Hacker News Reader

Comment by sschueller | Hacker News Reader

The EU should force apple to open NFC to all. The only reason we have these stupid slow bluetooth adhoc payment systems here is because apple refuses to let anyone other than their own apple pay use NFC.

I can use my android phone to pay via NFC directly from my bank account (no android pay, no third party or extra fees.). Why can't apple?

View on HN

It is also hurting the adoption of proper 2FA in the form of FIDO U2F/WebAuthn. With Apple phones and tablets there is no normal USB port (A or the newer C), and forcing vendors to include a Bluetooth option in their security keys drives up the cost.

It's downright silly to deny the owners of the hardware to use it.

Apple Pay is secure, does not expose your details and is integrated with the banks in the bank end.

The last thing you want is to have a plethora of insecure adhock hacked together contactless payment systems.

thats not the problem here. Developers like me dont want to access apple pay but NFC.

Lets say you distribute nfc stickers to local store, and when someone swipes their iphone on it, it should wake up my app and fetch the production information. Such ideas wont work with apples NFC limitation. They require you to first open the app, then swipe.

Many innovation ideas are hampered by Apples behaviour. Its not about security, its about Apple pays rollout and adoption

You are moving the goalposts. You can read NFC tags on iOS devices without a problem, I don’t want an NFC signal being able to initiate any action on my device, you shouldn’t want that either.

For mission specific implementations e.g. inventory checking or shopping costumers can have the app active it’s much less of an inconvenience and a security risk than being able to wake up apps and communicate with them without the user being aware of such activity.

While you can argue that many innovative ideas are hampered by Apple this isn’t one of them they are in the right on this issue and many other security related issues.

I don’t want an NFC signal being able to initiate any action on my device

Isn't that exactly what happens with Apple Pay?

No, you have to initiate payment from the device (phone/watch).

You only need to approve it, however it’s not the equivalent I trust Apple much more than any random 3rd party vendor. Heck as far as security goes I trust them more than my bank.

I'm not sure why you're disagreeing with the parent commenter. On my phone, I can wave my phone around the reader as much as I want, but until I double-click the side button, Apple Pay will not be engaged. I must then also authenticate, but there are no circumstances I'm aware of under which terminals can prompt Apple Pay to start. Which I believe is as it should be.

Something is odd with the phone or reader because all contactless payment readers in the UK activate Apple Pay on mine. As in I don’t need to double click I even have that option disabled it will prompt the wallet auth even if the phone is locked.

>They require you to first open the app, then swipe.

I really wouldn’t want to allow anyone with an NFC chip to be able to open apps on my phone. Which app gets used for what should be under the user’s direction, not the store’s or the developer’s. Habituation users into trusting any random kiosk to put data on their phone without input from them is terrible practice.

I wouldn't want your app on my phone if you insist it forces my phone to do things when in proximity to your tags. Talk about user hostile—it's my device, not yours.

If you don't like Apple's product design philosophy, that's fine. There is plenty of healthy competition in the smartphone market. I for one am glad there is a product like the iPhone which doesn't implement NFC as an anarchistic free-for-all.

Your file browser also "forces your phone to do things" depending on the file format, using whatever default application to open the file.

It's the same with NFC tags, and you can easily stop that by turning NFC off.

All of the files on my phone are there because I chose to put those files there. I choose which files I tap on. And I choose when I tap on them.

I don't choose where you stick your NFC tags.

You do choose when to turn NFC on, when to unlock your phone, and where to tap it.

Remember it's NFC, not WiFi we're talking about, you need to get your phone within less than half an inch from the tag for it to work.

If your expect me to unlock the phone and "turn NFC on" before scanning a tag then great, Apple supports that mode of operation today. What's the problem?

> we have these stupid slow bluetooth adhoc payment systems

Sounds like they already have a plethora of insecure adhoc hacked together contactless payment systems, just even worse than if Apple allowed third-party NFC

No we don’t because those are not allowed on iOS devices, if you want to use payments you need to integrate with Apple Pay.

Apple Pay even supports travel passes these days any use of NFC for payment authorization is supported in currently the most secure implementation we have with high assurance for privacy.

> if you want to use payments you need to integrate with Apple Pay

I dunno about that, I spent last month paying at retail for drinks, groceries, etc by scanning QR codes using https://itunes.apple.com/us/app/swish-payments/id563204724?m...

Yeah you do, they may not be insecure but they are "hacks" like Twint [1] which uses bluetooth and qrcodes to process payments:

[1] https://www.twint.ch/en/

Isn't that what the Store review process is supposed to prevent?

The store review process can only achieve so much, it also has no control over the backend.

Apple Pay is fully integrated with the banks and issuers you get a notification form your bank when you add a card and you can revoke it without going through Apple if your phone is lost.

You also are assured that your card details are never exposed because Apple does not use the PAN for billing, and it also does not expose your billing/shipping information without your acknowledgment and consent when used to purchase items on Apple Pay enabled services.

You mean https://developer.apple.com/documentation/corenfc?

That's limited to NFC tags. You can't do proper card emulation for payment terminals with that.

to be frank that corenfc has limitations which i think the threadstarter is complaining about. Namely it doesnt work if the app is not in foreground. Only Apple Pay can use corenfc when phone screen is off or the app is not running in foreground.

Does it use it in the background, though? I've always double-tapped the power button to open Apple Pay before trying to read the phone. Likewise, when I had an S7 Edge, I opened Google Pay before attempting.

Yes. On both iOS and Android, the wallet should open on its own when the phone detects a payment terminal. You don't have to double-tap the power button.

In my experience, this is definitely not the case. Multiple terminals at multiple stores have not activated Apple Pay on my iPhone X. I've always had to double-tap the button.

Here in South Africa we've had NFC payments (Android only) for our phones. I use it every day!

Apple needs to come to the party

Reply on news.ycombinator.com