Squareup
squareup.com
squareup.com
Magnetic cards (and all existing RFID equivalents) are bad.
Instead of encouraging their use, we should be creating the mostly fraud-proof obvious alternative: one in which a single transaction does not give the other party permanent access to your wallet.
Picture a card with a key pad on it, for entering a dollar amount. The transaction (through RFID?) would be valid for only that amount.
All of the required cryptographic math has existed for decades. All we need now is the hardware and some infrastructure.
If your goal is verification, an alternate system might have a display on the card that simply verifies the amount charged on most recent transaction, signed by the card processor. Crypto on cards is cheap and tested. This will add no new tasks to those that don't care and provide for a peace of mind to those who do.
Shoppers have dealt with counting out money for millenia. The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it.
> a display on the card that simply verifies the amount charged on most recent transaction
Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions.
Keypad or not, information sent to conduct a physical, face-to-face payment should not be re-usable in any way.
People have also worked 16 hour days to feed their families for millenia; no one's going to do that now. The amount of effort something takes almost always decreases.
> The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it.
How does this system provide 'total security' and guard against remote theft? There is no such thing as 'total security,' you're just mitigating risk. From the way it sounded, you punch in the amount at the time of physical swipe. Once you try to buy something online, you're outside the scope of your physical card.
I do agree however that you should be able to opt in for services that require more verification for transferring money. If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you.
> Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions.
No, I guess I personally did not. As far as the information I read about and had limited contact when I was associated with a security lab, carders distribute cc numbers in the thousands and resell them, and eventually do get charged in small amounts. Again, I don't see how a two-factor system would prevent this. But also admittedly, I've never spent any amount of time thinking about it nor did I personally research into this.
A built-in LCD gives you a single-use credit card number. (Such a product already exists, though a Windows-only PC app.)
> If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you.
And yet the service is offered by no one, and I don't think anyone has yet tried and failed.
> Again, I don't see how a two-factor system would prevent this
A number is good for one transaction, like a gift card code. In the case of my proposed scheme, it is effectively a PGP message signed with your private key, containing the transaction amount, recipient, and a serial number. The bank shall not process any attempted transaction which is not signed by an account holder's key or contains a duplicate serial number.
In a computer systems class we had a lecture about security and cryptographics. There were many case studies of fraud, and almost none of them were deciphering codes. There were many other way easier approaches to steal money from bank accounts.
How is the fact that a credit card number (given online or copied down by a waiter) gives armies of thieves continuous access to my account not a weak link?
http://www.cmu.edu/news/archive/2009/October/oct15_dynamics....
Hey that does sound fun, it also sounds like criminal fraud.
They'll launch, make a couple hundred mil, then they'll get hit with fraud, a ton of people will lose money, and they'll be forced to shut down, since noone will want to use the service, in fear of getting defrauded.
Since there is no barrier to entry, it'll be like 2 weeks before someone comes out with a black market version, that will look exactly the same, but instead of processing credit cards, it'll store them for future fraud.
Will be like the ATM snooping devices, but instead of having to get into the bank, all you need is an iPhone, and some "small" business to rob people with. A taxi, or a newspaper stand.
Edit: If you are going to downvote, at least tell me how exactly do you think this will avoid fraud from fakers who imitate the look and feel of the device?
You are doing everything on another person's gadget. Any verification Square can come up with, can be bypassed by simply not implementing it.
Verified icon? Easy JPG
Encoded credit card #s? Who said the fraudsters would need to use your tool?
Square Verified badge? Easily copied.
It basically boils down to trust issue, early on, consumers will just be unaware of how vulnerable they are, but then stories will start popping up all over the place about how so and so, paid with a credit card for a taxi ride using Square, and then got hit with $5K in credit card fraud.
The Square system is like me handing over a pot with all my money in it and saying "take what you like". Whilst the above is akin to me passing the money to an esscrow (my bank) and them checking it is OK and telling the receiver of the funds.
Sure a fraudster can get hold of a fake merchant ID and encode the transaction value, ID and their merchant ID with an acquired private key - but that merchant ID can just be locked when fraud is spotted and decrypting the data off the wire is going to require lots of resources.
What am I missing.
This will basically just eliminate all the risk.
As far fraudulent devices, I think it's pretty safe to assume that people aren't going to be swiping their cards with random people; rather merchants and vendors that they already have a reasonable level of trust with, but in situations where sales would have been limited to cash only or more complicated and PO-based (trade shows, live events, sales guys in the field, etc.). It won't stop the kinds of fraud that already happens; like your waiter at a restaurant keeping lists of card numbers for sale on the black market. And, I guess it would make that kind of fraud easier, since the attacker would have more information.
But, people are, I think, pretty cagey with handing random people their credit card outside of the context of a reasonably trustworthy business. I doubt this will change that. I'm about the hit the road doing sales work for my company, and I can see this coming in very handy, and I don't think my potential customers would have any reason to be concerned about fraud (since they can easily check up on us, and know that I am who I say I am).
Hope doesn't scale.
http://paulbuchheit.blogspot.com/2007/03/how-to-be-right-90-...
I just answered specifically to the comment, referring to the security aspect. Paypal was losing 10 million USD from fraud, so hope won't do it for the security.
"assume that people aren't going to be swiping their cards with random people"
Assuming, just won't do it.
I'll also mention that folks swipe their cards in fake ATM swipers pretty regularly. It hasn't hurt ATM usage, in general. Likewise, PayPal fraud is still an issue that they fight every day...but PayPal is incredibly profitable. eBay and craigslist also have huge fraud problems, but again, the sheer volume of legitimate transactions and the value of the huge markets they serve is enough to overcome any misgivings people have about using the services. So, I don't think that fake swipers will make this particularly company any more or less trusted than existing providers that have to fight fraud (assuming they are vigilant about actually fighting it).
The interesting thing here is that PayPal made all their margins by encouraging people to use bank accounts rather than credit cards because they made almost no profit on credit card transactions. I'm interested in how this revenue model will work out, it seems like merchant services providers have arrived at their current model of business (arduous checks before granting accounts) out of necessity. Since Square is basically in the merchant accounts business (that's where their margin is) it will be interesting to see if they actually know something that merchant service providers do not about granting accounts to anyone who wants them without more verification.
I've always wondered why merchant service providers didn't instantly verify accounts and allow people to start charging immediately, but hold the captured funds while the account was verified with all the proper checks. Maybe that is what Square is doing.
http://en.wikipedia.org/wiki/Credit_card_fraud#Skimming
How is this any different?
All you need is a taxi, and iPhone, and you can go around town collecting credit card numbers.
And unlike websites, there is no paper trail to link you to the scam.
The beauty of credit cards is that you're not responsible for fraud. I know that when I go to a restaurant the server could easily take a quick cell camera shot of my card, but I accept that risk because I know that I monitor my card activity and that I can recover that money if it does happen. The same applies here.
What is the hole in this? I'm not saying there is no hole, and I did like your question (and upvoted it), but I'm wondering if you can think of a good attack that I'm missing.
Edit: Instead of "iPhone" I should have said just "phone" since it will be on multiple platforms.
why are we naysaying this specific business and not other point of sale things that operate the exact same way? what prevents someone from running a fake newspaper stand with a laptop and CC swiper? why is this product vastly different?
If the device doesn't look 100% 'official' I wouldn't touch it with my card.
do they do restaurant payments different in the UK? would you simply hand your card over to a waiter to pay a bill? what prevents the waiter from just writing down your info? you wouldn't even see a device there.
i think that its just an issue of trust. you won't necessarily trust someone with a hacked together device on a street corner, but if its your cousin jim's glass blowing sculpture store, you'll probably trust anything they run your card through.
plus, in the US at least, we have a fairly robust consumer protection on cards. if you suspect your card to be compromised or see a charge on it you know isn't yours, dispute it and you'll probably have your issues resolved satisfactorily.
The portable POS devices allow the customer to tip as well BTW.
"They" don't run cards much any more. It's a case of consumers putting their own cards into chip+pin devices and keying in their PIN.
Sure @ disputes, we have similar, but it's an extra hassle and not fun.
also, what are your thoughts on online purchases? you're relinquishing a certain degree of control there, too.
disputing isn't fun or convenient, but if it wasn't there or it was worse, i don't know that the CC system would be as popular or successful. its one of the reasons why debit cards had a rocky start.
A scammer can today get hold of a fake taxi badge, pass a skimmer back to the passenger saying it's going to take payment and achieve the same end.
Presumably the argument against square would be that it will desensitise consumers to the risks associated with this and they'll drop their guard.
I think this might make sense if consumers had any guard in the first place. However since I'm sure the average person would hand their credit card to a taxi driver to skim today it's hard to see that Square changes anything.
At the end of the day this will come down to people being careful about who they hand their card to - just as they are (aren't) on the internet.
This isn't even as big a threat as, say, making people acclimated to the idea of joining open wireless networks at coffee shops -- card skimming at least requires physical access to the card for a few seconds.
If today a beggar extended his card reader-equipped iPhone to you, would you swipe? If this company takes off, in a few years you very well might.
Payment methods which give third parties permanent access to your wallet are bad.
a- Card present. Chances of fraud when the card is swiped are much lower than when it isn't (for obvious reasons). b- Signature. This lets you have a basic form of authentication for the user after the fact (oh, didn't make this purchase? Why is this your signature?) c- Location. Each purchase is tagged with the GPS coordinates from the phone. d- If need be, pictures. You could always snap a quick photo of the cardholder if the transaction comes up as a serious fraud risk.
Yes, there are still risks of the person skimming your card info, or stealing your CC number another way, but these are risks present in the entire credit card system.
It's certainly much safer than PayPal, and they're doing alright.
In fact, another article I read told about a couple in Portland, Oregon that cleared 50k between the two of the begging.
"Gregory: I was making 60 grand a year, 60 grand, not working hard. If I wanted to push it I could push it to 70. They want you to do over time on Wall Street. Wall Street judges you by your overtime. So yeah, I was raking it in. And I was spending it just as fast on alcohol. I would get up at 8 at night, take a shower, have a pint of Jack Daniel?s on me when I got into my car and drove to work."
Poetry sample:
"A Few of My (cough) Favorite Things"
Waking up achy, And out in the open.
Guard dogs are barking. Before words are spoken.
Wrought iron benches, That causes suff-ring.
These are a few of my favorite things.
Taking a shower, With four dozen others. Moving around,
In a stench that can smother. Finding that you,
Are the source of the stink!
These are a few of my favorite things.
When the bottles dry, And the smokes are gone,
And I'm feeling low
$250 every day = $25/hour if you "work" 10 hours a day. So 1 person donating $1 every 2.4 minutes.
In that 2.4 minute period, there are probably 1,000 people walking by. Is it really that far fetched, that 1 out of those 1,000 people will "give back"? Especially in a city like New York where there are plenty of high income individuals?
This is peer-review. I'm curious what the truth is, so I'm going to consider the validity of someone's speculation and criticize it accordingly.
Perhaps a better way of putting it is: The average beggar doesn't make anywhere near that much. I can imagine some especially good ones that make a solid living doing it, but most don't make much.
I also don't see any reason for two beggars talking amongst themselves (albeit loudly enough for others to hear) to inflate their daily income more than $100 or so, _especially_ if they're commuting (which costs ~$7/day) to do so.
Well, the short answer is pride. The long answer would be that they do it for the same reasons that you or I would do it if we were asked our salary on a form, knowing that it would be compared, even anonymously, to others. It's the reason why HR firms basically ignore any data that asks an employee for their salary as being inaccurate.
Think about how US dollars declare, on the face of the bill, that the currency is good for all sorts of transactions (all debts, public and private). Even a beggar can get in on the use of this currency. People can easily give to a beggar with almost no overhead, and the recipient can spend the currency almost anywhere.
Credit isn't anywhere near that yet, especially since transaction fees are non-trivial. However, there's been a pretty major barrier to receiving credit payments, and even if someone was willing to pay the fees, there hasn't been a good way to interface with it.
Let's say I pay for two coffees with credit, and a friend wants to pay me with credit for one of the coffees. Even if I were willing to pay the transaction fee, I couldn't take their credit card, easily. PayPal is close to that point, but square is closer.
Settling trivial, private debts with credit will be just as good as any currency that works for all debts, public and private.
Not sure how large of a market there is for this. Mom + Pop stores use CC terminals (cheaper than an iPhone), so that leaves this open to mostly people who accept payment outdoors at farmers markets, sports events, etc..
For that to work you'd have to be comfortable giving a merchant your credit card, which isn't a sure thing considering they can disappear without a brick+mortar store. Also, the merchant would have to be comfortable giving a customer their iPhone. I know I wouldn't want to hand out my phone to random people on the street.
That being said, it looks cool and if I had a store I would definitely give it a try.
Something like this could get merchants who don't traditionally accept credit to start
Be careful though, under US law since 2001, you are probably committing a financial crime by doing anything that looks like anonymous digital cash.
if you don't need a merchant account, the market for this is massive. there are millions of people who provide services and sell products who take cash, check, or paypal only. many of these people are dying to take credit cards with zero hassle, which square lets them do.
"like PayPal, Square allows anyone to have a virtual merchant account and take payments directly."
yep, the market is huuuuge.
Thinking out loud: I assume it reads the strips and converts the information to tones - but I would love to read more about it. I just want to plug it into my computer and see what comes up in Audacity when I scan a card.
I think this device/feature overwhelms the service as a whole actually.
The theory behind this app is that individuals are now empowered to take credit cards for anything they previously would have had to take a cash or check for, which is increasingly important in our society where credit cards are becoming the normal way to pay for things.
As for the hardware, it's a pretty old trick. Though I don't know any of the specifics of this device, you don't need to look any further than your graphing calculator to see the idea in use.
Note that PayPal was revolutionary and is worth many billions of dollars - largely because they could handle the fraud this kind of configuration causes.
http://www.verifone.com/countertop/vx510.aspx
The last thing I want to do is to hand my $699 iPhone over to a customer, especially with a usb attachment or delicate accessory in it's headphone jack....
This image on their home page gave me chills, though. http://a1.sqimg.com/static/6c1cc3c1ad109e13d0be182c75c470762...
But that's likely only because I'm a half-paranoid security geek.
Also, most Windows PCs aren't PCI-DSS compliant but people still use them for online shopping and banking.
What about wear and tear on the audio in jack? Gas pumps and grocery stores have card swipers that look like little tanks bolted on.
Although it seems like part of the point is to have a tiny device you can just pull in and out of your phone at need be.
I think it's also worth noting that, in that time, we've never had a problem with our card reader (the latest, we've had for about 4 years) but my ipod touch, which is a year old and sees far less punishment, has a broken home button.
Actually, there are two things about this system that I really like:
1. I can see a future where paper receipts are a thing of the past.
2. If someone uses my card fraudulently, I'll receive an e-mail a minute after it happens alerting me that something is amiss.
And then? Do you think the banks will assume responsibility for allowing the fraud?
I wonder what the overhead is per transaction (usually a small fixed fee as well as a percentage of the overall transaction). Having worked with some small retail shops, you usually trade off either a higher per transaction cost with smaller percentage fees for large ticket price items or the other way around for quick-serve restaurants for instance.
the customer could browse the menu, buy the product (coffee or whatever) and prepare their order before even getting to the store, then walk in, transmit the order wirelessly (or through the internet to the store) along with their stored payment info to the store's register and have everything processed right away without having to swipe anything or even stand in line.
i'm sure there are existing iphone apps that do this for particular stores (chipotle comes to mind) but if it was a generic app that automatically worked with any store that accepted square, it would be pretty convenient.
This would be ideal for us at tradeshows and seminars. We attend/sponsor about 5-10 per year and do quite a bit of business at a few of them. Instead of having a dedicated laptop in the back for sales, this would be much easier.
On the other hand, we already have a merchant account (with Brain Tree). Plus, we have older clients still paying us with PayPal subscriptions. The last thing we need is another gateway/merchant company.
I suspect there are many other businesses like us.
I hope they are either very flexible or license the technology to other companies.
I'm still waiting for the ability to pay with your cellphone to any merchant. This is happening in Japan and Korea right now among others.
Maybe an IPhone or Android will have an RFID chip in the future.
Or maybe there will be a mobile app that displays a QR code that a merchant can scan and grab your credit card information.
You could have expiring and non-expiring offers too, so that you could have a payment station that was not much more than a sign with a barcode.
I haven't seen a web site that communicates this effectively in a long time. Kudos to the front page designer!
Also I don't think this would work with chip+pin cards would it?
Chip and PIN doesn't seem to exist in the US so I'd imagine they're not targeting it immediately. I don't see why they couldn't expand the hardware to support it though.
Furthermore, the demands of providing an EMV solution do not even stop once all the necessary processing has been implemented, thanks to the extensive type approval process enforced by the governing body, EMVCo. Before any EMV-capable solution can be deployed, there are thousands of tests that need to be passed to validate that the implementation conforms to the EMV industry standard, and as the EMV specifications are regularly updated this becomes a major task in itself! This is why many businesses requiring an EMV "Chip & PIN" solution choose to license a purpose-built EMV software kernel rather than developing their own."
http://www.emvx.co.uk/emv_guide.aspx
idk, maybe they could license it from someone, but I wouldn't say it's a trivial thing to add.
I guess I'm wondering what use-case it's aiming at.
Also I absolutely would not trust someone swiping my card through one of these. I like a closed box that is obviously provided by a bank, which cannot be tampered with. Not an iphone that could be doing anything with my details.
And if they roll out person-to-person, this would be a whole lot nicer than, say, having your friend write you a check.
Maybe this is a European thing, but here in London every restaurant has a number of portable card readers. (Everyone here also uses chip & pin, though, too.) As a consumer, it's awesome... much faster than the old days, and a hell of a lot easier to split the bill when you want to do that.
Perhaps the London merchants are required or otherwise incentivized to use portable ones?
I've implemented point-of-sale systems before, and lemme tell you, there's nothing magical about a magstripe reader, a microcontroller, and a bit of firmware.
Think for a second about recent credit-card purchases you've made. If your habits are anything like mine, aside from gas stations (where the reader is usually integrated into the pump), most card "swipes" happen through either a peripheral device connected to a generic PC, or a compact card reader with little more than a keypad and phone jack, with no visible branding, certification, or tamper-resistant seals in sight.
(Also most places in the UK will not swipe your card anymore. It's all chip+pin).
That's pretty freaking cool.