Lessons learned from Apple Pay

Ladies and Gentlemen,

If you take a peek in https://developer.apple.com/videos/play/wwdc2016/703/ you will find a presentation of a mobile-device-based payment system that does things that traditional payment providers (banks) could only dream about like:
- HW secured keys
- Ability to be used locally, on the mobile Web, and as "companion" to a Mac
- Pre-installed in a popular consumer gadget

An equally noteworthy thing is that Apple Pay for the Web can be deployed in an existing Web checkout system without touching the code of the other payment alternatives.  That is, using a future Web Payment API standard is simply an option for sites that feel a need offering a tighter integration between different payment methods.

I believe this is compliant with what payment providers want which is why I early on advocated for developing application-neutral standards that would enable third-party innovation and competition rather than trying to standardize for example checkout.  It is still not entirely clear to me that the latter actually mandates a "hard-wired" API [1].  Adding application-specific APIs to general-purpose platforms is an exception to the rule also fo the W3C.

If somebody out there is interested in creating a technically more level playing field for innovation in Web payments and authentication [2], please drop me line!

Anders Rundgren
Principal, WebPKI.org

1] Maybe some kind of trusted Web code concept could support this equally well.  Just guessing here :-)

2] In spite of the massive buy-in, FIDO may not be everybody's choice

Received on Friday, 15 July 2016 12:41:30 UTC