Please create an account to participate in the Slashdot moderation system


Forgot your password?
Mozilla Businesses Firefox Open Source The Almighty Buck

Mozilla Introduces Experimental Open Payment System For Firefox OS 68

hypnosec writes "Mozilla has developed an open payment service API to support app purchases in Firefox OS, and has released a draft version allowing app developers to process payments. Pointing out the drawbacks of the different models for payments on the web that are currently available, Mozilla has revealed that it is looking to introduce a common web API that would make payments through web devices easier and more secure while being flexible and retaining today's checkout button features that are available for merchants. Partly based on Google Wallet, Mozilla's WebPayment API will remain open to ensure that it is used by a wide range of payment service providers. As a first step towards this, Mozilla has introduced the navigator.mozPay function, allowing web apps to accept payments."
This discussion has been archived. No new comments can be posted.

Mozilla Introduces Experimental Open Payment System For Firefox OS

Comments Filter:
  • More Data (Score:2, Interesting)

    by Anonymous Coward

    Not only does every website want me to create a profile and stores all my purchase details (email, phone, address, credit card) for *my convenience*, the software I use wants to do it to. Windows 8, Ubuntu (I'm not sure. Does the software center remember your info?), many cell phones, every app-store with punchable software, pay-to-play games, and now even Firefox.

    I hope they protect access to prevent your kids from buying things without permission. I hope the data can't be accessed from any website base

    • Re: (Score:2, Interesting)

      by Anonymous Coward
      I agree, I do not trust websites and these devices enough yet to place my sensitive info on them, it's still like the old wild west out there. Don't put your credit card information on your kids devices, to keep control of this, I sideload any apps onto my kids devices.
      • You ain't the only one AC, I have gotten to the point that if a site doesn't support paying through Amazon I don't buy from them as i'm tired of having so damned many places having too much data. I've had my card replaced something like 3 times in the past 2 years because of some dumbass at some website screwing the pooch and I'm just sick of it.

        And i'm not giving the OS jack shit, Ballmer can jerk off at the thought of a 30% cut of all software all he wants I'm following my business customers and hangin

    • As an Ubuntu user (Xubuntu), I can answer your question. I've never had to fill anything out to use the OS, but if you want to buy something from the Software Center, you need a Launchpad Account, not so bad really; if you're writing bug reports anyway. Afterwards when you buy your Software, you can have the site remember your info. I always choose not to, you'll need to enter it again if you buy something else. But that's all, nothing at all needed to get the free software or use the OS. =)

      I understand wha

  • How do you prevent an user from trivially modifying the Javascript in the app to not require payment?

    • by Mythmon ( 893588 )

      How do you prevent a user from trivially modifying a normal, compiled from C installed on my desktop app such that it does not require payment? In the end, you can't. The mechanisms that are effective in this case are the same mechanisms that can be used in JS.

      • Modifying x86 or x86-64 machine code embedded in COFF or ELF is slightly more complicated than modifying Javascript source.

        • You don't need to modify the file, just the code in memory. And it's not that hard for most software, otherwise we wouldn't need layer upon layer of protections, like DEP and ASLR.

    • by nametaken ( 610866 ) on Saturday April 06, 2013 @03:06PM (#43380161)

      Presumably your postback handlers at the server aren't going to validate a payment for [zero dollars as converted from the price point arg].

      In any case, no payment schema allows the client to change the price without screwing up a signed request or failing validation at the server... this was considered somehow.

    • "How do you prevent an user from trivially modifying the Javascript in the app to not require payment?"

      I was wondering this myself, and I don't think any of the replies so far actually address this issue. In Mozilla's example, they are using JavaScript to create a "JWT", but this is necessarily exposed in user-accessible code, and I do not see how it can be called "secure". They give lip-service to two-part authentication but don't then go on to explain where the other part comes in, which leaves me dubious.

      Further, what is to prevent someone from modifying the JS at the "postback" URL to capture the retu

  • by msporny ( 653636 ) * <> on Saturday April 06, 2013 @03:01PM (#43380119) Homepage

    Hi, I'm the chair of the Web Payments group at the World Wide Web Consortium (W3C). Just pointing out that the Mozilla mozPay() API is part of a greater push in the standards community to make payments a core part of the Webs architecture. This includes buying/selling digital goods, donations, crowd-funding, all the way to equity and loan-based crowd-financing for start-ups. Note that the mozPay() API is centralized, which even folks at Mozilla will tell you is not ideal. The eventual goal is to create a decentralized payment architecture that is designed for the Web from day one. We plan to put these advanced financial tools into the hands of all Web developers so that anyone with a website or blog has access to this open financial network.

    You can read more about the PaySwarm standardization work here, which is mentioned at the end of the Mozilla mozPay() blog post: []

    The first commercial implementation of these specifications launched three days ago: []

    If you're interested in following what's going on, join the Web Payments group at W3C: []

    • by Anonymous Coward on Saturday April 06, 2013 @03:15PM (#43380207)

      HOLY CRAP! a talking chair!

      Just because the wallet is near you when people sit on you. Does not make you entitled to any of the money.

    • by stacat ( 2890063 )

      Note that the mozPay() API is centralized, which even folks at Mozilla will tell you is not ideal.

      In what sense is it centralized? Locked to a single payment service provider?

      • by msporny ( 653636 ) * <> on Saturday April 06, 2013 @04:16PM (#43380457) Homepage
        The mozPay() API is built so that Mozilla has a whitelist of organizations that are allowed to be vendors. You have to get permission from Mozilla to get on that list, and that's not very Webby. That said, Mozilla will be the first to admit that this isn't ideal and that they want to move toward a more decentralized solution. They designed it this way because decentralized payments is a really hard problem and they didn't have time to solve it and launch FirefoxOS at the same time. Luckily, we (Digital Bazaar and other folks at the W3C) have been working on decentralized payments for years and have a working solution that we're coordinating with Mozilla on trying to find a way to get it integrated with the mozPay() API.
        • This is great, if Mozilla ensures that no one gets on the list. This will prevent web payment from ever taking off, a net gain for humanity.

    • Whatever you guys do, make sure it's not yet another USA-only thing.

      • by msporny ( 653636 ) *
        PaySwarm is currency agnostic and is designed to support both national currencies and alternative currencies like Bitcoin and Ven.
        • How is the issue of currency conversions addressed?
          • by msporny ( 653636 ) *
            In the beginning currencies will be exchanged at whatever the market rate is, automatically. So, if you are sending USD to someone that only has EUR accounts, the amount will be converted automatically based on current market rates and deposited into their account as EUR. The future plans hope to bypass the currency exchange markets for a more direct model, like Ripple, that doesn't have currency exchange fees that are as high as most international banks utilize today.
        • Whatever you guys do, make sure it's not yet another USA-only thing.

          PaySwarm is currency agnostic and is designed to support both national currencies and alternative currencies like Bitcoin and Ven.

          That doesn't address GP's point - Google Play Store supports alternative currencies and yet still remains US-and-UK-only. What GP (and myself) would like is a system that lets anyone from any country be a vendor. Unless I'm mistaken (IOW, correct me if I'm wrong) your system allows anyone to pay, but not just anyone to receive payment, just like Google Play and countless others? Merchants have to be resident in one of perhaps five countries?

          If I'm correct (and I heartily agree that I may not be - perhaps

          • by msporny ( 653636 ) *

            The PaySwarm specifications allow anybody to implement the specification and interoperate on the network. So, if your country doesn't have a PaySwarm Authority, there is a huge incentive for somebody to launch one in your country.

            In our system, anybody (in any country) can become a vendor. At the moment, we only deal in USD, so if you want to withdraw your money, you need a bank that can talk to the US banking system (many international banks can already do this).

            The only thing preventing us from branching

            • Thank you for that informative reply - I wish your efforts with payswarm take off, if only to ensure that non-US merchants can finally get paid
        • by elucido ( 870205 )

          PaySwarm is currency agnostic and is designed to support both national currencies and alternative currencies like Bitcoin and Ven.

          If it supports Bitcoin then I think your idea will be a major success. Bitcoin is the only way micropayments could work for the mainstream because it's deflationary. I suggest you also take a look at Devcoin as well because it seems to be important for what you're working on.

          • by msporny ( 653636 ) *
            PaySwarm will eventually support Bitcoin. However, that is a separate issue from the one of doing micropayments. They're two orthogonal concerns. They do have a slight bit of overlap, but not enough to tie the design either of the solutions to one another. +1 to Devcoin. You might also want to check out Gittip: [] We can support both with PaySwarm (since PaySwarm is currency agnostic). It's also fairly trivial to setup something like Gittip using PaySwarm (recurring payments). More he
    • by kipsate ( 314423 )
      Quoting linked page:

      There are a number non-interoperable solutions today; PayPal, Amazon Payments, Flattr, Google Checkout, Ven, Bitcoin, BankSimple, Square, and KickStarter are a few examples

      Obl. xkcd []

      • by msporny ( 653636 ) *
        ... and none of those are open, patent and royalty-free Web standards. You could argue that Bitcoin is such a beast, but it is more of a financial protocol and currency wrapped into one. PaySwarm will eventually support Bitcoin as a currency (along with hundreds of other currencies), so there is no real conflict there. Sorry, but this is Slashdot. If you're going to link to XKCD, you should at least make sure that what you're linking to is a good analogy. :P
    • It's a week late for Aprils Fools Day.

    • A word of warning - you don't get to call it "open" if there are ANY restrictions on usage. US currency clearly states that it is "legal tender for all debts public and private". That's the model you need to emulate, not self-righteous scumbags like PayPal and Google. Any system that restricts such things as gambling, adult media, sexual services, cash transfers, etc is a closed, proprietary financial system and the world is already polluted with far too many of those. When I can sell porn, poker, hookers,
      • by msporny ( 653636 ) *
        Things that are legal in most states: gambling, adult media, cash transfers. Things that are illegal in most states: sexual services, selling hookers (human trafficking), and blow (drug trafficking). Payment services tend to avoid gambling and adult media because there is a huge fraud problem with them, and in the grand scheme of things, they're not as profitable as the vast majority of other "safer" transactions. Cash transfers require a huge amount of money to get a license to operate in all 50 states i
    • by dargaud ( 518470 )
      I have a question... Why hasn't this been implemented in 95 ? There was a real need for a micropayment system at the time: everybody was talking about it, and then it got more or less replaced by credit card purchases, which took a long time to gain traction and are only use for larger payments anyway. Napster would have been different if there'd been a micropayment option in it !
      • by msporny ( 653636 ) *

        The short answer is that there aren't a lot of people working on the problem. There are 7,000,000,000+ people in the world. There are 60 people in the Web Payments Working Group at W3C, of which only around 10 are actively working on the problem. It's a hard problem and there aren't that many programmers, systems engineers, standards makers, writers, bloggers, lawyers, etc. that are willing to put in the hard work to solve the problem. If you think this is an exception to the rule, you'd be wrong. There are

    • by elucido ( 870205 )

      How do you intend to compete with Bitcoin technologically? Bitcoin seems to have every technological advantage over your product.
      This is a serious question because lately Slashdot has become very much pro-Bitcoin and for something like micropayments Bitcoin makes more sense than dividing pennies into a fraction of a penny which would be pretty much worthless to most users.

      • by msporny ( 653636 ) *

        Bitcoin isn't a technological competitor, it's a currency. Bitcoin isn't going to be the last currency of its kind, there will be many Bitcoins just like there are many currencies today. Each one is fit for the group of people that uses the currency. The PaySwarm standard is a financial protocol and is thus currency agnostic. We plan to support Bitcoin, and Ven, and a variety of other currencies.

        You could argue that Bitcoin is also a protocol, but that is where Bitcoin is fairly weak. Instead of building Bi

  • anything for stuff that wants "acces to your private date", "access to
    your harddrive", "access to the network" that I haven't got the source
    code for.

  • Question: Does this count as an in-app payment?

    Because you could consider a browser an app, would this fall under the purview of the in-app purchase patent that's being enforced out of East Texas?

    • by msporny ( 653636 ) *

      It could count as an in-app payment and I have no idea if the in-app purchase patent you're talking about applies, nor am I going to go take a look at it: []

      Our experience in this area, after looking at lots of patents, is that they tend to be badly written and/or easily easily worked around. We did file provisional patents for the technology in 2004 to establish prior art for the express purpose of ensuring that nobody else could patent the technology and that we

  • by A beautiful mind ( 821714 ) on Saturday April 06, 2013 @03:04PM (#43380153)
    The current mostly advertisement supported model that's dominant on the internet is warping how we interact with each other and how we use services - reminds me of a bad mix of Orwell's 1984 and The Matrix (the part where humans are used as batteries).

    I'd gladly pay for a lot of content on the internet, but currently I either don't have the option or the pricing is outrageous - scientific articles and newspaper subscription comes to mind as being way overpriced. We need microtransactions and the first step is building the infrastructure to make it possible. Things like instead of surveillance supported services like facebook are the step in the right direction.
    • by Anonymous Coward

      That sounds great. In theory.

      In reality you'll be seeing ads AND paying too. They'll be gathering all the data about you. AND you'll be paying too.

      They're not going to give up anything they've gotten upto now just because you started paying them...

      I'll pass.

    • by msporny ( 653636 ) *
      PaySwarm, which is part of the Web Payments work at the W3C, supports micro-transactions. All transactions in the system are accurate up to 0.0000000001 of a fraction of the currency specified. See this for more details: []
    • by Kjella ( 173770 )

      I think someone should soon start to make a standard form for why microtransactions won't work like we have for SPAM, I mean I've heard this now for a decade now? Two? And it never materializes, I think most of all because each transaction is either a hassle or an invisible drain on my bank account. Pay-per-minute Internet died in favor of flat rate even though it'd probably be rational for those who use it little to have a metered connection, but the simplicity of just paying a fixed sum won out. Ads may b

    • If you lookup Bitcoin it seems to be all about making micropayments possible. I think Bitcoin might ultimately resolve this problem.

  • This sounds like a great step forward.

    The article says: “Mozilla plans to work with other vendors through the W3C to reach consensus on a common API that supports web payments in the best way possible. After shipping in Firefox OS, Mozilla plans to add navigator.mozPay() to Firefox for Android and desktop Firefox.”

    I would add that those discussions at W3C should not only include “other vendors”, but also other stakeholders, internationally. This is a way too important topic to be

    • by msporny ( 653636 ) *
      PaySwarm is currency agnostic, so it can support all national currencies, as well as alternative currencies like Bitcoin and Ven. We don't have Bitcoin support in there yet, but it's on the roadmap and we hope to sooner than later. There are regulatory issues that we have to work through. More here: []
  • by ma1wrbu5tr ( 1066262 ) on Saturday April 06, 2013 @03:51PM (#43380345) Journal
    It seemed like it took forever for Firefox 1.0 to be released back when I was using Firefox .8 and .9. I remember people sarcastically complaining numerous times in the forums back then that the developers were trying to create an operating system and not a browser. Well, here we are a little over 10 years later talking about Firefox OS's new payment system. I wonder how much, if any, of that source code from the pre-one-point-oh release is still in Firefox today. Is there any of it in FFox OS? I know I sure never thought there would be a market for a Firefox OS back in 2003. Kudos to the mozilla team.
    • Two things.

      XPCOM is still in there.

      There isn't a market for FirefoxOS today, so its not like anything changed from 2003, or hell, even the 90s.

      This is just another example of Netscape employees doing whatever random thing they feel like working on rather than focusing on something coherent. Mozilla will die the same painful slow death that Netscape did. The reason Mozilla exists in the first place is that all the shitty Netscape devs needed somewhere to go work after the first one fell apart when Sun real

      • There isn't a market for FirefoxOS today

        By what measure?

        its not like anything changed from 2003, or hell, even the 90s.

        Oh right, the monopoly continues to bite us in the ass.

        Mozilla will die the same painful slow death that Netscape did.

        I don't see that happening. Mostly because at this point Mozilla isn't being financially strangled by a company leveraging a monopoly.

        The reason Mozilla exists in the first place is that all the shitty Netscape devs needed somewhere to go work after the first one fell apart

  • []

    Congrats Mozilla, you officially don't get the Internet any more.

  • by Anonymous Coward

    Makes me think of Mozilla Persona, which is their project to unify log-ins (in a better manner than openid, etc). I'm a big fan.

"The number of Unix installations has grown to 10, with more expected." -- The Unix Programmer's Manual, 2nd Edition, June, 1972