Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> requires internet connection for both parties (credit cards only require the merchant to be connected)

In China it's quite common for the merchant to have a static printed-out QR code for receiving payment. This requires a connection only for the payer (and merchants will often have WiFi available, so you're likely to be able to connect one way or another). These merchants tend to just trust you when you pay and then show them the "paid" screen on your phone. You could fake it, but I guess in general people don't, and the "paid" screen does include the merchant's chosen profile image, so you would have to have done your homework to fake it.

> scanning is worse ux than tapping

This is really true. When I lived in Shanghai it was pretty common to be stuck behind someone at the metro turnstile who was trying to use the stupid QR scanning thing to get in. Contactless is much smoother, but at one time QR code was the only way to use your mobile device to get into Shanghai's metro. Now Apple Pay supports the Shanghai transit card.



>In China it's quite common for the merchant to have a static printed-out QR code for receiving payment

"for the same amount of security" should be implied. If we're talking about what's possible, credit cards can also be processed fully offline by using an imprinter (eg. https://en.wikipedia.org/wiki/File:Credit_card_imprinter.JPG).


I think you are misunderstanding, which part of a print-out receiving QR code is insecure?


From the GP:

>These merchants tend to just trust you when you pay and then show them the "paid" screen on your phone. You could fake it, but I guess in general people don't, and the "paid" screen does include the merchant's chosen profile image, so you would have to have done your homework to fake it.


But that's only if they don't want to verify themselves. Which is not an issue, really. Or, if they do not have internet, in which case with NFC they couldn't do the transaction at all.

I feel like it's a case of abuse being so rare that they don't care.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: