News for hackers. Stuff that matters.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by afavour on Wednesday December 20, 2023 @02:23PM (#38712503)
IMO that would be better solved by mandating tap and pay payment at EV charging spots. Integrating payments into the charging standard feels like a wild overcomplication by comparison.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by highwaylights on Wednesday December 20, 2023 @04:22PM (#38713810)
It also brings that part of the charging experience to parity with gas, which is really simple for non-tech savvy switchers to understand.

The process for EV and gas refuelling is then identical:

Lift thingamabob -> tap card -> plug into car -> leave

Easy.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by AnthonyMouse on Wednesday December 20, 2023 @02:42PM (#38712704)
Not only that, how do you even propose to do it?

If you just send the payment info via the charging plug, now you have to worry about the payment info being stored in the car and potentially stolen if the car has any security vulnerabilities, including in the charging port.

If you use some kind of tokenization or similar then you're inserting third party payment processors into the system and they'll be wanting a cut.

Just put a card reader on the charger and be done with it.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by sonicanatidae on Wednesday December 20, 2023 @04:12PM (#38713710)
Wouldn't presence of the key address most of this?

Sure, they can steal the car AND the key, but more often, it's the car alone.

[dead]
Re:Volkswagen, Porsche, and Audi finally say they will use T... by AnthonyMouse on Wednesday December 20, 2023 @03:16PM (#38713065)
This is something you add support for as an optional convenience feature because you can do it entirely in software, not something you require people to use. You still need a card reader on the charger.

This is the fundamental problem with all of this stuff -- nobody wants your app. If you can't make it better than sticking a card in the machine, go away. If you can, prove it, by making it an alternative to sticking a card in the machine instead of the only option.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by andrelaszlo on Wednesday December 20, 2023 @03:27PM (#38713184)
Can't read. Does it say USB-C? ;)
Re:Volkswagen, Porsche, and Audi finally say they will use T... by tzs on Wednesday December 20, 2023 @05:26PM (#38714477)
Another reason for a card reader is that it easily handles the case of a borrowed EV.

It is customary when borrowing someone's ICE car to pay for the gas used by returning the car with as much gas as it had when you borrowed it, or even with a full tank. I'd expect people will want to continue that custom when the car is an EV.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by matt-attack on Friday December 22, 2023 @11:55AM (#38736033)
EVs could potentially handle that scenario even better than how it works with ICE cars. With ICE there’s always the error associated with how much gas was in the car to start as well as how much should you fill up when returning it. (Yes I know it’s customary to always just return a friend’s car filled to 100% regardless of the original tank state).

Nonetheless with an EV you could just hit a button saying “friend has taken possession” or “loaner mode” similar to valet mode. Upon returning the car and disabling that mode the car could present you with an accurate dollar amount of exactly what to pay your friend.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by mikepurvis on Wednesday December 20, 2023 @05:45PM (#38714666)
Particularly in a world where every new phone and smartwatch integrates tap-to-pay, seems like a no-brainer to just integrate at that point.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by Retric on Wednesday December 20, 2023 @06:57PM (#38715284)
Cars don’t need to have credit card details onboard.

Hypothetical standard: Charger lets car open a low bandwidth internet connection. Car uses it (or cellular) to open an encrypted channel to a 3rd part service (Tesla/Visa/whatever) saying it’s VIN, password, and the charger’s ID. Charger gets payment from 3rd party.

PS: I would rather chargers just had working credit card readers, but individual chargers don’t do many transactions per day so apps are a cost saving thing.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by AnthonyMouse on Thursday December 21, 2023 @12:30AM (#38717300)
You're getting at the root of the problem here, which is that Visa doesn't actually support anything like that and "whatever" is going to add another grubby middle man to the transaction, which is the thing that most needs to be prevented.

You're fundamentally trying to transfer your money to the operator of the charger, but they aren't standing around to give cash to, so you want something digital. Alright, so your bank should do this -- you authorize your car's private key to make withdrawals from your bank account at charging points and we're all set. Except that banks suck at this sort of thing, which is why we have the credit/debit network to create some kind of standard. Except the standard is credit cards, not public key cryptography.

You wanted to give your money to the charging point operator but instead you have to give it to your bank to give it to Visa to give it to the charging point operator. Now we're going to add "Tesla/whatever" to the chain? This needs to stop. You stick with the card reader until you figure out how to get banks, using some kind of standard, to support the public/private key thing and we can remove a middle man instead of adding one.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by matthewdgreen on Thursday December 21, 2023 @02:18AM (#38717911)
Visa et al are going to charge a minimum transaction fee for small-value transactions, which covers the typical charging session. Third party services are an advantage, because they can bundle small transactions together and take advantage of their economies of scale and their own fraud models. There is a world where Visa and the payment card industry looked forward in the year 2005 and said “IoT devices like EVs will need payment capability, let’s think about how to be essential to this ecosystem in a way that removes the need for third party services and saves everyone money” but that kind of technical innovation seems to be outside of their core competency.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by Symbiote on Thursday December 21, 2023 @03:27AM (#38718207)
The transactions are of higher value than many public transport tickets, and those are already common — either as normal purchases from a ticket machine, or with the special transaction type used when the payment card is touched to the reader on the ticket barrier.

Following a recent trip I had a bunch of ~1€ transactions from buying single bus/metro tickets from machines.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by matthewdgreen on Thursday December 21, 2023 @03:46AM (#38718297)
Visa charges a 5-10 cent fixed fee plus a percentage for those 1 Euro transactions. Presumably public transport just eats those costs, but in a commodity business like electricity I imagine it’s a noticeable chunk of the profit margin.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by ffgjgf1 on Thursday December 21, 2023 @03:52AM (#38718346)
1 cent fixed fee + percentage seems to be the standard where I am. It might be difficult in other EU countries but IIRC the fixed fee is capped at 5cents.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by Symbiote on Thursday December 21, 2023 @05:53AM (#38718991)
The only public information I can find is this, which is from 2013 in London:

Visa credit 0.65%, debit 1 pence. Mastercard credit 0.80%, debit 1 pence + 0.5%.

https://www.whatdotheyknow.com/request/costs_to_tfl_for_cont...

Re:Volkswagen, Porsche, and Audi finally say they will use T... by ffgjgf1 on Thursday December 21, 2023 @03:48AM (#38718309)
> of ~1€ transactions

In Europe, sure because the fees are capped. In the US you pay a fixed fee + x% which makes small transactions like this prohibitively expensive

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Retric on Thursday December 21, 2023 @01:30AM (#38717641)
I agree, except Visa and Mastercard are willing to innovate. Apple Pay/Google Wallet for cars isn’t an unrealistic goal.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by chmod775 on Wednesday December 20, 2023 @08:29PM (#38716020)
All the car needs to store is some private key corresponding to yourself, to prove it's that car. On modern hardware you can make these really hard to steal, short of taking the entire chip with you.

Worse case, if someone steals that key (or the hardware that stores it), they can steal electricity with it. Which also means they'll be caught approximately tomorrow.

If you have that level of access/capability, there's better things to do than using it to get 50 dollars worth of electricity and probably being picked up by police as you siphon it.

Besides, there's easier and stealthier ways to get free electricity.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Animats on Wednesday December 20, 2023 @04:41PM (#38714004)
The tap-and-pay RF people need to get their act together. The average number of tries needed to get a good read is > 1. For Veriphone units, > 2.

Please make it clear where, exactly, the near-field antenna is. Behind the screen? Behind the logo that looks like WiFi? Somewhere inside a separate hockey-puck device? And indicate when the reader is active, too. Light up something.

One place I visit regularly had a POS system which worked perfectly. They recently switched it out for a Clover unit with much lower read reliability and a worse customer-facing UI.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by VBprogrammer on Wednesday December 20, 2023 @05:10PM (#38714299)
For what it's worth, contactless is ubiquitous in the UK – the experience is almost always seamless. The only exception being the odd reader with the antenna in a stupid place (these have gotten less common over time) or when your bank decides to force a pin check.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by g_p on Wednesday December 20, 2023 @06:09PM (#38714868)
How would paying for an EV charge work like this? Would you select an amount of credit in currency (presumably via buttons on the charger?) then tap-to-pay for that amount?

(I believe there are some limitations on tap-to-pay transactions to prevent a merchant presenting the transaction with a different value after actually tapping the card.)

I think a lot of "pay at pump" fuel stations require a full insertion of the card to pre-authorize a large amount, then release it as a partial refund once the amount of fuel dispensed is known.

Would this be a barrier to EV charging, if you need a way to communicate this upfront, or have to effectively replicate out EMV infrastructure on totally unmonitored terminals with PIN readers (and likely the next card skimming scandal brewing)?

Also, how would contactless-only work for cards that get soft locked to be inserted for a PIN check? Would there be a way for EV chargers to be exempted from this? Or would people end up stuck and unable to charge as there's no available place with a PIN reader they can use to unlock their contactless payments?

Re:Volkswagen, Porsche, and Audi finally say they will use T... by sitharus on Wednesday December 20, 2023 @08:26PM (#38716009)
Pay-at-pump is ubiquitous here in New Zealand, I don't think I've seen a station without it for years. This may be because around 90% of all retail transactions are done with payment cards here.

It's easy. You select the max amount (up to NZ$200), tap your card, and it's done. Pick up the right fuel nozzle, refuel, and go. Exactly the same can be done on EV chargers.

The process card-side is not a charge-and-refund as refunds have fees to the merchant. Rather it's a pre-authentication and finalisation. Pre-auth holds the funds for a set time (determined by the merchant agreement with the bank) and the vendor can finalise the charge up to the pre-authentication amount. Most hotels and car rental places do this for security deposits as well, if they don't charge or explicitly cancel your bank will release the fund hold at the end of the holding period.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by baloki on Wednesday December 20, 2023 @06:22PM (#38714983)
They generally pre-auth for either £20 or £40 and then update the amount post-transaction.

In terms of PIN check, the card is just declined with an appropriate error message because you can’t insert it and the next time you use a contactless machine it asks for the card to be inserted and a PIN entered.

For petrol (gas) pumps in the UK it generally auths either £1 or £99.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by g_p on Wednesday December 20, 2023 @06:49PM (#38715204)
Makes sense and matched my understanding of the pay at pump preauth for a fixed amount.

I guess the issue then becomes relying on contactless (only) without the hardware for full EMV with PIN, as then someone whose card has been used contactless one too many times can't charge, and potentially ends up stuck there.

It does feel like contactless is a good convenience measure, but probably isn't ideal as the only mechanism on a reader for charging infrastructure.

Unrelated to this, but not being able to initiate charging without internet access (for online auth of cards, and the ones that can only be used online) also is likely to become an issue in rural areas, as well as give quite a few resilience issues if cloud infrastructure isn't available, or internet backhaul from the area is disrupted. Even once power is restored after a storm, if comms are down (like with Storm Arwen), this doesn't sound ideal for EV charging...

Re:Volkswagen, Porsche, and Audi finally say they will use T... by aaronmdjones on Thursday December 21, 2023 @12:14AM (#38717230)
I only have experience with Shell, Morrisons, and Tesco pay-at-pump stations. In all of those, you have to physically insert your card and type in your PIN; contactless does not exist.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by tharkun__ on Wednesday December 20, 2023 @06:57PM (#38715287)
What's a large amount? I haven't inserted my card at Costco for a very long time now. Just tap.

If the pump pre-authorizes an amount (many non-Costco gas stations I go to make you choose an amount to authorize) it simply never captures more than was actually used.

Now why would any of this be fundamentally different for EVs? You have a rough gauge for how much "fuel" i.e. "juice" you need, pre-authorize enough money but only capture what actually got used. Done. Why do EVs need to be special?

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Symbiote on Thursday December 21, 2023 @03:30AM (#38718221)
Public transport transactions (where the reader is directly on the ticket gate) are exempted from the soft lock, so maybe EV chargers could be too. At least for small amounts.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by g_p on Thursday December 21, 2023 @06:31AM (#38719196)
That makes good sense to exempt those kinds of readers from the soft lock. And given that's possible, it would likely make sense for some similar kind of leeway on EV charging.

Not that there's likely to be any real repercussions in many places given a lack of criminal enforcement around theft/fraud, but EV charging requires the user of the stolen card to stick around in a given area to charge the car, so it's likely lower risk than other places where a stolen card can be used for a large transaction in a short period of time.

I imagine you'd eventually get some people going around offering people "cheap" EV charges for free (for cash), and then tapping a stolen card on the reader, but there's always going to be someone trying to exploit stolen cards in innovative ways.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Ajedi32 on Thursday December 21, 2023 @04:50PM (#38727523)
I'm not sure how it works at the protocol level, but I've been using contactless payments at gas stations here in the US for years now. You just tap to pay before you start pumping, then after you're finished you get charged for the amount of fuel dispensed.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by barrkel on Wednesday December 20, 2023 @06:12PM (#38714895)
I'm increasingly finding that my phone is detected while I'm still moving it towards the scanner, and it complains that my phone moved too fast. Then I have to wait like a schmuck until something resets and I can do it again.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by Affric on Wednesday December 20, 2023 @05:43PM (#38714643)
I want to echo this. When contactless is ubiquitous there are pretty much no problems.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by xp84 on Wednesday December 20, 2023 @06:07PM (#38714857)
I don’t know if I agree. It’s exceedingly rare now to find a place which doesn’t accept contactless in America, but we have these problems still.

Besides dumb inconsistent terminals, the main thing holding it back is (A) customers don’t use it because they either don’t know it’s much faster than our garbage chip readers, or they have been burned by hunting for the right spot to tap. And (B) even the clerks don’t use it because until about this year there was a significant fraction of cards out there without NFC and who wants to hunt for the logo instead of just always shoving it in the (stupid slow) chip reader. There still might be plenty if you count debit cards which I never use but are very popular.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by recursive on Wednesday December 20, 2023 @08:47PM (#38716133)
Sometimes I try to use the tap-to-pay. When I try, more often than not, I cannot get it to work, and then I use the chip anyway.

So usually, I just use the chip to save time.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by xp84 on Friday December 22, 2023 @05:45PM (#38739472)
Yes, this is precisely what I think many people do. Because they are frequently punished for trying it by being made to look foolish. We all roll our eyes when someone in front of us can't seem to master the trivial task of completing a purchase, and in that moment, we are dismayed to realize WE are that person right now!
Re:Volkswagen, Porsche, and Audi finally say they will use T... by harshreality on Wednesday December 20, 2023 @10:00PM (#38716534)
> It’s exceedingly rare now to find a place which doesn’t accept contactless in America...

Lowe's and Home Depot? Walmart, still?

Companies still hoping to silo people into their own apps or antiquated payment method, which might give them a slight cc processing fee reduction that boosts their margins... at the cost of being a usability nightmare for anyone who doesn't shop there frequently. I expect that frequent shoppers will live with whatever a store does, and set up a custom app, if any, or accept using a physical card.

It's easy to see that their approach is petty, because Costco, which has fanatical customers and is members-only—there are no casual infrequent shoppers—got on board with nfc (card and smartphone) payments years ago. If any business could've gotten away with having their own app and special payment processing deals to save money, it's Costco.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Symbiote on Thursday December 21, 2023 @03:56AM (#38718368)
It's very odd, as this has been working smoothly in the EU for around a decade, depending on the country. It's so reliable that you can pay for bus/metro/train tickets in London (since 2014) and many other cities directly at the ticket barrier [1 for photo], which would cause problems if cards were failing or slow.

The only time I'm confused is when there's an unusual card reader, usually a low-budget all-in-one type with a touchscreen, as it's not always clear where the NFC reader is. This is maybe 1-2% of transactions.

Every so often a machine makes the "dur dur" noise and I have to use the chip and my PIN. I'm not sure if this is every Nth transaction, or after spending ¤X. Either way, it's to avoid a lot of contactless payments being made if the card is stolen. (And maybe this is irrelevant in the USA, without PINs?)

"8 out of 10 card payments now contactless in the Nordics" [2]. 54% in the whole EU [3], only 34% in the USA [4].

[1] https://www.intelligenttransport.com/transport-articles/1153...

[2] https://www.nets.eu/Media-and-press/news/Pages/8-out-of-10-c...

[3] https://data.ecb.europa.eu/blog/blog-posts/contactless-payme...

[4] https://ktvz.com/stacker-money/2023/08/01/american-consumers...

Re:Volkswagen, Porsche, and Audi finally say they will use T... by xp84 on Friday December 22, 2023 @05:51PM (#38739511)
Ah, you're right. I forgot about HD which surprises me every time I visit. TBH I have knuckled under for Walmart, which I shop frequently, by using Walmart Pay on their app. I agree that for frequent shoppers it's well worth it, but useless to someone off the street who isn't used to it.

I as a frequent shopper just like the way I can scan my code at any point and then push one button to check out, and that they allow credit cards to back it. For a while before its launch I think it was rumored that Walmart Pay would require an ACH or debit, which would have made it a hard no for me.

I still think that we've seen major progress. For instance, the huge Kroger chain got on board sometime in the past 2 years after being NFC or Apple Pay laggards. CVS a couple years before that, I remember them being particularly prickly about never taking Apple Pay and they came around.

Re:Volkswagen, Porsche, and Audi finally say they will use T... by Daneel_ on Wednesday December 20, 2023 @05:47PM (#38714684)
It’s ubiquitous in Australia as well. I haven’t carried a wallet in almost 5 years. My credit card, driver’s license, and other important cards are all digital.
Re:Volkswagen, Porsche, and Audi finally say they will use T... by Sophira on Wednesday December 20, 2023 @05:33PM (#38714544)
Okay, hear me out here. What's stopping us from just having payments be out of band, like with petrol?

Is being able to ask your car to make a long drive across long distances on its own actually something people want to do? Or is it a solution in search of a problem?

(Disclaimer, I live in the UK and not the US. It's possible there are cultural reasons I've missed.)

Re:Volkswagen, Porsche, and Audi finally say they will use T... by henrikschroder on Wednesday December 20, 2023 @09:38PM (#38716394)
I saw that Norway is now mandating tap and pay at all new EV charging spots.

I agree, that's the way to go. Charging an EV has to be just as easy as filling up a gas car. Pull up, tap you card, plug in. There's zero reason for having to fiddle with apps and memberships and qr codes and whatever else bullshit.