Jon Evans
More posts from Jon Evans
When I leave my home, I check that I have three things: keys, wallet, phone. How long will it be until the first two are obsolete? My wallet has only three things I actually need: credit cards, cash, ID. Any American with an iPhone 6 has already obsoleted credit cards, courtesy of Apple Pay. Any Kenyan, Senegalese, etc. with a phone has long obsoleted cash, courtesy of M-Pesa, Orange Money, etc.
As for ID, well, if you’re in Iowa, just wait: “Iowans will soon be able to use a mobile app on their smartphones as their official driver’s license … sometime in 2015.” Can the other 49 states be far behind? Well, yes. But will they be? I doubt it. Expect a profusion of government ID apps sometime over the next few years.
In America, cash is still the real sticking point for wallet replacement. Maybe, if we’re lucky, Coinbase, ChangeTip, and other Bitcoin startups will eventually drag America up to near-equivalence with African e-cash. I certainly wouldn’t go expecting American banks and carriers to do it.
What about keys? Already set. KwikSet’s Kevo locks (I would link to their site, but there’s an incredibly annoying autoplaying video with audio on their home page, so forget it) let you use Bluetooth LE to open your home. Lockitron (which has a much nicer home page, go click on them instead) does much the same. Both also let you send temporary e-keys to guests, a very cool feature not available for physical locks.
So in principle, if you live in Iowa, and don’t much use cash, then as soon as next year, you can buy one of those electronic locks and get rid of your keys and wallet forever…
…but you probably won’t. Because if you ask me, the real obstacle barring key/wallet replacement isn’t apps; it’s redundancy. Lose your phone today, and you can still pay for a ride home and let yourself in. But if your phone doubles as your key and your wallet, then if/when it’s lost or stolen, you are suddenly screwed beyond belief.
Especially since most online services are moving to two-factor authorization, in which the second factor is … a code sent to your phone. Which in turn is much more vulnerable than your keys or wallet. You don’t spend half your waking time waving the latter two around.
So: I predict that within the next 2-3 years, many of you will be able to replace your keys and wallet with your phone — but few if you will actually do so, until and unless the redundancy problem is solved.
Various solutions do immediately occur, but all are imperfect. The ability to temporary download your phone’s authorizations/settings onto a new/borrowed phone? Maybe, but that sounds like a key-management security nightmare to me. (Private encryption key, not physical door-opening key.) Temporary authorization for a friend or trusted service who can take you home and open your door? Again, not without its own flaws.
Oh yes. And remember: unless you own a Blackphone, you don’t control your phone. Its manufacturer does, its carrier does, and whoever wrote its OS does, but you probably don’t have root on its main microprocessor, and you definitely don’t have root on its baseband processor or its SIM card. Do you really want your every financial transaction, your entire legal identity, and your access to your own home to be dictated by a device controlled not by you, but by multiple separate mega-conglomerates? With absolutely no fallback to dumb incorruptible brute-force real-world entities such as steel keys and $50 bills?
I too would like to leave my home with only my phone and leave my keys and wallet in the past where they belong. But it seems like before we do that en masse, we need to solve the same problems that seem to be erupting everywhere else around our world, both online and offline: redundancy, security, and trust.
Comment