Tap-to-Pay: proof that it's safe

[bittelc]

The following is a user-request by @wing in Discord (source).

Are you planning a whitepaper or technical overview on walt.is outlining the relationship with your tokenisation partner, what's stored on-device for token refresh, etc?

I'm cautious of marketing language.
"Your transaction data stays on your phone" - I can believe that, big win.. 
"Your card details never leave your device" - I'm sceptical this is strictly true as you still need to tokenise with your partner somehow.
"Your card details aren't stored on your device or on walt.is servers" - but this I could believe.
 
A transparent write-up of what makes private payments work is where you build trust. Marketing fluff won't cut it with GrapheneOS types :)

I think people will understand that when dealing with cards/payments there will be some privacy lines necessary to cross, you're dealing with some really big fish to make this possible and being so up front about Walt is so refreshing to see. 

Closed source is a non-issue for me personally.

Use this GH Issue for discussion about how to grant users peace of mind when tap-to-pay goes live.

[bittelc]

Some progress on the "proof, not marketing" front. Research note on what a credible proof actually looks like: an EMVCo SBMP (Software-Based Mobile Payment) security evaluation. Before tap-to-pay can go live, the Walt app has to pass an independent, accredited-lab security evaluation from Visa and Mastercard.

Comapnies like Applus that certified Vipps MobilePay could be a good option here.

[wurstsemmel]

I would feel more comfortable if the complete app is open source to allow an independent code review.

[bittelc]

Ah yes, great comment @wurstsemmel and thank you for coming to this issue!

I have written in Discord a few times, but I need to write it somewhere more officially (which is probably not quite official enough, here), but Walt can't open source the tap-to-pay functionality. This is because of the audits that Visa and Mastercard require Walt to go through.
The 3rd party audits disapprove of open source applications, as they pose a larger security risk with a wider attack surface. I actually don't have a firm opinion on the position they've taken so I won't comment on whether or not I support or disapprove of that opinion.
But the result is that the tap-to-pay functionality cannot be open sourced. Only the Passes kernel here can be open sourced.

So this Issue is about brainstorming other ways I can achieve community trust, without being able to meet the gold standard of open sourcing it.

[wurstsemmel]

Thank you for explaining the reasons, that makes me understand much better the situation. IMHO threema.com is doing a pretty good job for being recognized as very secure although being at least partly closed-source (as far as I remember).

I am happy to see your enthusiasm and whish you all the best and lots of success in your endeavour to convince all involved players to embark on a European Google Pay / Apple Pay alternative.

[bittelc]

Ah super interesting, hadn't heard of Threema before. Thank you!

I'll be coming back to this issue in a couple months, when tap-to-pay gets closer.

In the meantime, if you get more ideas of how I could demonstrate security and authenticity of security, please come back and comment!