[SuperSU] JW09I4:
I understand the first part, however I am curious as to how you believe gaining access to authentication tokens prior to them being passed to the merchant would not result in what's been proposed by numerous experts within the financial sector.

Regardless of all of that, there is a 0% chance of users being able to use AP, in it's current form, on a rooted device or one running a custom ROM. One can be sure of this for a couple of reasons:

Money. Any dev who discovers an exploit is not going to pass up a fairly substantial pay day to make the exploit of something that isn't critical to one's use of their device public.

Has anyone ever heard of an exploit against a financial institution's secure payment servers being made public to the masses, let alone any information that's ever said secure payment servers have been compromised? That's the apples to apples comparison after all.

It's also highly likely should one attempt to exploit AP to work on rooted devices or custom ROMs, they'd get a visit by the FBI and/or Secret Service and be prosecuted by the federal government for doing so. Since AP acts as a financial institutions secure payment processing servers, an exploit of AP would likely be treated as if the individual(s) attempted to exploit secure payment processing servers.

Again, this is not some trivial matter

If an exploit was ever made public, Google and the financial institutions they protect, would take immediate action to disable AP

For example, financial institutions could block all transactional traffic queried by AP [balance/available credit requests, etc.])

Lastly, Google has made it crystal clear they will not allow AP to function on rooted devices or devices running custom ROMS... I'm inclined to take them at their word since they could easily make it near impossible to root devices and they've repeatedly chosen not to.

It's also highly likely protections were put in place by multiple organizations, private and public.

It wouldn't be surprising if the FTC and FDIC needed to sign off on the protections at some level, and it's almost certain every financial institution supporting Android Pay, including the 4 card brands, as well as the numerous ACHs, also had to sign off on the security implementations put in place.

After all, all financial institutions supporting AP had to agree to give up control of paying out money to merchants.

Additionally, insurance companies who insure banks and ACHs likely had to sign off on the security implementations as well, and it wouldn't surprise me if the insurance companies who insure merchants accepting AP had to re-evaluate risk due to it

It's also a good bet at least one congressional committee reviewed and had to sign off on the protections put in place, as well the contingencies.

---------- Post added at 18:13 ---------- Previous post was at 18:08 ----------

I think my mention of a malicious attack was misconstrued to mean an unsuspecting user... no, it would be individuals doing this purposefully on hundreds or thousands of devices in their possession.

I wish I had bookmarked the articles that were written about this by individuals in the banking sector, as it went into great detail as to what would likely occur not on a general user's device, but on thousands of devices in the possession of either criminal organizations or potentially states who'd like to cause global catastrophe [N. Korea for instance]