Hacker News Reader

Comment by adorton | Hacker News Reader

This seems similar to Google Wallet, which has been around for a few years. How does Apple plan to make this a bigger success?

View on HN

Google Wallet was terrible because you had to unlock your phone and enter a PIN, making it instantly way more cumbersome than swiping a card.

Since the iPhones that have NFC also have TouchID, they can authenticate you instantly without resorting to a PIN. If it works as advertised, it will be a huge improvement over Google Wallet.

(I still think Square got closest to an ideal payment scheme with Pay with Square, where the cashier verifies your face to charge you without requiring you to pull anything out. Too bad they broke it by requiring you to pull out your phone to check-in before it would work.)

Agreed on Square, but they even went a step further for a time and allowed geofencing at your favorite places...back when Square Wallet was still around, I used to frequently go to a Houston-area coffee shop with Square Register and never had to pull my phone out to pay. It was downright magical...wish they hadn't cancelled Wallet, it really had so much potential.

That's not the real issue. The real issue is that it doesn't fulfill the promise of you not having to hold your cards anymore (unless you only shop at Walgreens).

In the short term, sure, but if there's sufficient uptake things might look different in a few years.

For me, it might not take much - just Walgreens, some supermarkets, and a decent number of local restaurants supporting this might be enough to allow me to leave my wallet at home on a typical workday. Ironically the one card I'd probably still need, my transit card (Clipper), I assume also uses NFC of some sort. It'd be nice if the new iPhone's NFC feature could support that as well.

Clipper uses a technology called "MiFare DESFire". I'm under the impression that mobile phones can read these, but can't emulate them for some reason. (But apparently they can emulate its predecessor, MiFare Classic, which is unencrypted?)

No idea if it'll be a bigger success, but some thoughts:

1. Timing - 2011 (Wallet release) seems early for consumer NFC, not to mention smartphone penetration ([1] ~30% 2011 to ~70% 2014) and mass market comfort with mobile transactions (Uber, etc.) Wallet may just have been launched too early, they may have educated the market rather than capitalized on it.

2. Existing credit card info - many consumers already give Apple their CC info and payments (iTunes). I can only think of a few examples where you pay Google (Adwords, Google Play) and they are less commonly used.

3. Hype factor - Apple has some magic when it comes to hyping consumer products and services. Google has some of this, but I don't think it's nearly as much, especially with the general population (i.e. non-developers).

[1] http://www.gsmarena.com/asymco_pricing_doesnt_affect_smartph...

A bit more on the timing: USA is finally switching to EMV based credit card payments (chip and pin) during this year and the next, meaning that most terminals will likely be able to accept NFC payments as well (Google Wallet, Apple Pay, whatever else that follows the spec)

Apple has three advantages. First, it's on iPhone, which is a ton of devices. Second, they already have your credit card because you've used it to buy apps or music, etc. Third, people will know this exists because of the media.

So if you get a new iPhone, you're ready to start using it almost immediately. I'm sure I'll use it.

With Android, Google has to get you to sign up for wallet and get you to know that you should want to. Plus you had to have a phone that supports it (I don't know how common that is among high end Android phones).

This is one of those situations where "just being Apple" is a huge advantage.

Does Google Wallet have similar security features, such as not storing or transmitting your actual credit card number or your name, or use of a secure enclave in the phone hardware?

No. Google Wallet simply blurts the magstripe information into the reader over NFC. It has no security features to speak of.

That doesn't make any sense, no. Instead, they skip the secure element and transmit something non-standard (...by buying a bank and routing those through that, essentially acting as a proxy to the card networks?):

http://secureidnews.com/news-item/host-card-emulation-enable...

It doesn't use your card's number, it creates a virtual card and gives that number to the payment terminal.

https://support.google.com/wallet/answer/2676665?rd=1

Yes and who cares? It still is not secure. Anyone who gains the virtual card number can use it and the merchant system can charge arbitrary amounts of money to it.

A payment system that wasn't cooked up by weirdos would include actual security features such as your phone's display shows the amount of the transaction and you enter pin or password or other knowledge and your phone signs the transaction. That would be nonrepudiable and you could clear such transactions at negligible cost because there's little risk.

Square, which isn't exactly winning out there, at least does include a modest security feature of displaying the picture of the authorized card user on the terminal.

I wasn't commenting on the security, just on the "blurts the magstripe information" comment. Apologies if you meant that metaphorically.

As for the rest of your comment, I don't think you're doing any risk modeling.

I have $0 fraud liability on all my cards. When fraud occurs, it takes a couple minutes to dispute a transaction. Even when it was a debit card, my credit union immediately gave me a provisional credit for the disputed amount while they investigated. The total cost to me for fraud is no more than a few minutes of my time. I have little reason to care about security.

Banks care about profit. What makes you think they haven't considered tighter security measures, and found that the cost of implementing them (including the inconvenience to consumers and resulting lost revenue) outweigh the savings from reduced fraud?

I can only guess: but I believe that this will fly if the iPhone 6 is a hit, but it could really soar if the Apple Watch sells very well. Paying with something on my wrist seems more natural (slightly better UX?). If the products end up 'failing' (which for apple means sell like iPhone 5C) then this will just drag on like any product from an extremely large company like Google or Apple that just lives because they can push it on users.

If it means that someone here in the UK can finally pay for something somewhere with an NFC-capable phone, then good! Google Wallet has been US-only for years (and I think the UK promises about its arrival never materialised, unless I am wrong?)

In any case, hopefully this will force the industry to move forward, particularly on Android.

Hopefully this means stores will actually install the NFC readers or whatever.

One interesting unrelated development: the US is moving to chip-and-PIN cards next year. Merchants that don't move over to the new system (in other words, those that still take signatures instead of having you do the chip-and-PIN thing) will be responsible for fraud that occurs in their stores... so merchants will switch.

If merchants are getting new credit card terminals anyhow, it seems likely they'd get NFC compatible ones.

I noticed that the Whole Foods near me just changed their credit card terminals a couple of weeks ago...

My Bank of America Visa recently expired, and the new one they sent me has what appears to be chip and pin. Weirdly, there is no information in the included pamphlet about the technology. I assume they're just preemptively putting the cards out there.

I got a chip and pin card from wells fargo a couple months back, and the actual pin came in an envelope a few weeks after the card.

They've been issuing them for a while. It's not chip and pin, but chip and signature. afaik no major US bank issue chip and pin yet.

I have a Bank of America MasterCard that expired recently and they sent me a new card, but when you go to their information page about chip cards ( http://bankofamerica.com/chipcardfacts ) it seems pretty clear that it's actually chip and signature. They emphasize that if you get asked for a PIN, you should tell the merchant it only requires a signature.

I don't know enough about chip and PIN to say if it's possible, but I'm hoping that means they'll eventually move to adding a PIN too.

All that said -- my iPhone 5 is coming off contract in a few weeks now and I definitely plan on picking up an iPhone 6; I'm looking forward to seeing how well Pay works.

> I noticed that the Whole Foods near me just changed their credit card terminals a couple of weeks ago...

Yep, Whole Foods near me has as well. Also Walgreens near me has new terminals too.

Sadly, US banks seem to be going with chip-and-signature rather than chip-and-PIN. It's not easy to find one that will issue chip-and-PIN.

Will a chip and sig work in Europe? That's probably my biggest issue is traveling and not having a chip.

It ought to, since some European customers have chip-and-signature cards for various reasons. There's no guarantee that shop employees will be properly trained on how to handle it though.

Generally yes, although the cashier might be momentarily confused when the machine prompts her to get a signature since everyone else just uses their pin.

The only place it won't work at all is self-service kiosk.

Stores are already installing them to conform to the upcoming chip and signature standard rolling out across the US. You can tap most of your credit cards instead of swiping at the small number of merchants that have rolled it out (McDonalds, Staples, etc).

Google Wallet required Carrier SIM support which forced consumers to actually go and get a SIM that supported it, as well as a handset that supported said SIM. Apple's solution does not require this and cuts MNO's out entirely

if by similar you mean actually the same, yes they are similar

How? Google wallet basically dumps magstripe out of nfc. This doesn't do anything close to that.

Can you explain how they are the same?

From the user POV, it's the same:

1. upload your Credit/Debit card info to an app(passport/wallet)

2. your phone must have NFC.

3. pay with your phone at a NFC capable terminal.

Millions of adoring fans who trust the Apple brand. People who turn on Apple Pay for "convenience" and then use it for "impulse buy"

Reply on news.ycombinator.com