Slashdot Mirror
After Rewrites, Google Wallet Still Has Holes
itwbennett writes "A report from viaForensics makes clear that, despite efforts by Google to tighten up security after a poor evaluation in December, Google Wallet still stores data in too many places and could make it available too easily to be a secure way to make purchases using smartphones."
yay
Infiltrated by Google employees and well-wishers, Slashdot consistently offers justifications for every bad behavior and terrible decision coming from Google. Just look at the privacy changes article in which fanboys banded together to make sure Google was perceived as the good guy and that anyone critical of them was modbombed.
Just to recap, Google is a multibillion dollar advertising megacorporation that was caught by the German government sniffing people's wifi data (they "accidentally" did it for three years before admitting it only when authorities threatened an investigation), forced people to use real names on Google+ and admitted it was an identity service and not a social network, stuffed Google+ results into the search engine without any competing social networks even though they have those networks indexed by the search engine (hello, Microsoft tactics), said that the only people who care about privacy "have something to hide," hacked into Mocality to call its customers, removed H.264 support in Chrome out of "openness" only to turn around and ship the closed-source Flash plugin, withheld Android source from the public but shared it with privileged hardware partners so they could have a leg up, abused their Android compatibility program to make things difficult for smartphone makers who chose Bing over Google, and on and on and on.
With all this crap they pull that would get them completely trashed if they were Microsoft or any other company, there's one reason and one reason only that they have been propped up as the good guy on Slashdot all these years--Linux. They use Linux. Slashdot is a Linux advocacy site, and so because Google uses Linux, they are good guys and get a pass for everything. That's all it takes to get Slashdot to love you. Just use Linux.
Hypocrites. When Microsoft used their Windows monopoly revenues to fund development of Internet Explorer and release it for free to try to dominate the web market, everyone here cried "antitrust!" But when Google uses its web search monopoly revenues to fund development of Android and release it for free to try to dominate smartphones, everyone defends it. For anyone who was on Slashdot during those times, to see Google doing all the very same things Microsoft did but get a completely different reaction is surreal.
Slashdot is a bubble. You only get pro-Google, pro-Linux news. Major news occurring elsewhere is often days late, if it gets reported at all. The Google+ search results fiasco is huge all over the tech sites right now, but there's nothing about it here, as if it doesn't even exist as a controversy. And did you know iOS surpassed Android in marketshare by the end of 2011 according to three research firms? With how obsessed Slashdot is over marketshare, and how they constantly trumpeted Android's marketshare all the time as a victory last year, you'd think it would be big news. But, no. This is pro-Google territory, pro-Linux territory. Gotta keep the natives happy for more page views.
This will get modded down because trolls have taken over the moderation system and openly subvert it. That's fine. It just proves my point about how Slashdot reacts to anything outside the partyline. This site's news reporting is old, antiquated, and slow, but the news isn't even why people come here anymore. The part of the community still remaining (after its years-long exodus to Reddit, Hacker News, and other sites, which is why traffic has decreased so dramatically on most Slashdot stories today) only comes here to pat themselves on the back for thinking a certain way. "Yeah, Microsoft is still evil! Yeah, Google is still the good guy! Yeah, Apple is still for chumps!" It's the year 2000 forever on Slashdot.
Front switzerland...
Only faget use Google Wallet. Its like a faget pink wallet with rainbow faget sticker on it. Real man use leather wallet with chain, not some faget online Google faget wallet.
I think it should be noted that the report is behind a paywall.
http://www.14sb.com/
You don't even need a secure area on the smart phone. You could put a thumbprint reader on the phone, then generate a hash from the thumbprint, then use that hash to generate a public/private key pair, then encrypt the credit card details with the details with the public key. The phone would never have to store the private key at all. That is just one of many ideas that would help make this secure. Among others: 1. Require a thumbprint *and* a PIN code 2. Have a uber-long password to reset things in case the thumprint or PIN don't work 3. Have a website to blacklist lost or stolen phones, not just some obscure phone number 4. When talking to other NFC equipped terminals, don't send the credit card data. Have the phone sign a "transaction receipt" with your private key. This would prevent replay attacks and no one would ever even have you card number 5. Create a seperate pay-pal like account that users could put limited funds in, so if their phone was stolen, they would only lose the money in that account and in addition, there could be many cool new features: 1. Put NFC readers on laptops, and use the public key idea for online shopping 2. Use your public key for door locks, and throw away your keychain *and* your wallet 3. Keep a list of transaction details on the phone, then sync up to Quickbooks at night This technology could be super cool if they did it correctly, but as usual it seems to be implemented in the most half-assed way possible. Did these guy even contact and independent security firm to audit this before release? Did they hire someone like Bruce Shnier to architect it securely in the first place? Or did they just have a couple of MBAs, junior devs, and a few legal people draw something up on a whiteboard?
Worried about hackers from Eastern Europe, Rodney's dad used to carry around a picture of the kid who came with the wallet.
It's actually just the opposite.
Slashdot publishes google smear stories practically everyday. Including stories with very little credibility, i.e. stories from personal blogs etc.
Their wallet, checkout, or whatever really does suck. Not just because of security, but because of serious difficulty to setup and use, lack of features, and essentially no help from google.
I have used google wallet, and I have used paypal. Paypal is *far* superior.
I am far from a google hater. I even have some of those weenie google certs in analytics, and google apps. Sadly, Google merchant, and google wallet, are just not worth using.
Google is aware of the many problems with google apps, merchant, wallet, etc. But google only really cares about their bread-and-butter advertising business. Everything else is on a distant back burner. Google services, other than advertising, are things that google employees work on in their spare time - very low priority.
You would think that Google has enough money and perks to hire a few really good IT security experts. Apparently they do not have the corporate culture to do so. Pathetic.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Not interested in paying $1000/yr for a data plan so I can spend my money so easily that I'm less inclined to keep track of it, or so that anybody who can hack my overpriced system can spend my money. Die already. Just. Die.
Google has been experimenting with so many things lately. They are fiddling with self-driven cars, trying to get into home entertainment system , cell phone business etc. I have been a big fan of google, but lately I have been issues with a lot of their products. This is mostly maintainence stuff but it annoys me, especially considering that the products were good and easy to use in the beginning such that I switched to using google stuff for a lot of my day to day activities; Gmail has become slower and every now and then does something weird which forces me to close/reopen the tab Chrome memory usage has gone way up in case anyone is noticing. With the approx same number of tabs and plugins/extensions etc , I see all the different chrome processes add up to the same amount as firefox or even more. I could have sworn it was lesser around 6 months back. Google talk connection quality has gone down The gmail app on android has a tonne of bugs with respect to syncing and notifications. They keep fixing some and creating some everytime we have a new release. Currently, my android is not showing me notifications from Gmail app. I see them only from the stock email app. Now, google wallet earlier got pretty bad reviews for security and even this time around their ratings were not good. I wonder if they can put their weight behind only some of the items and make sure they get out a good product and maintain it properly would that be a better thing to do. I know they recently cancelled some projects, but they still have a lot of projects in a lot of myriad areas.
Not cool at all, product fail.
The key thing to keep in mind about the various Google Wallet deficiencies is that they all require the attacker to get your phone and root it... and he still has less information about and/or ability to use your card than if he'd gotten your credit card. That's not to say that the Wallet issues don't need to be addressed, but it does mean that carrying your credit card in your phone is more secure than carrying your credit card in your wallet.
Bottom line: Google Wallet security isn't as good as it could be, but it's still better than plastic.
Oh, I guess there is one way plastic might be more secure... the phone conducts transactions via RF, so there's still the possibility of someone doing a payment transaction with your phone while it's in your pocket, without your knowledge. Google Wallet addresses that risk in three ways. First, NFC is very short range. 1-2 centimeters with off-the-shelf equipment, perhaps 10 cm in the lab. Second, if your screen is turned off, the NFC payment is disabled. Third, if you haven't entered you PIN in the last few minutes (15?), NFC payment is disabled. In addition, all of the normal credit card risk management infrastructure is still in place, as well as the legal limitations on your liability.
Honestly, the biggest problem with Google Wallet isn't security, it's acceptance. Unless you want to eat at McDonald's a lot, it's fairly difficult to find merchants who can accept it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
One of the dumbest multi-account trolls ever on Slashdot throwing a tantrum that pretty much everyone quickly caught on to his flood of pro-Apple/anti-Google sockpuppet accounts.
Google wallet wasn't even created by google people. It is done by a korean IT company. I interviewed there. I got the drift it would be a 'you work 70 hours a week if you love your job' sort of place. I ran the opposite way. I would say this is more about poor software companies with draconian work conditions producing substandard software than google itself.
It is, after all: **Google** Wallet.
So it certainly has something to do with Google. If it's a Google product, it's up to Google to make sure it works correctly. No matter who Google contracts with.
I couldn't care less about nitpicking about how they store it internally. What is a real problem though, that after I buy something using it (from my PC, mind you), 3rd party programs on my Samsung Galaxy Tab suddenly gain rights to charge me, WITHOUT ASKING my password! (brilliant idea, dear Google) Bum, and you've just purchased non-refundable "5000 Happy Stars" for "Sheeps & Clouds" game for mere 7.99 Euro. How on Earth, after the story with Apple losing the case for remembering password for 15 minutes (!!!), could Google decide that remembering it forever is a good idea, is beyond me.
about security. All they care about is making $$$ and getting as much private information (about the user) that they can use to make more $$$.
... it does have holes: money needs to breathe you insensitive clod. No one wants dead bucks in his pocket.