Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Apple Pay Ups Payment Security But PoS Threats Remain
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 4:54:30 PM
Re: Note quite 3-factor authentication ...
@Technocrati - I'm comfortable with NFC as long as I can turn off the antenna whenever I'm not making a purchase. So if it's a slider like WiFi and Bluetooth, no issue.

@GonzSTL - I'd expect that a one-time token under these described conditions is a lot more secure than anything out there today, especially given the Target and Home Depot breaches. I'd be OK using it places that I won't even use VISA or MC today.
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 4:49:23 PM
Re: Apple creates De Facto Standard ?
@GAProgrammer - I think this is more an issue of Apple going after PayPal and expanding their walled garden for a cut of the action.
GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 3:21:56 PM
Re: Note quite 3-factor authentication ...
@Technocrati I'm in the same boat as you - I currently have no plans to use NFC, nor the desire for the potential for my biometric information to be stored somewhere outside of my control. In my post, I tried not to use absolute terms because there will always be exceptions like you and me, for example. I just think that manufacturers, in their efforts to add convenience, make it easy to also add insecurity as an undesirable result of that convenience. I hesitate to say that there should be governmental intervention in the form of regulatory requirements since that tends to spawn off a whole slew of other issues, but maybe if the industry itself set some sort of standard, it may be more palatable to the consumer. You are right, we don't hear anything from the manufacturers, at least in the public space.
Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:16:19 PM
Re: Note quite 3-factor authentication ...

"...I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome ...."

 

@GonzSTL      While I understand your reasoning here, from a consumer perspective I have to respectfully disagree.   I would not be more apt to use a device or method of payment ( NFC ) nor would  this entice me to succumb to biometric authentication.

 

In my case,  there seem to be too much information already running around the Net without my control - I surly don't want to add my biometrics to it.   But at least you are looking for solutions to the issue - I don't hear anything coming from manufacturers themselves.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 2:01:58 PM
Re: Note quite 3-factor authentication ...

Why not just make two-factor authentication required for using Apple Pay?

 

@GonzSTL    I think that is a really good question.  What is the problem if two-factor authentication is better for security which it obviously is - then why not burn it into the hardware ?   

Manufactuers do this all the time in one way or another, so I don't understand why Apple is dragging it's feet on this.   The only thing I can think of is they don't want to inconvenience their picky customer base.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:51:18 PM
NFC: There has Got To Be a Better Way

@Some Guy   How do you feel about NFC ?    I am not a big fan since I am not a big fan of mobile payments in general.   I just can't picture myself tapping my phone against some reader to make payments.   

 

Call me a germaphobe - but that is also a consideration.

Technocrati
Technocrati,
User Rank: Ninja
9/12/2014 | 1:44:36 PM
Re: Note quite 3-factor authentication ...

Ah yes, I do recall now that these security features were supposed to be local to the phone.   Not sure how I feel about that either.   But thanks for the clarification.   

I am also skeptical that this method cannot be cracked, sure it is a major stride forward - but I am a firm believer that anything encoded can be uncoded.

 

So we 'll just wait until the smoking gun goes off ( again ).

GAProgrammer
GAProgrammer,
User Rank: Guru
9/12/2014 | 1:25:33 PM
Re: Apple creates De Facto Standard ?
With Apple comprising roughtly 41%(and declining) market share, this is definitely a way for them to generate more revenue. I think if Apple makes it easy for retailers to process these payments, this could just be another form of payment. However, you will never catch me on that closed ecosystem. More and more of my friends who use iPhones are finding that the device REALLY isn't that great. I know of 10 people in the past 3 months who have ditched theirs for Samsung phones.

It'll be interesting to see how people, and more importantly, businesses like this new form of payment. It may just be relegated to Apple Stores when all is said and done.
Some Guy
Some Guy,
User Rank: Moderator
9/12/2014 | 1:09:27 PM
Re: Note quite 3-factor authentication ...
We're told the fingerprint is local to the device. It certainly creates storaage overheads if you expect to keep them all in the cloud. And without a lot of utility, since your fingerprint is only good on one device, and wouldn't work in Airplane mode if it only came from the Cloud. But then we've been told that your GPS wasn't tracked either and that turned out to not be true on the iPhone. For now I'd treat it as local only (until someone finds a smoking gun proving otherwise). It likely isn't even usable by other entities in its captured form; certainly not without some sophisticated translation to a 2D representation.
GonzSTL
GonzSTL,
User Rank: Ninja
9/12/2014 | 1:01:26 PM
Re: Note quite 3-factor authentication ...
"... Apple would step up its security game by broadening its use of two-factor authentication and more aggressively encouraging people to turn on two-factor authentication."

Why not just make two-factor authentication required for using Apple Pay? I would like to think that consumers who want to use their phone for payments via NFC would want strong authentication. I think that allowing a choice of weak authentication for the sake of convenience is a generally bad idea in the first place. With the almost weekly news of a breach widely reported in various media, I believe that the general public would welcome strong authentication. I did a very unscientific poll by asking some people I knew if they were willing to use fingerprint authentication when they made payments using their NFC and their own phone, and none of them said no. Like I said, it was very unscientific but at their main reason was that they were concerned about account fraud. Surely the general public has the same concerns, right? I think that users' hesitation to use biometric authentication is weighed in by phone manufacturers as a factor that could lose potential customers, but if the technique is presented as a requirement only for NFC payments, that hurdle can likely be overcome. If the feature is marketed properly, it could even be an added incentive for people to buy those phones.  Am I off base here? Is it just the security guy in me that influences this line of thinking?
<<   <   Page 2 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35730
PUBLISHED: 2022-12-04
Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin &lt;= 1.0.8 on WordPress.
CVE-2022-40968
PUBLISHED: 2022-12-04
Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin &lt;=2.1.5 on WordPress.
CVE-2022-35507
PUBLISHED: 2022-12-04
A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers...
CVE-2022-35508
PUBLISHED: 2022-12-04
Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Pr...
CVE-2022-46411
PUBLISHED: 2022-12-04
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.