Feeds

NFC SD crew gives up: No one wants our safe bonking tool

When it comes to secure mobe transactions, 2 options are enough

Reducing security risks from open source software

The NFC SD consortium - a collaboration attempting to capitalise on the use of removable memory to secure pay-by-bonk transactions - has called it a day seeing that no one wants to secure transactions using a Secure Digital (SD) card.

The investment, which NFC Times pegs at €3m, came mostly from Giesecke & Devrient but with €900K coming from Phison Electronics. The intention was to provide secure micro SD cards for NFC payments, initially with an integrated NFC antenna, then later using the phone's antenna over the Single Wire Protocol. But the industry is moving towards embedded and SIM-based secure elements, leaving NFC company Device Fidelity holding the flag for removable memory.

The shelving of the plan, which involves bringing staff back in-house and ending the collaboration, isn't that surprising given the way that SD cards have fallen out of favour as secure elements, with embedded and SIM-based options now becoming dominant.

Pay-by-bonk requires two distinct pieces of technology: 1) a radio standard by which the bonking of a phone onto a pad can trigger a transaction (for which Near Field Communications is used), and 2) a secure element with cryptographic tokens to authenticate the user while being entirely separate from the (implicitly insecure) phone OS.

Network operators want the secure element in the SIM, under their control, and have contrived the Single Wire Protocol to connect the SIM to the NFC antenna in the handset, so a customer changing handset can take their bank cards with them seamlessly. Handset manufacturers, conversely, want the secure element in the phone so customers can change network operators seamlessly.

Many banks wanted a third way - a secure element in a removable Micro SD card, with its own antenna or using the SWP, so the customer could change network operators, and handsets, while taking their banking details with them.

It’s a battle for ownership of the customer, and one which the banks have largely lost. The banks had an early lead, deploying large-scale trials only hampered by the iPhone's lack of SD card slot (there's a demographic overlap between iPhone owners and those interested in paying by bonk, enough to prompt several trials using iPhone cases with SD slots in them).

The withdrawal of Giesecke & Devrient isn't the end of the matter, SD Cards will still be pushed by some, but in most markets the question now comes down to whether the secure element should be owned by the network operator (Vodafone, O2, EE) or the platform owner (Apple, Google, BlackBerry), or an unhappy combination of the two. ®

Mobile application security vulnerability report

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Nadella: Apps must run on ALL WINDOWS – PCs, slabs and mobes
Phone egg, meet desktop chicken - your mother
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
White? Male? You work in tech? Let us guess ... Twitter? We KNEW it!
Grim diversity numbers dumped alongside Facebook earnings
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.