Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Apple Pay Ups Payment Security But PoS Threats Remain
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 4:54:30 PM
Re: Note quite 3-factor authentication ...
@Technocrati - I'm comfortable with NFC as long as I can turn off the antenna whenever I'm not making a purchase. So if it's a slider like WiFi and Bluetooth, no issue.

@GonzSTL - I'd expect that a one-time token under these described conditions is a lot more secure than anything out there today, especially given the Target and Home Depot breaches. I'd be OK using it places that I won't even use VISA or MC today.
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 4:49:23 PM
Re: Apple creates De Facto Standard ?
@GAProgrammer - I think this is more an issue of Apple going after PayPal and expanding their walled garden for a cut of the action.
GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 3:21:56 PM
Re: Note quite 3-factor authentication ...
@Technocrati I'm in the same boat as you - I currently have no plans to use NFC, nor the desire for the potential for my biometric information to be stored somewhere outside of my control. In my post, I tried not to use absolute terms because there will always be exceptions like you and me, for example. I just think that manufacturers, in their efforts to add convenience, make it easy to also add insecurity as an undesirable result of that convenience. I hesitate to say that there should be governmental intervention in the form of regulatory requirements since that tends to spawn off a whole slew of other issues, but maybe if the industry itself set some sort of standard, it may be more palatable to the consumer. You are right, we don't hear anything from the manufacturers, at least in the public space.
Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:16:19 PM
Re: Note quite 3-factor authentication ...

"...I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome ...."

 

@GonzSTL      While I understand your reasoning here, from a consumer perspective I have to respectfully disagree.   I would not be more apt to use a device or method of payment ( NFC ) nor would  this entice me to succumb to biometric authentication.

 

In my case,  there seem to be too much information already running around the Net without my control - I surly don't want to add my biometrics to it.   But at least you are looking for solutions to the issue - I don't hear anything coming from manufacturers themselves.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:01:58 PM
Re: Note quite 3-factor authentication ...

Why not just make two-factor authentication required for using Apple Pay?

 

@GonzSTL    I think that is a really good question.  What is the problem if two-factor authentication is better for security which it obviously is - then why not burn it into the hardware ?   

Manufactuers do this all the time in one way or another, so I don't understand why Apple is dragging it's feet on this.   The only thing I can think of is they don't want to inconvenience their picky customer base.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:51:18 PM
NFC: There has Got To Be a Better Way

@Some Guy   How do you feel about NFC ?    I am not a big fan since I am not a big fan of mobile payments in general.   I just can't picture myself tapping my phone against some reader to make payments.   

 

Call me a germaphobe - but that is also a consideration.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:44:36 PM
Re: Note quite 3-factor authentication ...

Ah yes, I do recall now that these security features were supposed to be local to the phone.   Not sure how I feel about that either.   But thanks for the clarification.   

I am also skeptical that this method cannot be cracked, sure it is a major stride forward - but I am a firm believer that anything encoded can be uncoded.

 

So we 'll just wait until the smoking gun goes off ( again ).

GAProgrammer
GAProgrammer,
User Rank: Guru
9/12/2014 | 1:25:33 PM
Re: Apple creates De Facto Standard ?
With Apple comprising roughtly 41%(and declining) market share, this is definitely a way for them to generate more revenue. I think if Apple makes it easy for retailers to process these payments, this could just be another form of payment. However, you will never catch me on that closed ecosystem. More and more of my friends who use iPhones are finding that the device REALLY isn't that great. I know of 10 people in the past 3 months who have ditched theirs for Samsung phones.

It'll be interesting to see how people, and more importantly, businesses like this new form of payment. It may just be relegated to Apple Stores when all is said and done.
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 1:09:27 PM
Re: Note quite 3-factor authentication ...
We're told the fingerprint is local to the device. It certainly creates storaage overheads if you expect to keep them all in the cloud. And without a lot of utility, since your fingerprint is only good on one device, and wouldn't work in Airplane mode if it only came from the Cloud. But then we've been told that your GPS wasn't tracked either and that turned out to not be true on the iPhone. For now I'd treat it as local only (until someone finds a smoking gun proving otherwise). It likely isn't even usable by other entities in its captured form; certainly not without some sophisticated translation to a 2D representation.
GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 1:01:26 PM
Re: Note quite 3-factor authentication ...
"... Apple would step up its security game by broadening its use of two-factor authentication and more aggressively encouraging people to turn on two-factor authentication."

Why not just make two-factor authentication required for using Apple Pay? I would like to think that consumers who want to use their phone for payments via NFC would want strong authentication. I think that allowing a choice of weak authentication for the sake of convenience is a generally bad idea in the first place. With the almost weekly news of a breach widely reported in various media, I believe that the general public would welcome strong authentication. I did a very unscientific poll by asking some people I knew if they were willing to use fingerprint authentication when they made payments using their NFC and their own phone, and none of them said no. Like I said, it was very unscientific but at their main reason was that they were concerned about account fraud. Surely the general public has the same concerns, right? I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome. If the feature is marketed properly, it could even be an added incentive for people to buy those phones.  Am I off base here? Is it just the security guy in me that influences this line of thinking?
<<   <   Page 2 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-41340
PUBLISHED: 2022-09-24
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
CVE-2022-23463
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver&acirc;&euro;&trade;s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes suc...
CVE-2022-23464
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate&acirc;&euro;&trade;s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information...
CVE-2022-23461
PUBLISHED: 2022-09-24
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
CVE-2022-36025
PUBLISHED: 2022-09-24
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incor...