Comments on: ARM Powered Mobile Payments

By: Alban Rampon

Alban Rampon — Tue, 09 Mar 2010 16:57:54 +0000

Hi David,
TrustZone could be called a special environment to which access is regulated. As this is embedded, in order to clone it you would need to reverse engineer at the die level = deprocess the chip.
This is not a matter of obscurity, but this way any keylogger or trojan would be useless and that is the point: working in a safe known environment.
Cheers, Alban.

By: Charbax

Charbax — Sun, 07 Mar 2010 17:53:21 +0000

If I understand this correctly, the PIN is only between you and the phone. So for example someone stealing your phone cannot use it to transfer money or authenticate unless they know your 4 digit pin code. The secure thing towards the web app happens at another highly encrypted level in the hardware which I think is not connected with your pin code. I'd rather have one pin code for net banking, payments, another pin code for all my web apps, than having to type in passwords on web browser sessions and have to think of having a different password for each site for it to be secure, and regularly change the password.

By: David Ashwood

David Ashwood — Sun, 07 Mar 2010 17:16:54 +0000

Security through obscurity isn't.
Tied to the phone? Phone cloning has been around for a long time.
People do reuse passwords but they also reuse PIN's – what would you rather have a 7+char password or a 4 char pin?