Google Wallet - why you shouldn't throw away your wallet just yet

Google has announced, to some fanfare, what it hopes will be a revolution in the way we pay for things: Google Wallet.
Google Wallet is a smartphone app (currently only available for the Nexus S 4G Android phone) that aims to replace your credit cards.
It works like this. You go to a store (let's imagine it's a coffee shop), the barista hands you your steaming skinny caramel macchiato and a toasted onion bagel with low fat cream cheese and bacon, and rather than give them your credit card or reach into your pocket for some coins, you..
* take out your smartphone
* unlock it
* run the Google Wallet app
* enter the PIN for your Google Wallet app
* swipe your smartphone against the coffee shop's pay point.
How convenient!
The Google Wallet app uses NFC (near-field communications) technology in your smartphone to wirelessly debit the credit card you have linked with the application.
Here's a video that Google has produced describing Google Wallet.

Human nature being what it is, some people will be nervous of adopting this kind of technology to pay for goods. Just remember how long it took for some people to switch to using credit cards.
The PIN
It looks like Google recognises that some people will be fearful, and is keen for potential users to know that the Google Wallet app is protected by a four digit PIN.
Unless the PIN is entered, the NFC antenna is switched off - meaning that you can't make any purchases. Similarly when the phone's screen is switched off, the NFC antenna is disabled.
The Google Wallet app insists that you re-enter your PIN every five minutes by default - something that I suspect many users will find irritating, and will change to a longer time period for more convenience and less security.
Another concern I have, though, is whether users will choose sensible PINs to protect their Google Wallet.
When you're waiting to slurp your steaming skinny caramel macchiato and munch on your toasted onion bagel with low fat cream cheese and bacon, will you be entering a PIN code that is convenient or one that is more secure?
Research published earlier this year, revealed the top 10 passcodes that iPhone owners use to protect their devices and we have to assume that Google Wallet users will be just as laissez-faire when choosing a PIN.

We already know that 67% of consumers don't have any form of password on their mobile phones.
It's hard to imagine that all users are going to choose a PIN code for their Google Wallet which is hard to crack, let alone different from the one which they should be using to protect all the rest of their smartphone.
So, if you lose your smartphone and have not chosen a sensible PIN code both for the device and a different one for your Google Wallet then there may be opportunities for criminals to take advantage.
Don't throw away your wallet just yet
I don't want to rain on the parade entirely, however. It's not Google's fault that people might choose dumb obvious PINs or use the same PIN code for their digital wallet as for the device itself (although Google might do some work to reduce the likelihood of those happening, or give an option for longer pass codes).
We may be a long way off throwing away our physical wallets entirely - as folks still like to carry around their receipts, driving license, business cards and some old fashioned bank notes - but we will see mobile devices being used more and more for commerce.
It's going to take some years for merchants to invest in the hardware to provide support for Google Wallet, and some may prefer to wait and see how the market plays out and if a rival option becomes more popular.
Always have a backup
I have one piece of advice though, which will probably hold true for many years to come. Think about this. What happens when your smartphone runs out of juice?
You won't be able to open your Google Wallet app to pay for the late night train ride home if the battery is flat. Then you'll be rueing not having a real credit card in your pocket or a couple of notes hidden in the sole of your shoes.

QR code security risks in the car park

QR codes are a highly convenient way to link a physical object to a URL. Point your phone's camera at the 2D barcode and you're instantly taken to a website.

That's something which can have security consequences, as mobile guru Terence Eden explains.

Recently, Islington Council in London has partnered with Verrus to bring mobile phone payments to car parking.

It's a really simple way to improve paying for parking - but it does leave open some fairly serious security risks.

Initial impressions

The QR codes being used by Islington Council are fairly clearly displayed on the side of the parking meters - but there is no printed call to action.

Which raises the question - what does scanning the code do?

From a practical point of view, would anyone scanning the code know that it allowed them to pay with their phone?

From a security point of view, does the QR code belong to the parking company? Could someone malicious have stuck this code onto the machine?

Unfortunately, there is a problem with the QR code that rang instant alarm bells in my mind.

I spotted instantly that it isn't using an HTTPS URL:

http://m.paybyphone.co.uk/?
utm_source=islington&
utm_medium=qrcode&
utm_campaign=mweb

For a site which asks for a password - and later for credit card details - that seems like a worrying oversight, and isn't going to instill confidence.

In fairness, the site does automatically redirect to the SSL version - but why leave that out of the QR code?

After scanning the code with their mobile phone, this is what the first time user sees:

One thing to note is that most mobile phones won't display the full URL, unless they are in landscape mode.

The URL on display could easily be:

https://m.paybyphone.evilsite.xxx/

Registering

If you've never used the system before, you need to register on this screen:

It is, in my opinion, a very poor idea to require someone to type their credit card number into a phone.

• What if there's a gang of vicious hoodies waiting to snatch credit cards from unsuspecting users as they get them out on the street?
• Is this really a legitimate site? There is no way of knowing, and the switch in branding between "paybyphone" or "PayByPhone" just makes things more confusing and suspicious.

Attack Vectors

The main way of attacking a QR code is to change it. In this case, all it would take would be a large sticker placed on the car parking notice to successfully redirect the user.

In the most mundane case, an attacker could ask the user to visit a malicious website which collects their login details - or worse, their credit card number.

However, a QR code can also be used to point to a premium rate phone number or premium rate SMS. Both could look "legitimate" when placed near a parking meter. A simple and effective way to deprive a victim of their money.

Solutions

QR code hijacking is very rare - but here are a few practical tips for securing a QR code payment service.

1. Include signage telling the user what the code does. Otherwise the user has no way of knowing if the code should point to a URL, phone number, or SMS.
2. Print the URL near to the code. This way if the code is hijacked and pointed to http://evilsite.xxx/ the user can see they're not visiting the correct site.
3. Include https in the URL. Get users used to checking for https before they interact with you.
4. If possible, use a short domain. Not only will it reduce the size of the QR code, it will give your users confidence if they can see the full domain in their phone's URL bar.
5. Don't ask a user to get their credit card out on a busy street. Use a mobile payment solution which charges to the user's phone bill or deducts it from their credit.

QR codes provide a brand new way for people to interact with your service. Make sure that what you offer them is simple, satisfying, and secure.

Disclaimer: The author currently works for InMobi who have a mobile payments product called SmartPay. There are several other cross-network payment solutions, including Bokuor Google Checkout.