To much fanfare MasterCard just launched their new PayPass Online not to be confused with their PayPass Wallet NFC offering.

We’ve packed a whole lot of choice into one ingenious, little button. You see, the PayPass checkout button not only lets you use our PayPass Wallet to checkout quickly and securely, it lets you use any digital wallet offered by a PayPass partner.

I applaud them for trying but unfortunately it is flawed on many different levels. They missed a great opportunity, but they don’t even seem to fix the fundamental security issues in the existing network.

First the good:

OAuth 1.0A
User only enters payment information once
User only enters shipping information once
Example code for Java/.NET/Android/IOS
Partner’s can create their own wallets

Now the very bad:

No OAuth 2
Returns full credit card account to merchant (yes you read right)
Very complex flow
No embedded payment functionality
Reliance on 3rd …

The recent breach proves again that no amount of security theater can secure a fundamentally flawed payment system. A lot can be done to improve payments, but I fear it is impossible to do it on top of the existing infrastructure.

For historical reasons the banking industry thinks in messages. When you perform a payment the terminal sends a message across an age old network encompassing many different servers, parties and businesses.

A payment likely hits one or more of the following parties:

Merchant
Payment gateway reseller
Payment gateway
Aquiring Bank
Credit card association
Intermediary banks
Issuing bank

Each one of these parties provide an opportunity for a breach.

What makes it even worse is that to authorize a payment, the entire security is based on the merchant sending the card and consumers details along in the message to authorize the payment.

If a breach happens anywhere along that whole list of …