We'll pay by smartphone, but let's not pay for dumb security

As we create the infrastructure for mobile electronic payments, we have to get the security right

It's a new dawn, people! As of today, you can walk into just about any Starbucks store and pay for your latte using nothing other than a (free) iPhone app, coupled to an existing Starbucks card account. That's right -- the day of mobile electronic payments is here at last! Ta-dah!

I will pause for the fanfare that it is sure to follow.

Still waiting.

OK, so, new infrastructure improvements don't often get much fanfare -- witness the DNSSEC and IPv6 rollouts.

Nonetheless, we truly (and finally) seem to be on the cusp of a whole new era in mobile payments. By most analyst accounts, the next generation of smartphones is sure to tackle mobile payments in a serious way.

There's a lot riding on the infrastructure for this. A stupid design mistake today can have long-term impact on all of us. Witness the (mostly) European Chip and Pin payment card system.

Researchers at Cambridge unearthed a design defect in the Chip and Pin system over a year ago. The defect enables a fraudster to make unauthorized payments using any valid (or cloned) Chip and Pin card, without needing either a PIN or a signature. (To be fair, that defect hasn't much slowed down Chip and Pin usage. With some 750 million of these cards in use, that's not going to change overnight, but rest assured that the card issuers are well aware of the problem.)

If a new payment system is rolled out to consumers only to be quickly cracked by attackers, no one wins. I'm not saying there are problems with the new Starbucks system (which was in testing for some time in limited markets). But if it does come to pass, the customers lose, the company loses and in the end, technology suffers a setback -- all quite possibly because of some silly design decision that failed to take attackers' capabilities into account.

I have the utmost confidence that a mobile payment system can be designed and implemented securely. If the engineers follow sound security principles, it's certainly within reasonable expectations that we'll have a ubiquitous and secure mobile payment system in the next few years. (I'm referring to something more general in purpose than the Starbucks system.)

But we can't afford bad judgment. Even well-intended security mechanisms can be implemented poorly. Take Apple 's hardware encryption of the iPhone (and other iOS devices), for example. All sensitive files on the file system are encrypted in hardware using AES with a key that is unique to each device. Sounds brilliant, right? Certainly, this is the stuff of breathtaking sales literature -- in which the security features are the hero for a change.

The problem is that Apple's engineers failed to adequately protect that unique encryption key, and the hardware encryption can be completely circumvented in seconds using freely available tools. That's what happens when you combine a brilliant idea with an implementation that wouldn't pass even the most casual scrutiny.

We have to get this right. For this new dawn of mobile payment systems to be accepted broadly by both consumers and enterprises, the system's security must be the hero.

Leave open the possibility of a man-in-the-middle attack anywhere in the system (as in the Chip and Pin system), and it will be exploited. Leave open the possibility of eavesdropping on a password, PIN or payment card account number, and it will most certainly be exploited. Leave open the possibility of someone spoofing a client or a server... You get the picture.

It is exactly because of how much is at stake that ubiquitous mobile payment systems didn't crop up years ago. Yes, plenty of smaller systems have been deployed, but the day of paying for anything from a can of soda to a car via your mobile phone has certainly not yet come to fruition in the U.S.

The stakes are indeed high, but we're staring at a point of confluence where the market pressures are finally overcoming the fear of screwing up. Everyone wants to be the first to get it right and to own the market (so to speak). We can thank ingenuity and competition for that.

So as consumers, we'll sit back and watch what happens as Starbucks and others roll out their offerings. I long for the day when I can throw away my wallet and just carry my (really) smart phone. If these efforts succeed, security will be the hero of the day -- albeit the unsung hero, no doubt. If it fails, it's a safe bet that security will be publicly flogged.

Whatever you do, guys and gals, don't screw this one up.

Now, I think it's time for that morning espresso. Where's my i4?

With more than 20 years in the information security field, Kenneth van Wyk has worked at Carnegie Mellon University's CERT/CC, the U.S. Deptartment of Defense, Para-Protect and others. He has published two books on information security and is working on a third. He is the president and principal consultant at KRvW Associates LLC in Alexandria, Va.

Read more about security in Computerworld's Security Topic Center.

Join the PC World newsletter!

Error: Please check your email address.

Tags starbucksAppletelecommunicationMobile and Wirelesssecuritymobile

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Kenneth van Wyk

Computerworld (US)
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?