Comment by Nursie | Hacker News Reader

Comment by Nursie | Hacker News Reader

Parent Full thread

They work using contactless EMV, which is the same way contactless credit cards work, and is the standard behind Visa/MC's Paywave and Paypass products.

This is why wireless terminals in general just work with apple and google pay and actually didn't need much in thw way of special support. From what I recall one of the few things that did change was raising of payment limits for these devices over contactless cards, because they are deemed more secure (can't be used by just anyone that happens to have stolen it).

> Why are these apps so hard/impossible to replace by open-source alternatives?

EMV implementations are non-trivial and need a lot of testing and validation using specialised equipment. There need to be secure enclaves on the device to hold private keys in a way that can't easily be compromised. The app needs to interact with the phone in such a way as it can tell that biometric or PIN-based unlocks have been used so that it can vouch for user security. And the app needs to interface with card-issuing banks on the back end during setup, to get the keys and details it needs issued.

An open source implementation would need to jump through a lot of hoops and set up agreements with the banks and pay for all sorts of lab verification (probably through UL).

> From what I recall one of the few things that did change was raising of payment limits for these devices over contactless cards, because they are deemed more secure (can't be used by just anyone that happens to have stolen it).

The limits are the same, but what these wallets added is on-device cardholder verification.

In a nutshell, it lets Apple Pay tell the terminal "the cardholder already did Face ID/Touch ID/entered their passcode; it's fine", which can then skip PIN entry or signature collection.

Other wallets do it differently and only prompt for that on-device authentication if the amount exceeds that where a PIN or signature would normally be required; yet others don't support it at all and just make you enter the PIN on the terminal (if there is any).

A couple of times that lack of signature verification tripped up a cashier, they’re obviously used to always needing it with however their terminal was configured, but with Apple Pay the receipt got printed with no signature line and after looking at it funny they’re like, “oh, well here’s you’re receipt I guess you don’t need to sign!”

I'm glad the cashiers in your country took it that well!

I've heard of a few cases of surprised employees getting suspicious or outright hostile in the early Apple Pay days (when it wasn't available to domestic cardholders yet and only tourists would use it)

This might be largely due to a strong culture of cashiers expecting to be handed over your card and them being the ones to insert it into the terminal (which is quite ridiculous – it causes the terminal to be pivoted between cashier and customer twice for each transaction for the mandatory PIN entry).

I got this experience first hand in Boston in 2008ish, "Tap and Go" had been introduced to Australia for what seemed to be years before and the cashier expected me to "pass my card" after I had already tapped to pay.

Fortunately she took my explanation well and wanted me to demo it in front of a co-worker.

> cashiers expecting to be handed over your card

This is quite frustrating. I used to have a rather low limit for contactless payments. Back then, some terminals would not prompt for a PIN when the limit was exceeded and would simply decline the transaction. Abroad, I had several incidents where a cashier would take my card, see the "contactless" icon on the card and tap the terminal. It was usually difficult to explain with limited English that they needed to insert the card because the limit was exceeded.

I ended up crossing the contactless icon out with a marker.

Fair enough, t̶h̶e̶ ̶t̶e̶r̶m̶i̶n̶a̶l̶s̶ ̶o̶r̶ ̶b̶a̶n̶k̶s̶ ̶m̶u̶s̶t̶ ̶h̶a̶v̶e̶ ̶l̶i̶m̶i̶t̶s̶ ̶t̶h̶a̶t̶ ̶d̶e̶p̶e̶n̶d̶ ̶o̶n̶ ̶t̶h̶e̶ ̶C̶V̶M̶ ̶t̶h̶e̶n̶,̶ ̶b̶e̶c̶a̶u̶s̶e̶ ̶t̶h̶e̶r̶e̶ ̶a̶r̶e̶ ̶d̶e̶f̶i̶n̶i̶t̶e̶l̶y̶ ̶h̶i̶g̶h̶e̶r̶ ̶l̶i̶m̶i̶t̶s̶ ̶f̶o̶r̶ ̶p̶h̶o̶n̶e̶ ̶p̶a̶y̶m̶e̶n̶t̶ ̶c̶o̶m̶p̶a̶r̶e̶d̶ ̶t̶o̶ ̶c̶o̶n̶t̶a̶c̶t̶l̶e̶s̶s̶ ̶c̶a̶r̶d̶s̶

(edit: forgot cards and devices can have their own limits, best ignore this comment)

I thought apple/google only verified payments up to a limit (ever increasing) of e.g. £500/£1000 based on the biometrics? Is that right?

Thanks so much!

Reply on news.ycombinator.com