Author: Ben Brooks

You’ve likely heard about [Coin][1] (that’s an affiliate link), a new credit card / iPhone pairing that seeks to eliminate you having to carry multiple cards. It even has its own Sandwich video. The product itself looks fantastic, and easy to use too.

And, as surprising as this might be, I pre-ordered one.

If you read this site you are likely to be surprised by that statement because I am a pretty privacy conscious guy. Before I talk about my thoughts on the security of this system, I want to share some non-security — more practical — concerns that I have with this card.

## You Can Change Cards Easily

The first thing I thought when I watched the video was: that’s way to easy to change cards. The Coin shows that, with a push of a button, you can toggle between cards. This is great for the *user* when they are the one in possession of the Coin, but what about when you hand the card to someone else? Sure if you don’t lose sight of the card you can be sure they haven’t changed your card, but what about at a restaurant?

I’m not even assuming anything malicious — just heavy handed use of the Coin seems like it could cycle between cards and potentially net you with a personal charge on a business card.

I really hope this concern is unfounded, and that there is a mechanism in place to prevent accidental changing of your card, but I remain skeptical.

This is all that is said about this concern on the FAQ:

> We’ve designed the button to toggle cards in a way that makes it difficult to trigger a “press” unintentionally. Dropping a Coin, holding a Coin, sitting on a Coin, or putting the Coin in a check presenter at a restaurant will not inadvertently toggle the card that is selected.

That doesn’t instill confidence of any kind in me.

## What’s That?

That’s the question I expect to get when I try to use the card. Maybe you won’t get that in San Francisco, but I know I will get asked that. No matter what I say, I suspect that the cashier will assume something shady is going on.

I can imagine a couple conversations that might prevent me from using the card:

1. “Sir, you can’t use this because we only accept American Express, Visa, and Mastercard. This is neither.” “No, it *is* an AMEX, trust me.” “Sir, this doesn’t look like any AMEX I have seen. Where’s the logo?” “Ugh.”
2. “Ummm, I need the three numbers from the back of the card.” “Sure they are right here (points).” “No, I need the ones on the **back** of the card, there is nothing on the back of *this* card.” “Ugh.”

I think *people* are likely to be the biggest usability obstacles.

## Security

The Coin FAQ has an entire section on security, but it’s not all that reassuring. There are some features of the Coin that makes it a lot better than a normal card:

– Push notification if you leave the Coin behind.
– Card disables if it is out of contact from your phone for too long.

There are two primary security concerns that I see with this product:

1. That you have to give a lot of credit card info to Coin and it is then stored (from the sound of it) on *thier* servers. Now, they will be in compliance with required security standards, but how can we trust them? I don’t know, but I don’t see this aspect as any more risky than storing, or using, a credit card with any *other* company on the web. Be that Amazon, or *this* site. ((For the record I can’t see your full card number — not even if I tried. I verified that with my own account before launching the paywall.))

This is why I don’t see Coin being a big issue — it just doesn’t strike me as any bigger security risk than using your card anywhere else. In addition to that, credit card companies are actually very *good* at fraud prevention and removing fraudulent charges. I wouldn’t link a debit card to the Coin — and I don’t ever use a debit card as I don’t want people to have that direct of access to my cash — but I don’t see any reason to *not* use a credit card with it.

2. I think the next major concern is not with the security of *you* using a Coin, but with others having access to this technology. In other words, Coin sounds like a credit card skimmers dream tool. I have no doubt this presents a security risk, but why should that stop *you* from using the Coin, or any other new technology for that matter. All new technology has inherent security risks that are only figured out through wide usage.

Already waiters have been known to skim credit cards — and the rule of thumb is to not let your card out of your site — but uhh… really?

Coin, for their part, says specifically on this topic:

> The Coin app requires that you take a picture of the front and back of the card, type in card details, and then swipe the card (using a reader we provide) to ensure the card’s encoded magnetic stripe data matches the card details provided. It is not possible to complete these steps unless you are in physical possession of a card. As an additional safeguard, the Coin app will only allow you to add cards you own.

Everything but that last line is moot. My assumption is that I am out to dinner and hand my card over for payment — now the skimmer has physical possession of my card. If that’s the case, what the hell does the last line of that answer mean? How do they verify ownership? Zip codes?

My best guess is that if your card is already registered with a Coin account, it then cannot be registered with *another* Coin account. And if that is the case you are probably *more* secure owning a Coin then you would be if you didn’t own a Coin.

That’s the main flaws I see with the card. The benefit, though, seems to outweigh the risks associated with using the Coin.

If I could truly just carry around a Coin and my ID — well that would be fantastic.

[1]: https://onlycoin.com/?referral=h23SNfFb

[Marisa Taylor][1]:

> Federal officials gathered the information from the customer records of two men who were under criminal investigation for purportedly teaching people how to pass lie detector tests. The officials then distributed a list of 4,904 people – along with many of their Social Security numbers, addresses and professions – to nearly 30 federal agencies, including the Internal Revenue Service, the CIA, the National Security Agency and the Food and Drug Administration.
> Although the polygraph-beating techniques are unproven, authorities hoped to find government employees or applicants who might have tried to use them to lie during the tests required for security clearances. Officials with multiple agencies confirmed that they’d checked the names in their databases and planned to retain the list in case any of those named take polygraphs for federal jobs or criminal investigations.

And:

> “It’s very alarming and McCarthy-esque in its zeal. To put a person on a secret list because they bought the ‘wrong book’ or are associated with someone who did is overly paranoid.”

Do you *still* think that all of this is ok because you “have nothing to hide”? Do you know what books you have bought over the last decade? What software? What YouTube videos you have watched?

It’s ok if you don’t, the NSA knows — and from the sounds of it they are willing to share that information.

[1]: http://www.mcclatchydc.com/2013/11/14/208438/americans-personal-data-shared.html

[Verne Kopytoff on new indoor tracking technology for marketers and retailers](http://www.technologyreview.com/news/520811/stores-sniff-out-smartphones-to-follow-shoppers/):

> Forest City Enterprises uses Wi-Fi to monitor foot traffic in most of the nearly 20 shopping centers it owns or manages. It says the data helped it decide where to move an escalator that was interfering with an entrance. The company also measures how long visitors stay after a fashion show or concert. Stephanie Shriver-Engdahl, Forest City’s president of digital strategy, says the company wants to know, “Do they get one soda, hop in the car, and leave? Or are they staying longer?” In the future, foot-traffic data could be used to set lease prices, she says.

Man I hate this stuff. I’m tempted to keep WiFi off on my iPhone until I need it, as LTE is fast enough 80% of the time.

On the other hand, from the retailer perspective, this is going to be a big deal as they struggle to compete with Amazon and the suggestions it makes to customers.

The iPad mini (retina) A7 appears to run slower than the iPad Air’s A7 does, this likely is a heat saving and power saving maneuver, [as Matthew Panzarino notes][1]:

> The reduction may be due to thermal profiles which prevent the device from getting uncomfortably warm to the touch, a complaint with some previous models of iPad. Many iPad Air owners and reviewers have noted that the tablet does not have the same warming issues even with heavy use.

Interestingly I hadn’t noticed that my iPad Air gets hot at all. With the iPad 3 there were many times it would be very warm, hot even. The iPad mini got warm, but never hot. The iPad Air, as best as my memory tells me, has yet to even feel noticeably warm. Even after gaming, Geekbenching — no warmth.

That may be the most impressive upgrade to the iPad line thus far.

#### Side Note

Panzarino [links to this Geekbench result][2] that is assumed to be the new retina iPad mini, clocking it at 1390/2512 on Geekbench 3. That seems to be on par with the iPhone 5s and just slightly lower than the iPad Air. We will need a lot more data points before anything definitive can be shown here though.

What’s more interesting to me is the speed jump from the original iPad mini which clocked in at: 261/495. That’s almost comical to think about in comparison to what the iPads are putting out today. Amazing, really.

I cannot wait for new applications to come out that take advantage of all the CPU power in the newest round of iPads.

[1]: http://techcrunch.com/2013/11/12/retina-ipad-minis-a7-runs-at-1-3ghz-same-as-iphone-5s-and-slightly-below-ipad-airs-1-4ghz/
[2]: http://browser.primatelabs.com/geekbench3/201561

[Charles Arthur][1]:

> That means that Google has gone from having at least 31m users on the iPhone in April 2012 – and perhaps as many as 35m in September 2012, based on a model using a sliding scale of maps ownership – to around 6.3m who are using it monthly on iOS 6 and above.

That his concluding paragraph — the rest of the article says this (more or less) several times over. That’s a massive hit to Google. These numbers are survey numbers and not comprehensive, and therefore should not be taken as gospel — still they show a very disturbing trend for Google.

Mapping is important, but it is important to Google and Apple in different ways. Google uses mapping as a direct source of income (sponsored listing, targeted ads, other creepy things), where Apple uses mapping as indirect income: mostly as a feature to their iOS platform, just another selling point for the device.

So whereas Apple could survive if they killed their mapping client all together (because users could install alternatives), ((Yes, still a lot of people would complain, but even *you* would buy a new iPhone if it didn’t have a native maps app.)) Google would take a substantial revenue hit if they lost all mapping. It’s in that light that I highly doubt the explanation for why Apple switched from Google maps is any more convoluted than: we don’t want to make money for our competitor.

[1]: http://www.theguardian.com/technology/2013/nov/11/apple-maps-google-iPhone-users