Hacker News Reader

> absolutely no information about who I just paid or how much I paid them.

That's unfortunately how the contactless payments protocol works. Chip cards don't have a display, so user-visible on-device payment confirmation was never a design goal.

There's been some attempts in introducing it (apparently with mixed/bad results, since it's not a thing anymore), but it's ultimately not possible: Since the final payment amount is often not known at the time you tap/dip/swipe your card, what you'd see on your phone would differ from what is ultimately charged.

Arguably, not showing an amount rather than an estimate that will usually be either way over or under the actual amount is better.

> Since the final payment amount is often not known at the time you tap/dip/swipe your card

As a foreigner, I have trouble understanding this.

How can the final amount of a transaction not be known when you are paying it? Is that one of the usual nonsensical shenanigans stores like to play with taxes in the USA?

One example is at the gas station I have to tap/swipe my card to activate the pump and then I get charged when I'm done.

Gas stations are an exception: They will usually pre-authorize a certain amount (usually some number that is not likely to be exceeded by reasonable gas tank sizes) and adjust downwards once the final amount is known.

This is different from having different amounts in the chip transaction and in the "actual" transaction amount fields.

This was annoying when gas prices were very high. We had a van with a massive tank and the pre-auth wasn't enough. We would hit the limit and need to drive to the next pump to continue.

At this gas station scenario, you have two transactions - the preauth, verified by the card, with a specific limit; and afterwards a transaction (not verified or even seen by the card) with the actual amount.

The former is something that the card/phone can show and verify, as that is the actual amount you're authorising, even if you don't "spend" all of it.

In some stores you can tap your card before the transaction is completed, once the receipt is 'closed' the payment terminal will receive the final amount and use the authorized session to complete the payment.

You can also simply wait for the receipt to be closed before tapping, then the terminal will show you the full amount.

I - for example - use the pre-transaction tapping when buying groceries, it means I can just walk out when the last item is scanned.

It is a security risk - an attacker may add some expensive item to the session - but I think I can take it, the terminal will still show the total at transaction close.

This is not related to taxes as far as I understand. I's just that for legacy magnetic stripe payments, there is no dynamic element to the transaction data, which in practice allows the customer to swipe while the cashier is still ringing up items.

Accordingly, this is what customers have become used to, and this assumption has been further baked into POS software.

Rather than forcing all POS vendors and customers to change this habit, the EMV standard was relaxed for the US (and a few other markets where this is common) to not necessarily include the final transaction amount in the payment data signed by the chip.

This used to be common with tips at restaurants. The would take your card to the back and swipe it, then come back with the receipt. The receipt had a box for a tip. When you left they would then charge the card for the total including the tip.

With chip cards restaurants now tend to bring the card machine to the table. This way you can enter the tip on the machine and complete the payment without the card leaving your hand. I don't know if this is because the machine is there anyways or because chip payments need to know the amount when the transaction is authorized.

The machine is just a fancy new toy, although it does have the added benefit of your card not leaving your control. It's still possible to put the tip in after your chip card has been read.

This is a different thing: The tip is usually reconciled only during payment capture time (which is a batch process and distinct from the authorization stage).

In some countries, the switch from signature to PIN has coincided with the introduction of chip cards, and given that the terminal needs to be brought to the customer anyway for those (or vice versa), it's just simpler for everyone involved to include the tip amount right there.

I have yet to be in a restaurant in the US where they bring the reader to the table. I wish they would, but I've never seen it (Minnesota, US, other places in the Midwest).

The ones here will do it if you want to pay via phone *Pay. Obviously not every restaurant has updated to that though, especially mom and pop joints. I usually leave the tip in cash anyway. Covid has put an end to my restaurant visits for a while though except the occasional outdoor place.

What? Every restaurant I go to still takes the chip card and uses it. If you want to pay via phone *Pay they'll bring out a wireless POS to finish the transaction, if they support phone pay at all.

These guys want instant feedback rather than checking a ledger later that day or night. This seems like paranoia to me after using *Pay for several years now. Ask for your receipt if you're nervous about it.

At least for the EMV standard the card definitely knows the transaction amount; it's one of the core fields of the transaction that's signed by the chip on the card iff it meets the restrictions configured in it.

Of course, the issuing bank may charge some extra fee on top afterwards, but the amount that the chip card sees and signs should be the exact same number that the POS system would print onto a receipt as the transaction amount.

That's exactly how a contactless debit/credit card would work. I'm fairly sure most (if not all) payment terminals would not have the capability to send your device the information. I use it, get a notification from the bank and from Google Pay usually instantaneously.

> But that's better than the experience I had with the app when I paid at a McDonald's recently. I was expecting a screen which said something like "You are about to pay $9.72 to McDonald's Corporation. CONTINUE/Cancel.

That's written on the payment terminal. Google Pay is just a standard NFC payment. You might be prompted if the payment is large depending of the legislation in your country but for small amount, it's fast on purpose.

The terminal is an untrusted device. It would be much more secure if the details could be printed on my device for my confirmation. (It could then sign them to approve the payment.)

Of course this isn't how the payment system was designed as it was designed for cheap, simple cards. The saving grace is that you can perform a chargeback if the transaction is wrong. Not as elegant, but is basically as effective at the end of the day.

>The terminal is an untrusted device.

Untrusted by who? You?

The terminal is a trusted device in the payment system, and in most cases is the only trusted device in the store involved in the payment chain.

It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.

You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available.

If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.

For sure. It is far more important for the phone payments to have widespread adoption than improving security. I don't blame them for that. However it would be cool if they could start adding security features. I can imagine that your use case could be solved by signing to token such as "Up to $500 in the next 6h" or something. You could be promoted on your phone and approve it.

In fact I would like the whole credit card system to be overhauled or replaced with a different system that gives consumers much more control over the access they give companies. Sure, some companies like online stores I might give full access like I do today as I plan to make many future purchases with different values, but I can also see a lot of uses for more restricted access like fixed monthly subscriptions and one time fixed-cost payments that don't give them access to charge me later.

Certainly, I imagine it's a product decision weighing security and convenience.

How do you pay for things when not using the phone system (which you explicitly refuse to use)? I'm curious what system of electronic payment you believe is trustworthy if the payment terminal is not.

I do use it. All I am saying is that you can't trust anything the terminal tells you. The only way to be sure what you paid is checking the statements at the end of the month and requesting chargebacks if anything isn't correct.

If it's fake or modified, it will not have the ability to communicate with the payment network and process the transaction.

Wait till you see what happens when you swipe, insert or tap a credit/debit card.

Erm... your contactless debit card doesn't show information either. The information is on the POS terminal.

Hoping one is talking to that terminal and it's not manipulated to show wrong information. (The later is quite unlikely at a larger store as it would lead to too many complaints, but still nothing I can ; even the first one could be noticed by them not receiving money, thus other payment could be noticed and reverted - eventually)

Contactless debit cards can be skimmed without being authd too; does that mean we should make the app not bother to get your finger print and just have nfc on all the time?

Obviously not.

They’re different things: approval and notifications seem pretty appropriate for an app.

No, but local authentication before authenticating any payment is possible within the limitations of the protocol.

Amount and payee authentication is unfortunately not. It would require updating all payment terminals in the field – the last time we tried that (i.e. introducing chip support) it took literally decades (and we're still not done).

> does that mean we should make the app not bother to get your finger print and just have nfc on all the time?

You don't need to unlock your phone to pay amounts under 30€ in my country. You just need the screen to be on.

I'm quite glade it's like this actually. If I had to fiddle with the phone every time I wanted to pay, I would just use my card.

> Contactless debit cards can be skimmed without being authd too;

nitpicking, but contactless cards as far as I am aware cannot be "skimmed" (a process of copying the information from a magnetic stripe and creating a cloned card). If the payment terminal can handle a chip, it will refuse to downgrade the security. In addition, countries are marked as chip only, which means it's almost impossible to get a bank to authorise a transaction for a card that should have a chip in a country where most readers are chip-capable. And if the card was suddenly used in a non-chip region, any good bank would block it.

All you can do with contactless is relay the signal over the internet, but that introduces delay and can sometimes be detected by the reader.

> Now they're doing away with the web interface. They don't say why, so the reason has to be pretty shady.

The article explains why.

> Just like with Google Allo, SMS-based authentication means there's no desktop support at all. The Google Pay website is being stripped of all its useful functionality because a browser does not have a carrier SIM card and therefore can't be authenticated by the SMS-reliant system.

That's not really an explanation, though. The web interface works today and will continue to work through April 3. So, if Google wanted it to continue, it would.

I've since switched to iPhone but on Android I didn't get a confirmation but I always got a pop up notification at the top of the screen saying who I paid and how much within seconds of the buzz. Maybe it's different in Australia?

You are correct about the payment history though, mine was always missing huge chunks (sometimes weeks) of payments for some reason.

Why? I used to review my GP transactions at night (these days I'm using apple pay). All those charges can be reversed if they don't look right. Don't use your debit card for GPay or ApplePay though, those can be much harder to reverse.