector here would be. Can someone elaborate?

You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID.

Or (and this seems REALLY probable) people make apps to 'help' you pay or track you spending and pay/etc. But they now have very sensitive banking data so that's insecure.

How about CurrenC or Walmart or some other company makes their own NFC payment thing on a different standard that isn't compatible with standard terminals. Now anyone who uses that new payment system is vulnerable to any bugs in that implementation as opposed to a very well tested system like the current NFC stuff (which I'm sure has shortcomings, but at least is well understood).

> You could make an app that pretends to be a payment terminal so you hold your phone near someone else's and trick them into paying you as they try to unlock their phone with TouchID.

So? You can already do that. You can put an NFC shell around your phone which connects with bluetooth and that is being done already. You can touch an Android phone or anything else. Same story.

You can't do that because you have to buy extra hardware. All of a sudden everything you need would be built in. That makes it WAY more practical of an attack. All of a sudden ANY phone can be used.

Reply on news.ycombinator.com