Hacker News new | ask | show | jobs
by mikeash 3849 days ago
Nearly everything in your original comment is wrong. You say there's a "minor surcharge" but the cost to the vendor is the same as any other credit card. You mention the cost of supporting yet another platform, but the platform is just NFC, there's nothing special needed to support Apple Pay specifically. You say the consumer has their fingerprint tied to payments, but the fingerprint data never leaves the device. You say the attack surface is increased substantially, but Apple Pay is much more secure than using a credit card directly. (Not that consumers need to care, since fraud protection is 100%.) You imply that credit card companies aren't involved in resolving fraudulent Apple Pay transactions, but they are. You close by saying that Apple Pay isn't just a nice frontend for the card companies with better security, but that's precisely what it is.

I personally think this can rightly be described as "very misinformed."

1 comments

>> there's nothing special needed to support Apple Pay specifically.

Yes, there is. NFC enabled terminals may be the norm at major chain stores but they do not have widespread adoption in smaller retail outlets.

The merchant pays for those terminals and they are not inexpensive. Sometimes $1000 or more. That tradeoff (making it slightly easier for you to pay) just isn't worth it to most merchants right now. As EMV adoption grows and merchants have to update their terminals to support that as well, NFC will grow.

Also, it may seem as if ApplePay is more secure for the banks as it prevents issues with data breaches but to date, it has not prevented any, will continue to only lessen the impact and is absolutely wrought with card fraud as there isn't any validation that you own the card you are loading into ApplePay. Once it's loaded it isn't checked by the merchant (if the merchant even pays attention these days) and is implicitly trusted by the network.

The key word there is "specifically." Apple Pay may require technology that isn't 100% deployed, but it is a generic and standardized technology that long predates Apple Pay, not some new Apple-only technology that the boys in Cupertino came up with and foisted on the world.

I don't understand your security point at all. It hasn't prevented any breaches? How do you know? It doesn't validate cards you enter into Apple Pay? If you possess the card (or can make one from having possession of the card data) then you can already use it fraudulently, loading it into an iPhone is just an extra unnecessary step for the thief. The security advantage is that malicious terminals can't steal card data, and stealing your method of payment doesn't confer the ability to pay. It's not perfect by any means (and again, not something us consumers need to even care about), merely better than a regular plastic card.

It took the UK a few years since contactless cards were launched around 2010. Everyone already had chip+pin terminals, and at first it was mostly coffee shops in London, but now many merchants have upgraded to contactless ones. It's not just national chains, but local shops too. It's much faster paying by contactless in a busy pub than paying cash.

It's possible there's pressure/support from Visa and MasterCard for small, local retailers to accept contactless payments. It's part of their advertising that you can buy a newspaper using the system, and most newsagents are local, independent shops.

A basic chip+pin (not contactless) terminal is available for £100 (or £3/month), I can't find a price for a contactless one.