We'll pay by smartphone, but let's not pay for dumb security

Computerworld - It's a new dawn, people! As of today, you can walk into just about any Starbucks store and pay for your latte using nothing other than a (free) iPhone app, coupled to an existing Starbucks card account. That's right -- the day of mobile electronic payments is here at last! Ta-dah!

I will pause for the fanfare that it is sure to follow.

Still waiting.

OK, so, new infrastructure improvements don't often get much fanfare -- witness the DNSSEC and IPv6 rollouts.

Nonetheless, we truly (and finally) seem to be on the cusp of a whole new era in mobile payments. By most analyst accounts, the next generation of smartphones is sure to tackle mobile payments in a serious way.

There's a lot riding on the infrastructure for this. A stupid design mistake today can have long-term impact on all of us. Witness the (mostly) European Chip and Pin payment card system.

Researchers at Cambridge unearthed a design defect in the Chip and Pin system over a year ago. The defect enables a fraudster to make unauthorized payments using any valid (or cloned) Chip and Pin card, without needing either a PIN or a signature. (To be fair, that defect hasn't much slowed down Chip and Pin usage. With some 750 million of these cards in use, that's not going to change overnight, but rest assured that the card issuers are well aware of the problem.)

If a new payment system is rolled out to consumers only to be quickly cracked by attackers, no one wins. I'm not saying there are problems with the new Starbucks system (which was in testing for some time in limited markets). But if it does come to pass, the customers lose, the company loses and in the end, technology suffers a setback -- all quite possibly because of some silly design decision that failed to take attackers' capabilities into account.

I have the utmost confidence that a mobile payment system can be designed and implemented securely. If the engineers follow sound security principles, it's certainly within reasonable expectations that we'll have a ubiquitous and secure mobile payment system in the next few years. (I'm referring to something more general in purpose than the Starbucks system.)

But we can't afford bad judgment. Even well-intended security mechanisms can be implemented poorly. Take Apple's hardware encryption of the iPhone (and other iOS devices), for example. All sensitive files on the file system are encrypted in hardware using AES with a key that is unique to each device. Sounds brilliant, right? Certainly, this is the stuff of breathtaking sales literature -- in which the security features are the hero for a change.