Hacker News Reader

Comment by bendtheblock | Hacker News Reader

your last point isn't true - EMV cards with a chip (modern credit cards) use public key cryptography and don't reveal more than they need to to the merchant. Typing in the card numbers (or swiping it) will slowly stop in the US, as it has in most other developed countries by now.

I disagree with the rest also - mainly on the grounds that for a normal person, there isn't any benefit and as the OP says, the status quo is preferable

View on HN

Is there any solution in the works for online purchases?

not cryptographically no (and would be nice to see, but crypto is not the answer). But as a consumer when I shop online I never worry - if I am defrauded the (centralised) bank will give me the money back, that's the solution and it works for everyone

And that's how I ended up having to change my card numbers on file with a bunch of businesses, and why every couple months a purchase fails until I respond to a fraud email. It's a hassle and it's unnecessary, especially when phones have secure enclaves for private key storage. I'm not even arguing for blockchains now, just for using public keys in online purchases.

> especially when phones have secure enclaves for private key storage

Can you convince the powers that be to allow rooted phones to store card credentials?

It's already used for Apple Pay so...yes? And:

> Crucially, iOS itself cannot directly access data stored in the secure enclave, so even if malware could make its way onto an iPhone, it would have no access to the data.

https://9to5mac.com/2020/02/12/apples-secure-enclave/

Even if it's not a perfect solution, it's better than handing full account credentials to every online merchant I use. A dedicated FIDO fob would be even better but the phone is something most people already have.

Google Pay refuses to work on rooted devices unfortunately.

In several countries you now have to approve practically all online payments with second factor, the bank app on your phone.

Apple Pay is one. Also, in Asia it's very common for a website to display a QR code which you scan with your phone to make a payment, either with your bank's app or with a separate payment platform app. These don't reveal any secret data to the merchant.

Even when using traditional card numbers, many banks offer you the ability to instantly mint as many cards as you like, so you can just generate a card for the specific website. Often you can even lock the card number to that merchant after the first payment.

Reply on news.ycombinator.com