Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Apple Pay Ups Payment Security But PoS Threats Remain
Oldest First  |  Newest First  |  Threaded View
Page 1 / 3   >   >>
Some Guy
Some Guy,
User Rank: Moderator
9/11/2014 | 11:10:02 AM
Note quite 3-factor authentication ...
"If you use both a passcode and a fingerprint to secure your device, then every purchase you make uses the authentication trifecta: something you know (the passcode), something you have (the device), and something you are (the fingerprint)."

So it's close but not quite 3-factor authentication, because it doesn't require all three at the same time. Simply possessing the device while it's still unlocked and keeping it unlocked allows you to operate it in 1-factor mode at NFC terminals ... forever. Any pickpocket worth his salt can do that.
Technocrati
Technocrati,
User Rank: Ninja
9/11/2014 | 9:09:49 PM
Apple creates De Facto Standard ?

Really found this subject to be a very fascinating read Sarah.  With Apple jumping head first into the mobile payments arena - I was really interested in see how they expect to pull this off.  Otherwise it is a headache not many wanted to deal with until Apple decided to get out in front of this.

This token system is a good idea, but it too as you mention will be compromised as well by hackers in time.  But I guess the industry had to start somewhere - and it is an improvement over magnetic cards ...etc.  

I am not so sure I particularly like using my phone for purchases - though I pay bills occasionally but for the most part I don't want to use my phone for transactions.  I may be in the minority here - as I do not have an iPhone either.

My question is who is governing this new method of payment transmission ?   The FTC ?  Seems to me Apple just created a de facto standard ?

Technocrati
Technocrati,
User Rank: Ninja
9/11/2014 | 9:13:36 PM
Re: Note quite 3-factor authentication ...

@Some Guy   I have to wonder about this finger print authentication.   How  does this work exactly in a global sense  ?    Is there a database with endless numbers of scanned fingerprints in it ?   

 

Sounds funny but  I bet I am not too far off.

GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 1:01:26 PM
Re: Note quite 3-factor authentication ...
"... Apple would step up its security game by broadening its use of two-factor authentication and more aggressively encouraging people to turn on two-factor authentication."

Why not just make two-factor authentication required for using Apple Pay? I would like to think that consumers who want to use their phone for payments via NFC would want strong authentication. I think that allowing a choice of weak authentication for the sake of convenience is a generally bad idea in the first place. With the almost weekly news of a breach widely reported in various media, I believe that the general public would welcome strong authentication. I did a very unscientific poll by asking some people I knew if they were willing to use fingerprint authentication when they made payments using their NFC and their own phone, and none of them said no. Like I said, it was very unscientific but at their main reason was that they were concerned about account fraud. Surely the general public has the same concerns, right? I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome. If the feature is marketed properly, it could even be an added incentive for people to buy those phones.  Am I off base here? Is it just the security guy in me that influences this line of thinking?
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 1:09:27 PM
Re: Note quite 3-factor authentication ...
We're told the fingerprint is local to the device. It certainly creates storaage overheads if you expect to keep them all in the cloud. And without a lot of utility, since your fingerprint is only good on one device, and wouldn't work in Airplane mode if it only came from the Cloud. But then we've been told that your GPS wasn't tracked either and that turned out to not be true on the iPhone. For now I'd treat it as local only (until someone finds a smoking gun proving otherwise). It likely isn't even usable by other entities in its captured form; certainly not without some sophisticated translation to a 2D representation.
GAProgrammer
GAProgrammer,
User Rank: Guru
9/12/2014 | 1:25:33 PM
Re: Apple creates De Facto Standard ?
With Apple comprising roughtly 41%(and declining) market share, this is definitely a way for them to generate more revenue. I think if Apple makes it easy for retailers to process these payments, this could just be another form of payment. However, you will never catch me on that closed ecosystem. More and more of my friends who use iPhones are finding that the device REALLY isn't that great. I know of 10 people in the past 3 months who have ditched theirs for Samsung phones.

It'll be interesting to see how people, and more importantly, businesses like this new form of payment. It may just be relegated to Apple Stores when all is said and done.
Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:44:36 PM
Re: Note quite 3-factor authentication ...

Ah yes, I do recall now that these security features were supposed to be local to the phone.   Not sure how I feel about that either.   But thanks for the clarification.   

I am also skeptical that this method cannot be cracked, sure it is a major stride forward - but I am a firm believer that anything encoded can be uncoded.

 

So we 'll just wait until the smoking gun goes off ( again ).

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:51:18 PM
NFC: There has Got To Be a Better Way

@Some Guy   How do you feel about NFC ?    I am not a big fan since I am not a big fan of mobile payments in general.   I just can't picture myself tapping my phone against some reader to make payments.   

 

Call me a germaphobe - but that is also a consideration.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:01:58 PM
Re: Note quite 3-factor authentication ...

Why not just make two-factor authentication required for using Apple Pay?

 

@GonzSTL    I think that is a really good question.  What is the problem if two-factor authentication is better for security which it obviously is - then why not burn it into the hardware ?   

Manufactuers do this all the time in one way or another, so I don't understand why Apple is dragging it's feet on this.   The only thing I can think of is they don't want to inconvenience their picky customer base.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:16:19 PM
Re: Note quite 3-factor authentication ...

"...I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome ...."

 

@GonzSTL      While I understand your reasoning here, from a consumer perspective I have to respectfully disagree.   I would not be more apt to use a device or method of payment ( NFC ) nor would  this entice me to succumb to biometric authentication.

 

In my case,  there seem to be too much information already running around the Net without my control - I surly don't want to add my biometrics to it.   But at least you are looking for solutions to the issue - I don't hear anything coming from manufacturers themselves.

Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...