Hacker News Reader

Comment by rickmb | Hacker News Reader

I have a problem with most these arguments. You're suggesting that they should not have allowed the purchase. I would be highly annoyed if Apple didn't allow me to purchase from a different device. I see no reason for Apple to outright refuse this.

The same goes for purchasing something like you've never purchased before. Hell, one of the commercial strengths of the App Store/iTunes concept is that it gets people to do exactly that. There's nothing particularly suspicious about that.

We don't implement such paranoid measures either in other web-services or in real live, so I find it rather overblown to demand Apple does this.

The one thing I agree with is that there should be a better fraud reporting mechanism.

View on HN

What's utterly silly about not having a "purchase first, warn later" system in Apple's case is that that of unlike credit cards, Apple can literally undo the purchase. Apple has done a great job of making the App Store's FairPlay DRM invisible to users, but in the case of a fraudulent purchase, I would imagine it trivial to make that DRM quite plainly visible to the fraudulent purchaser.

We don't implement such paranoid measures either in other web-services

Yes "we" do. Steam doesn't let you authenticate, let alone buy stuff, from a new computer without entering a code that they'll email to you. Takes all of ten seconds--start up Steam, go to my email client, paste the code in, done.

And it works great. So what's the complaint?

Steam is the only service that I've tried to use that won't accept any of my credit card... I'm not in a common situation living in China with a French credit card registered with my chinese address but still, I only could pay two times successfully (after a lot of tries) and now I can't anymore (and one would think that it should have become easier since they didn't get any chargebacks when I did buy)

So, in a world where customers can easily chargeback fraudulent charges, I think having security measures that are too paranoid is a great way to lose customers for no real advantages to the customer security.

Oh man, I've tried numerous time to buy something using Steam and was never able. If you have a card issued in a country and you are traveling abroad, good luck making a purchase. Even if you change the billing address registered with the credit card to the same country you're traveling to and making a purchase from, it won't go through.

I would not give Steam as an example of a successful payment system implementation.

I don't seen the downside to verifying your account on a new device before being able to use it. If you have access to the appstore then you have access to Gmail and one simple email to say "Yeah, go ahead and let my friend's iPad buy this app on my account for 24 hours/7days/forever" is all it takes to prevent this sort of thing.

> We don't implement such paranoid measures either in other web-services or in real live, so I find it rather overblown to demand Apple does this.

Google Two-Factor Authentication, Facebook emails you when someone logs on using an unknown computer, Steam does the same, and I'm sure there are more examples.

It's only paranoia until something happens.

As I mentioned in another comment, you don't have to go as far as verifying before usage (although in some cases you should), but at the very least alert the user of any new device, just like Facebook does.

Reply on news.ycombinator.com