Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Apple Pay Ups Payment Security But PoS Threats Remain
Oldest First  |  Newest First  |  Threaded View
Page 1 / 3   >   >>
Some Guy
Some Guy,
User Rank: Moderator
9/11/2014 | 11:10:02 AM
Note quite 3-factor authentication ...
"If you use both a passcode and a fingerprint to secure your device, then every purchase you make uses the authentication trifecta: something you know (the passcode), something you have (the device), and something you are (the fingerprint)."

So it's close but not quite 3-factor authentication, because it doesn't require all three at the same time. Simply possessing the device while it's still unlocked and keeping it unlocked allows you to operate it in 1-factor mode at NFC terminals ... forever. Any pickpocket worth his salt can do that.
Technocrati
Technocrati,
User Rank: Ninja
9/11/2014 | 9:09:49 PM
Apple creates De Facto Standard ?

Really found this subject to be a very fascinating read Sarah.  With Apple jumping head first into the mobile payments arena - I was really interested in see how they expect to pull this off.  Otherwise it is a headache not many wanted to deal with until Apple decided to get out in front of this.

This token system is a good idea, but it too as you mention will be compromised as well by hackers in time.  But I guess the industry had to start somewhere - and it is an improvement over magnetic cards ...etc.  

I am not so sure I particularly like using my phone for purchases - though I pay bills occasionally but for the most part I don't want to use my phone for transactions.  I may be in the minority here - as I do not have an iPhone either.

My question is who is governing this new method of payment transmission ?   The FTC ?  Seems to me Apple just created a de facto standard ?

Technocrati
Technocrati,
User Rank: Ninja
9/11/2014 | 9:13:36 PM
Re: Note quite 3-factor authentication ...

@Some Guy   I have to wonder about this finger print authentication.   How  does this work exactly in a global sense  ?    Is there a database with endless numbers of scanned fingerprints in it ?   

 

Sounds funny but  I bet I am not too far off.

GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 1:01:26 PM
Re: Note quite 3-factor authentication ...
"... Apple would step up its security game by broadening its use of two-factor authentication and more aggressively encouraging people to turn on two-factor authentication."

Why not just make two-factor authentication required for using Apple Pay? I would like to think that consumers who want to use their phone for payments via NFC would want strong authentication. I think that allowing a choice of weak authentication for the sake of convenience is a generally bad idea in the first place. With the almost weekly news of a breach widely reported in various media, I believe that the general public would welcome strong authentication. I did a very unscientific poll by asking some people I knew if they were willing to use fingerprint authentication when they made payments using their NFC and their own phone, and none of them said no. Like I said, it was very unscientific but at their main reason was that they were concerned about account fraud. Surely the general public has the same concerns, right? I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome. If the feature is marketed properly, it could even be an added incentive for people to buy those phones.  Am I off base here? Is it just the security guy in me that influences this line of thinking?
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 1:09:27 PM
Re: Note quite 3-factor authentication ...
We're told the fingerprint is local to the device. It certainly creates storaage overheads if you expect to keep them all in the cloud. And without a lot of utility, since your fingerprint is only good on one device, and wouldn't work in Airplane mode if it only came from the Cloud. But then we've been told that your GPS wasn't tracked either and that turned out to not be true on the iPhone. For now I'd treat it as local only (until someone finds a smoking gun proving otherwise). It likely isn't even usable by other entities in its captured form; certainly not without some sophisticated translation to a 2D representation.
GAProgrammer
GAProgrammer,
User Rank: Guru
9/12/2014 | 1:25:33 PM
Re: Apple creates De Facto Standard ?
With Apple comprising roughtly 41%(and declining) market share, this is definitely a way for them to generate more revenue. I think if Apple makes it easy for retailers to process these payments, this could just be another form of payment. However, you will never catch me on that closed ecosystem. More and more of my friends who use iPhones are finding that the device REALLY isn't that great. I know of 10 people in the past 3 months who have ditched theirs for Samsung phones.

It'll be interesting to see how people, and more importantly, businesses like this new form of payment. It may just be relegated to Apple Stores when all is said and done.
Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:44:36 PM
Re: Note quite 3-factor authentication ...

Ah yes, I do recall now that these security features were supposed to be local to the phone.   Not sure how I feel about that either.   But thanks for the clarification.   

I am also skeptical that this method cannot be cracked, sure it is a major stride forward - but I am a firm believer that anything encoded can be uncoded.

 

So we 'll just wait until the smoking gun goes off ( again ).

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:51:18 PM
NFC: There has Got To Be a Better Way

@Some Guy   How do you feel about NFC ?    I am not a big fan since I am not a big fan of mobile payments in general.   I just can't picture myself tapping my phone against some reader to make payments.   

 

Call me a germaphobe - but that is also a consideration.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:01:58 PM
Re: Note quite 3-factor authentication ...

Why not just make two-factor authentication required for using Apple Pay?

 

@GonzSTL    I think that is a really good question.  What is the problem if two-factor authentication is better for security which it obviously is - then why not burn it into the hardware ?   

Manufactuers do this all the time in one way or another, so I don't understand why Apple is dragging it's feet on this.   The only thing I can think of is they don't want to inconvenience their picky customer base.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:16:19 PM
Re: Note quite 3-factor authentication ...

"...I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome ...."

 

@GonzSTL      While I understand your reasoning here, from a consumer perspective I have to respectfully disagree.   I would not be more apt to use a device or method of payment ( NFC ) nor would  this entice me to succumb to biometric authentication.

 

In my case,  there seem to be too much information already running around the Net without my control - I surly don't want to add my biometrics to it.   But at least you are looking for solutions to the issue - I don't hear anything coming from manufacturers themselves.

Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-43705
PUBLISHED: 2022-11-27
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
CVE-2022-45934
PUBLISHED: 2022-11-27
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.
CVE-2022-45931
PUBLISHED: 2022-11-27
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used.
CVE-2022-45932
PUBLISHED: 2022-11-27
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used.
CVE-2022-45933
PUBLISHED: 2022-11-27
KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side proj...