zlacker

[return to "Experimental release of GrapheneOS for Pixel 9a"]
1. verslu+1B[view] [source] 2025-04-13 09:42:13
>>moelf+(OP)
I love GrapheneOS. The biggest downside is that Google integrity API block wireless payments in Google Pay. All Dutch banks now advertise to install Google pay for wireless payments. I've tried asking Google to support GrapheneOS but they told me to do a feature request. Which I did and got no reply to. I've contacted the consumer market authority and made a formal complaint since Google and Apple share effectively a contactless payments duopoly and decide which OS distributions get access. Those are closed source and usually bundled with a lot of spyware. I also explained how the Google integrity API might affect banking availability in the future (and already does for some banking apps). They took it very seriously and I hope to hear from them in the future.
◧◩
2. palata+YG[view] [source] 2025-04-13 10:58:19
>>verslu+1B
> All Dutch banks now advertise to install Google pay for wireless payments.

That sounds like a very big mistake to me. And a missed opportunity: in some countries, banked work together to develop their own systems. People can send money to each other and pay everywhere with a small app that is not BigTech from the US.

I think there should be such an app in every country; you don't want your payment system to fully depend on US companies.

◧◩◪
3. dzikim+eL[view] [source] 2025-04-13 11:57:56
>>palata+YG
Banks do that for p2p payments and e-commerce (like iDeal mentioned by sibling comment or BLIK in Poland).

For physical transactions there's barrier of hardware and network effect - everybody has card terminal. Users expect near 100% acceptance for them to use payment method daily.

If you consider creating own NFC payment app instead of Google/Apple Pay - that's actually possible, but more expensive and often disliked by the users due to inability to easily switch between cards issued by different apps.

◧◩◪◨
4. palata+gW[view] [source] 2025-04-13 13:50:48
>>dzikim+eL
As mentioned in the sibling comment, Twint goes with QR code. It just works.

It's even better than NFC because a small store can print their QR code on a piece of paper and not need to buy a terminal. Most stores just have the normal card terminal print the QR code and people scan it.

◧◩◪◨⬒
5. andrew+IP1[view] [source] 2025-04-13 22:11:32
>>palata+gW
NFC, for payments, has bidirectional communications and limited scope for MITM. It's a bit too easy to cover a sticker.

The TWINT app says -- if their promo videos are to be trusted -- "Scan only QR codes from trusted sources and check the receiver of the payment in the next step". That doesn't fill me with confidence :(.

A dynamic QR code could be fine -- they have their app, you're able to bootstrap what is effectively a secure channel between the PoS machine and the app to give the vendor confidence their device has received payment and the consumer confidence that they're paying the right vendor. A static QR code is more challenging, and it sounds like they're putting more weight into social protections than I'm comfortable with -- especially considering a technical solution is possible and exists.

I'm especially wary of the warning that individuals can't have QR codes. Why not? Unless it's part of the social protection. But I can personally accept NFC contactless payments (having opened an account with a suitable provider), and indeed I bought a device which means I can accept chip and PIN payments too.

◧◩◪◨⬒⬓
6. palata+WS1[view] [source] 2025-04-13 22:51:31
>>andrew+IP1
Multiple things here.

* The vast majority of the payments (almost all of them) are done with dynamic QR codes.

* The static QR code is mostly used by very, very small entities. Like the person asks you to scan their code, enter the amount and show them the confirmation. It is in their interest to show the right QR code.

* Sending money to a friend is done with the phone number as an id. It works, but you need to enter the mobile phone number of the receiver.

* There is one situation where static codes are printed and where phishing has been reported (it's not MITM, it's really just a QR code that sends you to a bad website): when paying for parking. You don't have to use it if you don't feel comfortable, and it is possible to feel comfortable because it actually just opens a website (so if you use it regularly you can learn to check that you are on the legit website before you make the payment).

Overall, it is super popular and it works really well. No need for NFC, and no need to install the Google Play Services \o/.

◧◩◪◨⬒⬓⬔
7. andrew+O64[view] [source] 2025-04-14 19:11:34
>>palata+WS1
I'm sure it does work really well -- the social dynamics are there, it's obviously easy to use. That doesn't mean I have to like the technical characteristics.

A counter-point might be that my credit card doesn't require Google Play Services either. And won't run out of battery. And works with all the local businesses, including the smallest -- while there are some people (mostly outside cities) who still only take cash, I can't imagine them signing up for TWINT either.

There are several providers of services allowing individuals and small traders to accept credit and debit cards, and I've happily accepted cards from foreign banks too.

I'd be sceptical of anything like TWINT catching on in the UK, because NFC payments are already ubiquitous and also really easy to use.

[go to top]