What are North American people doing for replacing contactless payment? Last time I checked, the solution was to use Curve but it only works for Europe.
What are North American people doing for replacing contactless payment? Last time I checked, the solution was to use Curve but it only works for Europe.
I don't. GrapheneOS is worth the effort of pulling a card out of my wallet.
In general I'd agree.
Curve demand a "video selfie" and I've never been comfortable with sending companies such biometric data.
It's infuriating that they won't do this for non Google Android. It's in the best interest of both the bank and the card owner. Credential theft risk goes down to basically zero when backed by a fingerprint authenticated virtual card.
I'm sure contrats between Google and banks provide the financial guarantees that not open-source project would be able to. Unless governments mandate there's zero interest from banks to put extra effort into building for unpopular solutions
What do you mean by credential theft? Stealing the numbers on the card or a malicious person triggering the contactless payment?
Stealing the numbers. Could've been someone taking a photo of the card out of sight. I honestly don't track my card that well when I'm out cause it's easy to have a transaction voided if it's legit not me. Then again cameras are everywhere now.
Banks don't want the headache of supporting multiple weird phone OSes and it's understandable. As long as they don't require running an apple/google-certified device and OS I don't care.
> Banks don't want the headache of supporting multiple weird phone OSes and it's understandable.
Commercially, this makes sense.
I am surprised that most nations of the whole world are fine with every citizen relying on one of two american companies for their lifestyle interactions though. I would have thought more nations would legislate their banks must support other options for sheer sovereign resilience.
> Commercially, this makes sense.
Does it though? The people in this thread are like "just use a card". Well I've done that for years and had my card skimmed, lost, and stolen over the years. The cost wasn't trivial either. The credit card company knocked it off my balance but also lost on sales when I didn't have my card while they issued me a new one. It cost the credit card company actual money in both lost sales and in dealing with the fraudulent transactions.
Now if I was allowed to use my rooted Android phone during those years? It would have been locked down tighter than the vast majority of Windows boxes.
People forget that one of the value-adds of credit cards in the first place is that suddenly you didn't have to walk around with a big wad of cash. Credit cards gave you that extra level of security. Even if someone stole it, it's useless to them as soon as you make a phone call to the CC company. We can verify a transaction with a yubikey-like secret store on your device that never shares the private key with the operating system and which generates a virtual credit card on the fly. That's literally how Apple Pay and Google Pay already work. So whether a device is rooted or whatever literally doesn't matter.
Does skimming still happen a lot? At least in Europe we have switched from magnetic strip to chip-based cards, which are protected against replay attacks.
We have chips but magnetic strips are still on most credit cards and payments are still accepted that way in many older payments gateways. From what I read on the topic the cost of lost business if this was disabled is greater than eating the cost of skimmer attacks. There is a several year plan to phase it out entirely. It's mostly because initially when chips came out a lot of business owners were angry that they had to buy new payment machines and good luck explaining this to a none tech person.
In the UK, many banks disable the magnetic strip by default, and you have to temporarily enable it from the bank's app/website if you want to use it.
You'd struggle to find a POS terminal that even has a reader for them in the UK. I've only ever had to enable them in the US or Japan.
The US first got magnetic strip readers in 1970 so we just have a ton of infrastructure using them. Since most people drive pickpocketing and things of that nature are much less of an issue for us. Typical use has someone using the card for everything then paying it off at the end of the month so if there's a random extra charge the credit card company will typically let it go to maintain the active user.
whether a device is rooted kinda does matter from this pov as it undoes a lot of the security assumptions on android...
however grapheneos isn't rooted anyway
We're talking about just in time tokens that disappear after use. There's nothing you can do to defeat that on a rooted device. That's the whole point of the entire tech. That's why yubikeys are even a thing.
I'm in Europe, but I had accepted that I had to do without. I hadn't heard of curve, going to check that out.
the Play store reviews for Curve are attrocious, especially the most recent ones. Looks like Curve is absolutely unusable, for many reasons
Garmin pay if you're ok with Garmin is one possibility.
It's even available in my country! Never heard of it, would have assumed it's not being sold here. Let's see what that costs when I click the "shop now" button that's front and center
> Attention required!
> Sorry, you have been blocked
> The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.
Thanks cloudflare *handshake* garmin. I suppose I'll stay with chip and pin for now
They don't support amex or capital one, the two I use the most...
They have an app for Android that can do NFC? I thought it was only for their watches. Thanks!
There is no replacement. Strap a credit card to the back of your phone or pay cash.
Use a solvent to dissolve the plastic from the card then epoxy the extracted antenna and chip innards to the back of your phone case. Problem solved. (I'm only 50% joking, you can actually do this but maybe epoxy isn't the best option.)
Somewhat similar, Polar sells a band with an NFC payment chip in it (no experience, just saw it the other day):
https://support.polar.com/en/payment-wristband
Other solutions that use the same underlying technology:
https://fidesmo.com/consumer/wearables/
I'd like to do this, but epoxy it to a dress watch
There are a few other banks running their own NFC payment systems, like Swedbank in my country.
I am not North American, but instead of Google Pay I use my bank's app for contactless payments.
I have these cards I keep in my (RFID-blocking) wallet, one for each credit account. Then I just pull them out and tap to pay. It's super convenient - no app required!
What does RFID-blocking wallet do?
People cannot steal your card info via proximity to your wallet over NFC if the wallet’s physical barrier blocks the RF signal.
People can't steal your card info via proximity to your wallet over NFC even without an RF blocking wallet. This is tinfoil hat security cargo culting, like putting tape over your webcam while leaving the laptop's microphone connected (audio from your room is much more useful than 2834823428 frames of your greasy face).
No but they can steal up to the pin-free amount of money your card allows. They can just hold a sumup to your pocket. Here in Europe most people use debit cards with non-reversible transactions and that limit is often 70-100€ which is quite a lot of money where I live. And they can steal a lot more if they follow you and shouldersurf your pincode.
I definitely use one of those wallets. They're quite convenient too.
[flagged]
Can you please not post aggressively like this? It's against the site guidelines because it destroys what HN is supposed to be for.
If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
[dead]
The person mentioned it like it's a feature for them, but I haven't heard of it being anything other than a marketing gimmick, so I was curious for their perspective.
It just has a Faraday cage and blocks radio signals. That's it.
Cash for most things, and just use a card like normal otherwise.
I don't really see the appeal of contactless payment, pulling a card out really doesn't take much time.
Cards are "contactless payment" these days.
Google Pay (Google Wallet) actually also has virtual number so my real card number won't leak in many cases.
Just having to take your phone with you is quite comfortable. Your phone is probably the pocket-sized item you are unlikeliest to lose.
True, but I also need my license to ride my motorcycle or drive a car, plus cash needs to go somewhere.
The perks of living in a city with good public transport
+ my country already has a mobile driver's license app
And most places take card (or nfc via google/apple pay)
Putting my credit card in my phone case