Hacker News Reader

Comment by f38zf5vdt | Hacker News Reader

I feel like a broken record, but in the near future we are going to switch to a public key authentication object for everything social we do. Payment has already moved to it: tap payments use public key cryptography.

Yet, at the same time, whenever it is brought up people love to engage in contrarian rambles about how it is simply too hard, people will lose their dongles, etc etc. Most phones support NFC communications these days, it's a tap against a phone or reader for verification and so couldn't be easier.

Within 10 years people are going to wonder how we ever lived _without_ this.

View on HN

If you have to own a specific device to exist administratively, I'd rather use something that:

- doesn't cost hundred of dollars

- doesn't live track me every seconds

- isn't holding also the rest of my entire life

- isn't a good target for stealing, ceasing or hacking

The wonderful thing about the payment card is that it's just that: a payment card.

It's small, cheap to replace, doesn't require a battery, doesn't share my GPS position at every second, can't show me ads, and if it gets stolen, I don't also lose my entire list of contacts and my browser favorites.

I can easily have many in my pocket, and only use one when I want. If I lose it, I can cancel it quickly, it doesn't affect anything else, and it's swiftly replaced.

It's also super simple to use, yet not that easy to abuse.

The phone is already too many things at once. Too many eggs on the same baskets.

Yes, a government or corporate issued device like a Yubikey with NFC is my ideal. Just tap to the phone to verify. Payment cards got it right, everyone else is just catching up.

We used to have a little key ring fob that would display a number that would change from time to time. That +password was all we needed.

If my phone breaks, I can’t get onto my work network now…

Contrarian opinion: I’m never going back to using a card now that I’m used to paying with my phone. I always have my phone with me anyway. Paying with it is perfect. I don’t even carry a wallet anymore. Plus, things are frictionless. Changing card is easy. It’s fast and doesn’t require a pin most of the time.

I have been moving more and more things to my smartphone as time goes on. It’s already my 2FA anyway so it will be a major hassle if it’s stolen (but stealing modern smartphone is useless as they can’t be reactivated anyway).

> Most phones support NFC communications these days

There are signs of a trend of people getting rid of their smartphones in favor of dumbphones. (Disclaimer -- I will be doing this when my smartphone dies.) So using them for payment may not, in fact, become ubiquitous.

Even now, just watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.

Yes, I phrased this badly. I meant that instead of using the phone's NFC for verification, we can use a small NFC device that we tap to the phone and which the phone reads via NFC to verify our identities. Just like we tap our cards to payment terminals.

There is no reason why simple non-smart phones should not support NFC.

> watching people at stores and coffee shops in my area, it seems that only about 10-20% of them use their phones for payment.

It seem more like 50% here in central Norway, perhaps more.

But doesn't the phone need to interact with a backend service to be used for payment? Maybe it doesn't -- I don't know how these services actually work in this regard -- but typically you need to use an app and register your accounts in order to be able to do payments, correct?

A dumb phone wouldn't do any of that stuff.

It doesn't necessarily need to be online for that kind of payment workflow. It could just directly emulate a payment card, which those definitely do not have internet connectivity. It would probably take some kind of app to add/remove payment cards, but theoretically this could just be something built-in to the device instead of being some kind of app you'd get from an app store.

Dumb phones still run applications, they're not mechanical devices, at least anymore.

> this could just be something built-in to the device instead of being some kind of app you'd get from an app store.

Yes, I wasn't asking about where the app came from. Preinstalled or user-installed doesn't matter.

So what I hear you saying is that the app doesn't need to communicate with anything, either to add/drop accounts or to make payments. Is that correct?

Ah ok, I think I get what you're talking about -- you're talking about the initial provisioning. I do imagine that would need some kind of communication. But it might not necessarily be some kind of internet connection on the device itself. It could be logging into your bank's website from your computer and putting in some kind of fixed identifier of the device or like a smart card transaction with the website by a USB cable, or registering the device at some physical bank branch, putting in some kind of SIM-card like device, etc.

There would probably have to be some way of pairing the device to your account, but there's probably many potential ways it could be done with some theoretical "dumb phone".

Yes, I understand better now. I don't use these sorts of things, so I've never needed to really know how they work practically. I do understand the cryptographic underpinnings.

So, a feature phone could be used for this. Good to know!

Theoretically, yes. In practice, I don't know any.

No both Google Pay and Apple Pay directly work with the payment terminal as if they were cards. You need to add your card to the app so that your bank sends the necessary keys to your phone secure enclave but then it works perfectly fine offline. You just have to tap twice on a physical button and pass the biometric auth to pay.

> your bank sends the necessary keys to your phone

Ah, that clarifies things. Thank you.

We microchip our pets. Let me walk into the DMV and get microchipped.

Then I can force-wave to pay for goods, go through security checkpoints, etc. People will freak the fuck out about it... but personally I'm 100% for it.

I'm all for this. I've had a chip in my hand since 2014

Did you do it yourself or use a service? What do you use it for?

I had a local body mod artist implant it. He ordered it from dangerousthings.com

I just have my contact card on it so when I meet people I can have them scan my hand with their phone to give them my number.

You're assuming the post-2001 security state assumptions remain the same or don't ease. Which is probably true, but a lot of us would rather ditch them.

The main problem is, PKI is hard and banks and DMV aren’t known for their appreciation of technical complexity.

we have highly technical CAs for https that have wild problems. A well functioning PKI system for banking, identity might work - but it needs to actually be well functioning and transparent.

Reply on news.ycombinator.com