UPDATED:Why the Secure Enclave could change credit card transactions forever

 by D@LY3D

The iPhone 5S Secure Enclave
[Via Daring Fireball]

Fascinating piece on Quora by Brian Roemmele on the new “secure enclave” in the A7 SOC of the iPhone 5S. (That’s where the encrypted fingerprint biometric ID is stored.)

Imagine what Apple could have come up with if they were still capable of innovation.

[More]

Apple maybe ready to kill NFC. Here is the key paragraph:

There are dozens of applications and use cases on the roadmap and I am certain a developer economy will build around this amazing technology.  One that is very clear is retail payments and Apple will have quite a number of unique ways they will solve real problems for merchants and iPhone users.  I can say this aspect of Touch ID will be more magical then what we have seen thus far.  There will be connections to iBeacons and the amazing technology Apple just acquired through Passif.

The secure enclave, which holds your fingerprint data, means that the iPhone is tied directly to you. no one else can pretend to be you and use it.

This means that, in addition to using the fingerprint to turn on the phone, the whole system also makes secure mobile transactions possible, based on your fingerprint.

It is the combination of software of the OS with the hardware of the fingerprint scanner and the crafting of the CPU that makes this all work. No one else can really do this to the level Apple can. This will drive really secure transactions, ones that no thief can easily hack, if at all.

iBeacons are an Apple attempt at using low power Bluetooth to send and receive data. Most people have looked at their ability to allow stores to localize where you are and send you ads.

But the iBeacons can receive data also. That data could be credit card information. What happens when the iPhone becomes a super credit card, validated by your fingerprint, secured by a special enclave and usable only by you? 

Here is one possible example:

A normal credit card is not tied directly to you, which is why anyone who possesses it can use it.

There are NFC systems which allow digital credit card transactions, where the phone is brought close to a receiver to send credit card information.

Unfortunately, NFC systems are just as secure as a plastic credit card. So, if your phone is stolen and hacked, they can get what they need to ruin your credit. They can just take the phone around to buy stuff. You have to make phone calls. It’s like dealing with a stolen wallet. 

A pain but no worse than today for a real credit card.

But Apple will do something very different. They may make super credit cards out of your Phone, by combining iBeacons, fingerprint ID and the secure enclave:

And there’s one last trick that the new iPhone 5S has in favor of a mobile payment system using wireless services like iBeacon: positive user identification. This could come courtesy of the phone’s built-in fingerprint sensor, which means the iBeacon system has the following set of authentication data: The user’s phone is physically present in a retail location; the phone is properly ID’d, and shares coded payment data in the right way; and that the user of the phone, and thus the owner of the payment card, is positively identified as being with their device. Added together that equates to a level of security that makes credit card signatures on a slip of paper look positively medieval in comparison. Even an NFC payment interaction looks unimpressive compared to this.

Imagine you are at a restaurant and read to leave. You take your iPhone and hit the home button. The restaurant uses an iBeacon to send the bill to your iPhone. You hit pay and the credit card transaction is completed – assuming proper security can be created here.

No need to wait for the waiter.

No need to carry a wallet with credit cards when your iPhone will do it.

(Yes, this will only work if proper security is used. I would not expect Apple to be pursuing this if proper security cannot be maintained. If someone can just grab your credit card information out of the air, then security is not very useful.)

Your iPhone is stolen? You can wipe it yourself with little worry because the new iOS 7 cannot be wiped without fingerprint authentication or your Apple ID password. If the battery is drained or the iPhone is rebooted, it requires a passcode to do anything. a passcode you created.

The phone is pretty much useless by anyone else if they steal it.

As several state Attorneys general stated:

In the months ahead, it is our hope that Activation Lock will prove to be an effective deterrent to theft, and that the widespread use of this new system will end the victimization of iPhone users, as thieves learn that the devices have no value on the secondary market.

So why steal an iPhone when it will be impossible to do much with it? Your iPhone is yours and no one else’s.

Men may not longer have to sit on that big fat wallet. You may be able to decide just which credit card to use by tapping a button.

All because your iPhone is yours and no one else’s.

UPDATE: Not too surprisingly, I am not the first to see this. Mike Eigan at Computerworld discussed using BLE for payment  by Apple a year ago. He wrote:

In restaurants, credit card transactions would continue to require servers to make two trips between the table and the cash register — one to carry the card to the register for approval, and the other to punch in the tip and file the signed credit card slip.

For its part, Google Wallet would require just one trip — for the waiter to bring an NFC device to the table.

But Apple iWallet users wouldn’t need the server at all: They’d just pay on the phone and go.

And then on Sept. 14 he wrote in more detail about all this.

But the real purpose of Touch ID is to authenticate users. “Yes, it’s really Mike Elgan — go ahead and process that payment using his credit card on file with iTunes.”

 Just like I wrote. And no one else will be able to compete with this for some time.