Nokia Launches Pay-By-Phone Service 34
adeelarshad82 writes "The world's top mobile phone maker, Nokia, said it would launch a mobile financial service next year targeting consumers, mainly in emerging markets, with a phone but no banking account. Nokia's Money service was based on the mobile payment platform of Obopay, a privately-owned firm that Nokia invested in earlier this year, and it is now building up a network of agents. Obopay, which uses text messaging and mobile Internet access, charges users a fee to send money or to top up their accounts."
GSM Security? (Score:3, Interesting)
Last time we were trying to push USSD based 'small payment system' in GSM networks, the Central Bank (of that country) launched an independent study which found that security practices in GSM networks were below standards to permit financial transactions. Cloning and some weaknesses in A3, A5 and A8 (and other algorithms/mechanisms) played major concerns.
TFA does not mention anything about security, but, I was wondering how exactly they would take care of this.
Re:O2 just started doing this in the UK (Score:5, Interesting)
It's been going on in Africa for quite a while. It sounds like they are just investing more in owning the full process so they can make more profit from what is already going on and will surely be growing. The cell phone companies in much of Africa have essentially become the banks for many people, and of course the vast majority of phones you will find there are Nokia phones.
I was in a meeting last friday with a guy from a communications lab at the University of Central Florida. He is working on distance learning with smart phones. I think we may be doing a test study with them in Kenya next year. We were primarily focused on the education software part of it, but much of the discussion also dealt with microloans and transferring of funds via this method. We would like what we do to be self sustaining. It's really some very exciting stuff I think, but I may be a bit biased.
Not directly related to the article - but they are using Android as their primary platform. I'm stoked about that too because I think Android is going to be huge down the road.
GSM Security? There isn't any. (Score:3, Interesting)
GSM only authenticates one way, not both, so it is almost ideal setup for man in the middle attacks. One of the presentations at last year's CCC, the 25C3 [events.ccc.de] covered this, but you can find plenty of older and newer material on it elsewhere.
Any GSM phone-based payment system has some big challenges. GPRS could be better, since you can then run something behind SSL or SSH. However, even then, when it comes to money, the designers must design the system on the assumption that the network is insecure, perhaps even the endpoints.