Identity & geography
Tag: Apple
How the past (ticketing technology) can still be relevant in the future.
Last week, I attended the excellent Transport Ticketing Digital Summit which focused on advances in fare collection and Mobility as a Service (MaaS).
Ultra wide band – the 2nd coming?
Every year Consult Hyperion publishes our Live 5. We try to shine a lens on the year ahead and think about what will be impacting our clients. The themes for 2021 are:
Today I want to explore the topic of micro location from the point of view of (mostly) Apple ecosystem, and how developers can leverage application programming interfaces (APIs) to build useful apps. In order to understand that, first we should visit the topic of location in general – how do devices know where they are?
Contact-free and App Clips in Apple’s iOS 14
The Use of Contact-free is Accelerating
At Consult Hyperion, we have already seen the pandemic accelerate the adoption of contact-free payments in the face to face environment as customers have become wary of catching COVID by touching shared devices, such as self-service terminals and PIN pads. The use of personal devices for payments is hardly new but the attraction of an in-app/in-store version of mobile payments, whereby the consumer uses an app on their own device to interact with the retailer or service provider and pay for services, has just increased dramatically. Solutions for parking (RingGo) and for restaurants (like the Wahaca app, powered by Judopay) were already demonstrating the benefits of such an approach for customers and businesses before COVID struck.
Apple are right and wrong
I’m sure you’ve all seen this story by now.
Thousands of iPhone 6 users claim they have been left holding almost worthless phones because Apple’s latest operating system permanently disables the handset if it detects that a repair has been carried out by a non-Apple technician.
Now, when I first glanced at this story on Twitter, my immediate reaction was to share the natural sense of outrage expressed by other commentators. After all, it seems to be a breach of natural justice that if you have purchased a phone and then had it repaired, it is still your phone you should still be able to use it.
I have my Volvo fixed by someone who isn’t a Volvo dealer and it works perfectly. The plumber who came round to fix the leak in our bathroom a couple of weeks ago doesn’t work for the company that built the house, nor did he install the original pipes and he has never fixed anything in or house before. (He did an excellent job, by the way, so hats off to British Gas HomeCare).
If you read on however, I’m afraid the situation is not so clear-cut and I have some sympathy for Apple’s actions, even though I think they chose the wrong way to handle the obvious problem. Obvious problem? Yes.
The issue appears to affect handsets where the home button, which has touch ID fingerprint recognition built-in, has been repaired by a “non-official” company or individual.
Now you can see the obvious problem. If you’re using your phone to make phone calls and the screen is broken then what does it matter who repairs the screen as long as they repair it properly. But if you’re using your phone to authenticate access to financial services using touch ID then it’s pretty important that no one has messed around with the touch ID sensor to, for example, store copies of your fingerprint templates for later replay under remote control. The parts of the phone that other organisations are depending on as part of their security infrastructure (e.g., the SIM) are not just components of the phone like any other component because they feature in somebody else’s risk analysis. In my opinion, Apple is right to be concerned. Charles Arthur just posted a detailed discussion of what is happening.
TouchID (and so Apple Pay and others) don’t work after a third-party fix that affects TouchID. The pairing there between the Secure Element/Secure Enclave/TouchID, which was set up when the device was manufactured, is lost.
Bricking people’s phones when they detect an “incorrect” touch ID device in the phone is the wrong response though. All Apple has done is make people like me wonder if they should really stick with Apple for their next phone because I do not want to run the risk of my phone being rendered useless because I drop it when I’m on holiday need to get it fixed right away by someone who is not some sort of official repairer.
What Apple should have done is to flag the problem to the parties who are relying on the risk analysis (including themselves). These are the people who need to know if there is a potential change in the vulnerability model. So, for example, it would seem to me to be entirely reasonable in the circumstances to flag the Simple app and tell it that the integrity of the touch ID system can no longer be guaranteed and then let the Simple app make its own choice as to whether to continue using touch ID (which I find very convenient) or make me type in my PIN, or use some other kind of strong authentication, instead. Apple’s own software could also pick up the flag and stop using touch ID. After all… so what?
Touch ID, remember, isn’t a security technology. It’s a convenience technology. If Apple software decides that it won’t use Touch ID because it may have been compromised, that’s fine. I can live with entering my PIN instead of using my thumbprint. The same is true for all other applications. I don’t see why apps can’t make their own decision.
Apple is right to take action when it sees evidence that the security of the touch ID subsystem can no longer be guaranteed, but surely the action should be to communicate the situation and let people choose how to adjust their risk analysis?
Apple Pay is cool and great and fun, but it isn’t disruptive
I saw a lot of comment on an article in Harvard Business Review that discussed Apple Pay and concluded that it is not a disruptive play.
By launching Apple Pay as a reseller instead of as a disruptor, Apple is helping to perpetuate a credit card payment system that is obsolete, overly expensive, and absolutely unnecessary in the present day.
[From Apple Pay Is Just a Big Giveaway to Credit Card Companies – HBR]
Well, that’s a little harsh and I’m not sure I’d agree that credit cards are obsolete, but you cannot help but agree with the core point about Apple Pay not being a disruptive technology. I’m hardly the only the person that thinks this and it’s not a new perspective. ApplePay is not disruptive because it cements in place the existing rails for retail payments. And there are good reasons for doing that (apart from anything else, they work) and it means that the service has immediate access to a mass market.
But truly disruptive new services don’t just digitize the familiar. They do away with it.
[From What Amazon, iTunes, and Uber teach us about Apple Pay – O’Reilly Radar]
This is a fair point. Apple Pay is certainly digitising the familiar rather than doing away with it.
In each of these cases, my payment information is simply a stored credential that is already associated with my identity. And that identity is increasingly recognized by means other than an explicit payment process.
[From What Amazon, iTunes, and Uber teach us about Apple Pay – O’Reilly Radar]
The point is, of course, that in time services like Uber will use Apple Pay, because they will want to switch from using stored payment card credentials under “card on file” rules and rates and instead use “cardholder present” rules and rates. This will turn all payments into push payments (which is a good thing) and greatly benefit retailers and consumers alike. What will vanish is the idea of a “point of sale”, since even in-store all payments will be made in-app, just like Uber.
Apple Pay optimizes for how the world does work. The real winner in payments will build for how the world should work.
[From What Amazon, iTunes, and Uber teach us about Apple Pay – O’Reilly Radar]
So how should payments work? Well, that depends on who you are. But if you are a merchant, for example, you want the money to come directly from the customer’s bank and into your bank (forget about what “bank” might mean for the moment) with no-one else in the loop.
Banks don’t orchestrate commerce… they are a dumb pipe payment service that cost far more than the value they provide. The greater they work to control the existing pipes, the greater the business case is for going around them, or regulating them into submission.
Tom’s typically robust approach may aggravate some but there’s no denying that he has an informed perspective. Unless banks find some added value (spoiler alert: I have a feeling that this may be something to do with identity) then they won’t get anything out of this either. Time to start developing a strategic response to falling net interest income, transaction fees asymptotic to zero, flat trading income future. Right now, only 7% of European bank revenues are “other”, so it’s time to grow this piece of the pie…
European Bank Revenues 2014 (Source: Deutsche Bank, March 2015).
If we’re being disruptive, then we don’t start with Apple Pay, we start with thinking about how payments should work. Broadly speaking, wow payments should work is how Bill Gates said they should work in his closing address to SIBOS 2014. He said:
What should the marginal cost of a transaction be, if the identities are properly established, it is extremely low.
Not my words: Bill Gates’. This is a perspective that suggests a very positive model for disruption around a new role for banks in the wider economy. The banks role is to reduce the marginal cost of everyone else’s transactions as well as their own by delivering the trusted identification with strong authentication that the new economy demands. This means more transactions, more commerce, more prosperity and a decent line of business for the banks themselves.
OK, OK, so the new iPhone will have NFC
I love NFC, but I was sceptical that Apple would put it in the iPhone 6 because of one particular problem. Maybe Apple have solved it.
Apple speculation
Even if Apple does put NFC in the iPhone 6, I do not see why they will use it to implement the existing industry model for contactless mobile payments.
