Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The terminal is an untrusted device. It would be much more secure if the details could be printed on my device for my confirmation. (It could then sign them to approve the payment.)

Of course this isn't how the payment system was designed as it was designed for cheap, simple cards. The saving grace is that you can perform a chargeback if the transaction is wrong. Not as elegant, but is basically as effective at the end of the day.



>The terminal is an untrusted device.

Untrusted by who? You?

The terminal is a trusted device in the payment system, and in most cases is the only trusted device in the store involved in the payment chain.


It may be trusted by the store or the payment provider but I most certainly don't trust the terminal in a random store. It could be fake or modified and I would have no way to know. I can't trust it to show me the correct amount.


You have a fair point but this tool is actually meant to be a software translation of contactless cards and it's 1-1 that. Neither Apple nor Google Pay thought to reimplement given the new tools they have available.

If I had to guess, I would say it is because they wanted to support some use-case that contactless cards currently do: presumably like I can pay at Safeway before knowing the amount - a feature I use very often to speed up the process.


For sure. It is far more important for the phone payments to have widespread adoption than improving security. I don't blame them for that. However it would be cool if they could start adding security features. I can imagine that your use case could be solved by signing to token such as "Up to $500 in the next 6h" or something. You could be promoted on your phone and approve it.

In fact I would like the whole credit card system to be overhauled or replaced with a different system that gives consumers much more control over the access they give companies. Sure, some companies like online stores I might give full access like I do today as I plan to make many future purchases with different values, but I can also see a lot of uses for more restricted access like fixed monthly subscriptions and one time fixed-cost payments that don't give them access to charge me later.


Certainly, I imagine it's a product decision weighing security and convenience.


How do you pay for things when not using the phone system (which you explicitly refuse to use)? I'm curious what system of electronic payment you believe is trustworthy if the payment terminal is not.


I do use it. All I am saying is that you can't trust anything the terminal tells you. The only way to be sure what you paid is checking the statements at the end of the month and requesting chargebacks if anything isn't correct.


If it's fake or modified, it will not have the ability to communicate with the payment network and process the transaction.


Wait till you see what happens when you swipe, insert or tap a credit/debit card.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: