Introducing Netflix Stethoscope

Re:Introducing Netflix Stethoscope by Dylan16807 on Tuesday February 21, 2017 @07:04PM (#13701523)

I don't see how protection from hostile NFC and protection from rogue applications are related. You want both, ideally, but the increased difficulty of solving problem 1 on a phone vs. desktop does not make it harder to solve problem 2 on a phone vs. desktop. So I think you're wrong to say that it's "two totally different landscapes".

[ Parent | on HN ]

Re:Introducing Netflix Stethoscope by kiallmacinnes on Wednesday February 22, 2017 @06:21AM (#13704695)

Ah, I was suggesting that comparing "I have a CC in my wallet and can do stupid things with it" to "I have a CC on my phone now others (hackers, bad apps) do can evil things with it" are two totally different things.

I was drawing parallels between hostile NFC readers and hostile apps/hackers :)

[ Parent | on HN ]

Re:Introducing Netflix Stethoscope by Dylan16807 on Wednesday February 22, 2017 @11:30AM (#13706693)

But the more important comparison in those posts is not CC in wallet. It's that CC on desktop computer has no restrictions.

"hackers/hostile apps can do evil things on desktop" is nearly identical to "hackers/hostile apps can do evil things on phone"

So while in a vacuum you could argue that you need to protect against hostile apps the same way you protect against hostile NFC, it's a weak comparison. While the treatment of hostile apps on your heavier home computing device is a super strong comparison.

[ Parent | on HN ]

Re:Introducing Netflix Stethoscope by kiallmacinnes on Wednesday February 22, 2017 @07:17PM (#13710522)

I'm not sure I agree it's a weak comparison, mostly because I think we've made a whole bunch of bad decisions in how we handle things on a PC.. The PC was born in a different era to the smartphone, and it's treated as such.

Example: CVV numbers, these are needed for "Card not present" transactions are must not be saved (e.g. no browser will save them). Using your phone for an NFC payment on the other hand does not need this number.

Yes, this is a tiny detail. But this detail entirely changes the share of responsibility between the consumer/merchant/payment processor/bank.. This is usually reflected in the different fees that are charged for different types of transactions, card swipe vs card not present vs Chip+PIN vs NFC.

Assuming that just because a CC number + errata stored on a PC can be stolen an abused, that the banks etc should just let me do that on e.g. Android Pay is just wrong..

Nobody is stopping you from creating a text file on your phone with the card and CVV numbers, but don't expect to be able to use that text file as a NFC payment method!

Edit: in case I wasn't clear (I know I wasn't, because I kinda forgot to say it ;)), once your phone is untrusted - as in untrusted by the bank etc - everything stored on it may as well be that plain text file as far as they are concerned.

[ Parent | on HN ]