Hacker News Reader

Comment by jfb | Hacker News Reader

Straight from the horse's mouth [1]:

"On the data security side, the technology choices we’ve made take consumers’ security into account at every aspect of their core functionality. We want to assure you, MCX does not store sensitive customer information in the app. Users’ payment information is instead stored in our secure cloud-hosted network. Removing this sensitive information from the mobile device significantly lowers the risk of it being inappropriately disclosed in a case that the mobile device is hacked, stolen or otherwise compromised."

There are simply not enough faces to palm.

[1] http://www.mcx.com/blog/answers-to-your-questions/

View on HN

Disturbingly, this is even more dangerous than them storing credit cards on their servers, since the MCX system uses raw bank account information. If you think it's bad dealing with reversing charges and changing numbers when you get a credit card stolen, try dealing with ACH fraud.

Isn't that same "raw bank account information" on every check you write?

Well, sure, but it's a lot easier to steal a million of them from the "secure cloud technology" than in person.

America is one of very few developed countries in which checks are not an anachronism for precisely this reason.

It's funny that they say that, considering that storing tens or hundreds of millions of credit card information or e-mail addresses in the "cloud" represents a much higher risk than storing everything locally, in a secure enclave in devices, with little to no exposure to the OS, the way Apple does it, in terms of potential for total damage.

It's a lot simpler to steal a million people's identities in one shot than it is to mug a million people -- and that's not even getting into phone security.

Just being pedantic, but the more accurate term is: secure element. The SE has its own OS (JavaCard) and is usually directly wired to the NFC controller (no iOS in-between).

http://globalplatform.org/mediaguideSE.asp

"Secure Enclave" was (is?) the term Apple was using for the "element" storing fingerprints for Touch ID.

http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...

The iPhone 6 has both a secure enclave, for Touch ID, and a secure element.

"Every time you hand over your credit or debit card to pay, your card number and identity are visible. With Apple Pay, instead of using your actual credit and debit card numbers when you add your card to Passbook, a unique Device Account Number is assigned, encrypted, and securely stored in the Secure Element, a dedicated chip in iPhone."

https://www.apple.com/iphone-6/apple-pay/

They worst part is that they aren't even going to store credit card details because they aren't launching with credit card support. They want to tie into your checking account and do ACH! (This being the big pitch to the retailers, not only can you track across stores but you can forget about credit card fees). This is an instant fail company.

> This is an instant fail company.

This is a project largely driven by Walmart with some buy in from other merchants. Walmart has recently announced it'll provide low cost checking accounts to its customers[1]. Walmart's profits are basically driven by volume and beating up their vendors for low prices so they can in turn sell to customers at low prices - the margins are razor thin. Cutting out 2-3% from credit card fees has got to look attractive.

I'd never touch this product, because it's got shitty implementation and security written all over it, but I'm not so sure if it'll be instant fail or not. If they offer a portion of what they save in credit card fees in flat discounts to people, they might be able to make it work.

Of course, I don't really see what non-Walmart merchants are gonna get out of this. Helping them improve their margins seems like it'd only make things worse for places like Target or grocery stores.

[1] http://www.nytimes.com/2014/09/24/business/finding-a-door-in...

So far, what I've heard about CurrentC reminds me of Circuit City's failed attempt to push their proprietary pay-per-view DVD scam.

Like any number of similar schemes, up to and including Microsoft's attempt to force-feed Metro to desktop users, it's all about what the company wants, rather than what the consumer wants. That always works out so well for the company.

> it's all about what the company wants, rather than what the consumer wants.

This is definitely true, but I'm not sure how much it matters.

I, as a consumer, definitely prefer using credit cards because of the protection it affords me, plus I get rewards for what I buy - I never use a debit card to pay for things. I'm also a bit leery of the marketing surveillance state that's cropped up in the US over the past few years, and a scheme like this sets off alarm bells immediately. And I'm sufficiently well off that I'm unlikely to be enticed to try it out just to get some discounts.

But I'm also not a typical consumer. I could see where - if properly and/or luckily done - this might appeal to a not insignificant number of people. If I'm getting a bank account at Walmart, it's likely because I have difficulty getting one somewhere else. Those discounts might seem more attractive to me. Maybe you could argue that's the type of consumer who's also less likely to pay with their phone (or have a phone capable of handling the payments). Dunno, but it seems like even though nobody particularly wants this, it could work because there's a lot of folks who might not dislike it enough to make a difference. DIVX failed because the idea of DVDs that are single use is just a blatant cash grab. It's less obvious here, from the consumer's perspective.

My gut says clusterfuck, though.

EDIT: added a sentence.

I find it hard to believe that the consumer benefits of CurrentC (pretty much just that it works on phones without NFC) outweigh the PITAness of the system. A Walmart-issued card could be directly linked to a Walmart account and people inside that closed ecosystem that bypassed the credit card companies (saving Walmart that precious 2%) would be easier and safer using a Walmart card than CurrentC, at least as currently described.

It looks to me like a very expensive way for some midlevel executive at Walmart to collect huge bonuses for a few years and then get fired after burning through billions with no appreciable change in the mix of payment systems.

From all the "protection through credit cards" talk (which is a new concept to my German socialization - credit cards have a pretty bad rap here), it seems to me that in the US it's easier to counter risks by adding a middle man (yay, layers of abstractions, all with extra costs) than fixing the root cause.

Because here, we enjoy a reasonably fast, cheap and secure electronic direct debit system since the early 80s (only now replaced by a EU wide system that works pretty much the same) that was built by merchants and banks. Credit cards never managed to seriously make a dent in that market.

I'm not sure the unbanked demographic aligns well with a smartphone app that requires a data plan. If they are giving out debit cards to their customers they wouldn't be paying the interchange fees anyway (that's why companies like Target are always pushing the store branded cards).

Sadly, that same demographic is going to be paying for a large portion of their Walmart purchases with an EBT card (Walmart is the largest receiver of food stamp benefits). Maybe they will integrate that into CurrentC, but that sounds like a GOP wedge issue if I've ever heard one.

Reply on news.ycombinator.com