Re: Apple Pay - Security Description

On 2014-10-03 12:22, Ricardo Varela wrote:
> What I mean is that there's several parts to what you were mentioning:
>
> 1) create a Webby version of the scheme
> 2) create a "decentralized" (pending definition) version of the scheme
> 3) create a completely separated version of a complete payment system, independent of "the traditional payment industry"
>
> It is really difficult to get momentum doing all 3 at once - Apple did basically their own version of 1) - substituting "webby" with "for Apple's platform of choice"

Agreed.

Regarding #2 there are (as you write) different takes on this aspect.
One of the more "trivial" is the WAYF (Where Are You From) mechanism.

The lack of a useful WAYF is *one* of the factors which to date has stymied OpenID.
Microsoft did an effort to fix this almost decade ago with Information Cards but
it was based on the client tech available at that time and was eventually shelved.

I think it is (about) time resurrecting this excellent idea, but using a revamped
platform which also addresses the dependency on static code of the original
Information Card concept.  This is [among many things] what WebCrypto++ is about.

>
> Saludos!

U 2 :-)

Anders
>
> --
> ricardo
>
>
> On Fri, Oct 3, 2014 at 10:50 AM, Anders Rundgren <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com>> wrote:
>
>     On 2014-10-03 11:21, Ricardo Varela wrote:
>
>         I may be missing something here. In my understanding what Apple has done is a (very smart, I give them that) EMVCo compatible implementation. The underlying capabilities are still Visa, Mastercard, AMEX et al, plus the bank network (eg: "the traditional payment industry") - I mean, even the spec was created by them
>
>         My two cents: I still think its a bit difficult to have lots of groups continue pushing to "create an alternative" over structures that are not working yet, instead of "create a layer over what already works" and then "add an alternative implementation with the alternative". For innovation purposes, yes of course is a good thing, but for practicality/adoption/create momentum, not so much. Apple is big enough that they COULD have done an alternative and chose to do this instead - I may be wrong but maybe its a good thing to check why?
>
>
>     My core message is that it only works well because it is Apple, nobody else (of any significance) have implemented tokenization.
>
>     Creating a Decentralized and Webby version of their scheme would be great but there's (AFAICT) no push behind that, so for Secure AND Convenient payments our alternatives are super-providers like Apple, Google, PayPal and Alibaba.
>
>     Anders
>
>
>         Saludos!
>
>         ---
>         ricardo
>
>
>         On Fri, Oct 3, 2014 at 6:44 AM, Anders Rundgren <anders.rundgren.net@gmail.com <mailto:anders.rundgren.net@gmail.com> <mailto:anders.rundgren.net@__gmail.com <mailto:anders.rundgren.net@gmail.com>>> wrote:
>
>         http://m.tuaw.com/2014/10/02/__apple-pay-an-in-depth-look-at-__whats-behind-the-secure-__payment/ <http://m.tuaw.com/2014/10/02/apple-pay-an-in-depth-look-at-whats-behind-the-secure-payment/>
>
>              It is pretty clear that the traditional payment industry is YEARS after Apple.
>              The missing link is a way combining Security AND Decentralization.
>
>              The latter is something the "Super-Providers" have no reasons to bother
>              about since they don't need it.
>
>              So what's the problem then? The only people interested and *prepared* challenging
>              the super-providers represent economically and politically insignificant entities.
>              In addition, this lot is *highly divided* making alternatives poorly funded and marketed.
>
>              I'm a pessimist?  Well, where is your "brave" bank who gladly sinks a couple of million
>              bucks in a risky high-tech project that their competitors can also use?
>
>              Anders
>
>
>
>
>         --
>         Ricardo Varela - http://twitter.com/phobeo
>         "Though this be madness, yet there's method in 't"
>
>
>
>
>
> --
> Ricardo Varela - http://twitter.com/phobeo
> "Though this be madness, yet there's method in 't"

Received on Friday, 3 October 2014 11:31:43 UTC