upvote
I don't. GrapheneOS is worth the effort of pulling a card out of my wallet.
reply
In general I'd agree.

Curve demand a "video selfie" and I've never been comfortable with sending companies such biometric data.

reply
It's infuriating that they won't do this for non Google Android. It's in the best interest of both the bank and the card owner. Credential theft risk goes down to basically zero when backed by a fingerprint authenticated virtual card.
reply
I'm sure contrats between Google and banks provide the financial guarantees that not open-source project would be able to. Unless governments mandate there's zero interest from banks to put extra effort into building for unpopular solutions
reply
What do you mean by credential theft? Stealing the numbers on the card or a malicious person triggering the contactless payment?
reply
Stealing the numbers. Could've been someone taking a photo of the card out of sight. I honestly don't track my card that well when I'm out cause it's easy to have a transaction voided if it's legit not me. Then again cameras are everywhere now.
reply
Banks don't want the headache of supporting multiple weird phone OSes and it's understandable. As long as they don't require running an apple/google-certified device and OS I don't care.
reply
> Banks don't want the headache of supporting multiple weird phone OSes and it's understandable.

Commercially, this makes sense.

I am surprised that most nations of the whole world are fine with every citizen relying on one of two american companies for their lifestyle interactions though. I would have thought more nations would legislate their banks must support other options for sheer sovereign resilience.

reply
> Commercially, this makes sense.

Does it though? The people in this thread are like "just use a card". Well I've done that for years and had my card skimmed, lost, and stolen over the years. The cost wasn't trivial either. The credit card company knocked it off my balance but also lost on sales when I didn't have my card while they issued me a new one. It cost the credit card company actual money in both lost sales and in dealing with the fraudulent transactions.

Now if I was allowed to use my rooted Android phone during those years? It would have been locked down tighter than the vast majority of Windows boxes.

People forget that one of the value-adds of credit cards in the first place is that suddenly you didn't have to walk around with a big wad of cash. Credit cards gave you that extra level of security. Even if someone stole it, it's useless to them as soon as you make a phone call to the CC company. We can verify a transaction with a yubikey-like secret store on your device that never shares the private key with the operating system and which generates a virtual credit card on the fly. That's literally how Apple Pay and Google Pay already work. So whether a device is rooted or whatever literally doesn't matter.

reply
deleted
reply
Does skimming still happen a lot? At least in Europe we have switched from magnetic strip to chip-based cards, which are protected against replay attacks.
reply
We have chips but magnetic strips are still on most credit cards and payments are still accepted that way in many older payments gateways. From what I read on the topic the cost of lost business if this was disabled is greater than eating the cost of skimmer attacks. There is a several year plan to phase it out entirely. It's mostly because initially when chips came out a lot of business owners were angry that they had to buy new payment machines and good luck explaining this to a none tech person.
reply
In the UK, many banks disable the magnetic strip by default, and you have to temporarily enable it from the bank's app/website if you want to use it.

You'd struggle to find a POS terminal that even has a reader for them in the UK. I've only ever had to enable them in the US or Japan.

reply
The US first got magnetic strip readers in 1970 so we just have a ton of infrastructure using them. Since most people drive pickpocketing and things of that nature are much less of an issue for us. Typical use has someone using the card for everything then paying it off at the end of the month so if there's a random extra charge the credit card company will typically let it go to maintain the active user.
reply
whether a device is rooted kinda does matter from this pov as it undoes a lot of the security assumptions on android...

however grapheneos isn't rooted anyway

reply
We're talking about just in time tokens that disappear after use. There's nothing you can do to defeat that on a rooted device. That's the whole point of the entire tech. That's why yubikeys are even a thing.
reply
I'm in Europe, but I had accepted that I had to do without. I hadn't heard of curve, going to check that out.
reply
the Play store reviews for Curve are attrocious, especially the most recent ones. Looks like Curve is absolutely unusable, for many reasons
reply
Garmin pay if you're ok with Garmin is one possibility.
reply
It's even available in my country! Never heard of it, would have assumed it's not being sold here. Let's see what that costs when I click the "shop now" button that's front and center

> Attention required!

> Sorry, you have been blocked

> The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

Thanks cloudflare *handshake* garmin. I suppose I'll stay with chip and pin for now

reply
They don't support amex or capital one, the two I use the most...
reply
They have an app for Android that can do NFC? I thought it was only for their watches. Thanks!
reply
There is no replacement. Strap a credit card to the back of your phone or pay cash.
reply
Use a solvent to dissolve the plastic from the card then epoxy the extracted antenna and chip innards to the back of your phone case. Problem solved. (I'm only 50% joking, you can actually do this but maybe epoxy isn't the best option.)
reply
Somewhat similar, Polar sells a band with an NFC payment chip in it (no experience, just saw it the other day):

https://support.polar.com/en/payment-wristband

reply
Other solutions that use the same underlying technology:

https://fidesmo.com/consumer/wearables/

reply
I'd like to do this, but epoxy it to a dress watch
reply
There are a few other banks running their own NFC payment systems, like Swedbank in my country.
reply
I am not North American, but instead of Google Pay I use my bank's app for contactless payments.
reply
I have these cards I keep in my (RFID-blocking) wallet, one for each credit account. Then I just pull them out and tap to pay. It's super convenient - no app required!
reply
What does RFID-blocking wallet do?
reply
People cannot steal your card info via proximity to your wallet over NFC if the wallet’s physical barrier blocks the RF signal.
reply
People can't steal your card info via proximity to your wallet over NFC even without an RF blocking wallet. This is tinfoil hat security cargo culting, like putting tape over your webcam while leaving the laptop's microphone connected (audio from your room is much more useful than 2834823428 frames of your greasy face).
reply
No but they can steal up to the pin-free amount of money your card allows. They can just hold a sumup to your pocket. Here in Europe most people use debit cards with non-reversible transactions and that limit is often 70-100€ which is quite a lot of money where I live. And they can steal a lot more if they follow you and shouldersurf your pincode.

I definitely use one of those wallets. They're quite convenient too.

reply
[flagged]
reply
Can you please not post aggressively like this? It's against the site guidelines because it destroys what HN is supposed to be for.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

reply
The person mentioned it like it's a feature for them, but I haven't heard of it being anything other than a marketing gimmick, so I was curious for their perspective.
reply
It just has a Faraday cage and blocks radio signals. That's it.
reply
Cash for most things, and just use a card like normal otherwise.

I don't really see the appeal of contactless payment, pulling a card out really doesn't take much time.

reply
Cards are "contactless payment" these days.
reply
Google Pay (Google Wallet) actually also has virtual number so my real card number won't leak in many cases.
reply
Just having to take your phone with you is quite comfortable. Your phone is probably the pocket-sized item you are unlikeliest to lose.
reply
True, but I also need my license to ride my motorcycle or drive a car, plus cash needs to go somewhere.
reply
The perks of living in a city with good public transport

+ my country already has a mobile driver's license app

And most places take card (or nfc via google/apple pay)

reply
Putting my credit card in my phone case
reply