Module 18 of 22 · Operator · 60 min
SoftPOS and Tap to Phone
Commercial phones as contactless terminals: where PCI CPoC and MPoC sit, attestation, and what breaks when the terminal is an app on untrusted hardware.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01Three things get called the same thing
- 02What a certified terminal was providing
- 03What the certification covered
- 04PCI DSS already says the quiet part
- 05What moves into software
- 06The Terminal Transaction Qualifiers are now written by an app
- 07The limits live in a file
- 08CDCVM, from the other side of the counter
- 09PIN on glass, and the boundary of what is known
- 10Attestation, and what it can and cannot say
- 11The merchant phone was already in the trust path
- 12One shape, four times
- 13Where the trust used to be, and where it went
- 14The same idea, already tested in the field
- 15How to test one
- 16Why this direction is not reversing