Profile

Location

Sydney

Member since

2008

Reads

Lockstep Technologies Constellation Research

Writes about

Security Payments Regulation & Compliance

Stephen's blog archive

2012 (3) 2011 (6) 2010 (6) 2009 (9) 2008 (10)

Stephen Wilson

Managing Director at Lockstep Consulting

Message Posts: 34 Comments: 183

Bio I specialise in data protection, digital identity, privacy engineering, smart technologies and fraud prevention. I run Lockstep Consulting, which provides independent analysis & advice in privacy and identity security, and researches innovative solutions to secure data sharing, verifiable credentials, Card Not Present fraud and identity theft. See ht Career History Over three decades in digital technologies and embedded systems R&D in Australia and the USA. Since 1995, dedicated to digital identity, working for Baltimore Technologies, KPMG, PwC beTRUSTed and Cybertrust. In 2004, established Lockstep Consulting to provide specialist consulting, and to develop novel privacy and safety solutions.

Blogs

Now is not the time to go soft

03 Aug 2012

Online computing represents probably the first new platform in thirty years. Not since the PC have we seen a whole new hardware-software-solution-product environment emerge. It's understandable that there's a mad land grab for app-driven market share. But you'd think that the rush to market would be moderated by a realisation that we ought to b...

How much worse can CNP fraud get?

17 Jul 2012

The Australian Payments Clearing Association (APCA) releases card fraud statistics every six months for the preceding 12m period. For the first time in many years, Australian card fraud has grown in all categories. The ratio of Card Not Present fraud to all fraud remained steady at just under three quarters. An up-turn in skimming and counter

Credit card numbers are like nitroglycerine

13 Jan 2012

It's terrific that merchants are increasingly pushing back on PCI-DSS. It really is high time we shifted the emphasis from ad hoc stop gap compromise measures, onto tackling the real problem: the replayability of account data. Credit card numbers are a bit like nitroglycerine: handle them with great care or they'll blow up! The slightest slip-up,...

Banks really know their customers

13 Dec 2011

A few months ago, the Australian banking consortium BPAY announced the cancellation of its promising and well funded account portabilty MAMBO. What does this mean for the even more audacious plans for federated identity in banking? The US government's National Strategy for Trusted Identities in Cyberspace (NSTIC) envisions using university studen...

See all Stephen's blogs

Stephen is Commenting on

Apple offers to open up NFC payments access to settle EU antitrust probe

Mny thnks Karl. I overlooked the "host" part. Geez, I am rusty on Host Card Emulation but yes, now I remember. That takes us back to the first digital wallet wars when Google was forced into HCE because the handset vendors wouldn't allow access to the NFC chips. Do we really want to do all this again? I know that granting access to the NFC chips is hard. So it should be! But the effort needs to be weighed against the reward of proper hardware security, which HCE cannot provide. Or can it?

23 Jan 2024 Reply Read article

Apple offers to open up NFC payments access to settle EU antitrust probe

The article states: "Apple would create the necessary APIs to allow equivalent access to the NFC components in the Host Card Emulation mode, a technology issued to securely store payment credentials and complete transactions, without relying on an in-device secure element." I want to query the part about 'not relying on an in-device secure element'. As I understand Host Card Emulation, it does use a secure element, just not the same one as in the EMV smartcard. That is, the protocol will use Apple's iPhone enclave. For a bank and a handset vendor to agree to use an NFC chip set to emulate an EMV card, thebank must satisfy itself that the NFC chips are more or less equivalent to EMV chips as "secure elements". It will bethesame logic when a handset's NFC chip set isused to hold an (emulated) eID, e-passport or mDL. If I am correct, then the article might be misleading for it implies that the Apple NFC offering would foresake a secure element. Steve Wilson, Lockstep Consulting.

23 Jan 2024 Reply Read article

Apple to turn iPhone into a payment terminal

Can people please identity themselves? It's hard to thread conersatyions when it's "a finextra member". At least sign off your comments using some handle please.

31 Jan 2022 Reply Read article

Apple to turn iPhone into a payment terminal

"Finextra member" commented "But until now, there hasn't been a payment terminal in everyone's pocket...? When you say 'merchant, doesn't this open things up for mass P2P payments, such as paying a friend?" No, it really doesn't. "Merchant" in a card scheme is a business that has signed up to the scheme Merchant Services Agreement via an Acquiring Bank. This is the guts of my original point: the party that can accept payments in a scard scheme is tightly regulated by the scheme, and must operate under a highly standardised set of rules and contracts. In particular, the merchaint must only use scheme-approved termnals or gateways. I reckon the guts of the Apple announcement must be that a scheme has approved the iPhone (plus a merchant app of some sort) as a terminal. As someone else said, authentication is a must; only approved merchants can be allowed to run such an iPhone app to accept payments.

31 Jan 2022 Reply Read article