9 ms·
I unabashedly love apple pay and use it preferentially whenever I can. in the US, it's faster than chip-and-pin cards by a LOT. It rolls a new number every ti
by hprotagonist 7y ago
I unabashedly love apple pay and use it preferentially whenever I can.
in the US, it's faster than chip-and-pin cards by a LOT. It rolls a new number every time I use it, so i can pay at sketchy gas stations at 2 AM and not care about skimming. More and more gas stations are upgrading their pump POS pads so i can refuel my bike without digging under my armour for my wallet.
On websites, my only quibble is that it's often very hard or not possible to enter discount codes or other special checkout options like "pick up in store" when using the apple pay button(s); when I don't have any codes, I dearly appreciate not having to make an account for that merchant and i'm significantly more likely to spend money at websites that support it.
- needusername 7y ago> It rolls a new number every time I use it, so i can pay at sketchy gas stations at 2 AM Nope. That's deliberately confusing Apple marketing. You get one PAN per device. The new "number" is just the EMV unpredictable number. You get that with any EMV card. https://emvlab.org/emvtags/show/t9F37/ https://emvlab.org/emvtags/show/t9F37/ > and not care about skimming. Because the PAN is only valid for online authorized EMV transactions.
- anamexis 7y agoSo, yep? They didn't claim it was a unique feature of Apple Pay.
- needusername 7y agoThey make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a "token" instead of a PAN is used for the transaction. This is very misleading. If you read it very carefully they are not wrong, but for the uninitiated a wrong impression is crated. They are using an industry standard protocol that is 25 years old.
- reaperducer 7y agosuggest that a "token" instead of a PAN is used for the transaction Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.
- function_seven 7y ago> but for the uninitiated a wrong impression is created I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.
- sjwright 7y agoYou are right that the core of Apple Pay security is functionally identical to chip and contactless transactions. However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used. This reduces the scope for downgrade attacks.
- 7y ago
- jonknee 7y agoYes, so unlike almost all the gas pumps before that used just the mag stripe it's much more secure. Contactless at the pump is great.
- bret791 7y agoMostly there, you get a tokenized PAN (DPAN) for every card enrollment. Remove, and re-add a card to your digital wallet and you'll get a new DPAN. The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ https://emvlab.org/emvtags/show/t57/ ) DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.
- CKN23-ARIN 7y ago> Remove, and re-add a card to your digital wallet and you'll get a new DPAN. Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?
- SiNTEx 7y agoOnly possible problem I can think of is that you would trigger some of the fraud rules on Apple’s, network’s or issuer’s side as all theses parties have the ability to trigger yellow or red flows during the token provisioning. You would then probably have to call your issuer for assistance every time you want to provision new card to your device.
- robk 7y agoWhy would you do this?
- CKN23-ARIN 7y agoSo that retailers won't be able to use DPAN to uniquely identify me across transactions.
- divbzero 7y agoOn the flip side, the ability to look up your past purchases can enable returns without receipts. The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.
- jhenkens 7y agoI have actually started preferring 76 stations because they all support the 76 app which lets me pay without credit card. My card was skimmed (and recreated into a new physical card!) earlier this year, which almost certainly happened at a gas station.
- hprotagonist 7y agoI'm holding out; i don't want to install yet another app, i want to wave my watch at the thing and have gas come out without mobil knowing more about me.
- reaperducer 7y agoBack in the 90's Mobil had a little thing you put on your keychain that did this. It was shaped like a plastic tube about the size of a match, but thicker. I don't know what happened to it. My guess is that since most gas stations are small businesses, they didn't want to pay to upgrade all of their pumps.
- judge2020 7y agoI find myself using these systems more as well. Publix, Kroger, and Walmart all have respective apps where you can scan a QR code on the screen (for both non-self-checkout and self-checkout) and pay using a card on file. Although, I think I use them only because they've chosen to not support Apple Pay and other mobile payment providers.
- tzs 7y agoI'd continue using the Walmart app to pay in their stores even if they did start supporting Apple Pay on their terminals. That's because those sales show up as being in the "online shopping" category for my credit card despite actually taking place in store, and I've got a card with very good cash back rewards for online shopping.
- bdcravens 7y agoShell and Exxon have the same.
- Cu3PO42 7y ago> It rolls a new number every time I use it, Are you positive about this? When I used Apple Pay (in Germany) I always got the same card number. It was my understanding that the number is generated when you add a card to Wallet and is unique to your device, but not transaction. EDIT: The Apple support site [1] claims the following: > Full card numbers aren’t stored on the device or on Apple Pay servers. Instead, a unique Device Account Number is created, encrypted, and then stored in the Secure Element. I believe this aligns with my understanding. [1] https://support.apple.com/guide/security/credit-debit-prepaid-card-provisioning-sec0f005981a/web https://support.apple.com/guide/security/credit-debit-prepai...
- jbtule 7y agoThe device "card" number doesn't change with each purchase but it does have an additional one-time unique crytpogram as well as a dynamic security code that is needed to use that device number.
- sevencolors 7y agoI believe OP means it generate a new payment token that's sent over for each purchase
- madeofpalk 7y agoThat is not a unique feature of Apple Pay. It happens for any contactless 'card' payment.
- Spivak 7y agoRight but Apple, Android, Samsung, Walmart, NBCUniversal, TacoBellFritoLaySnappleGroup Pay are pretty much the first contactless payment platforms to really gather steam in the US. Visa and MasterCard didn’t have the advantage of a phone platform that make contactless payment actually more convenient than magstripe so the value in rolling it out was pretty low.
- 7y ago
- thom 7y agoYeah, absolutely love it. Just by virtue of breaking the £30 limit for contactless payments I now just never need my wallet. For a long time I held off upgrading my previous iPhone, and it never really occurred to me that Apple Pay was a killer app, but it's probably the single biggest quality of life upgrade that a piece of technology has given me in 5 years or so. My only sadness is that not many websites support it - where they do, you don't have to type out endless steps in a wizard, just give a thumbprint and that's it.
- gregmac 7y agoNot sure how contactless limits are set, but I suspect it's by the merchant. In Canada most are $100, though there's a handful of places that do $200. Costco is $400. If you go over the limit, you get promted to insert your card and use a pin. Signing a signature is basically obsolete - in fact I can't remember the last time I did. Restaurants usually have a wireless terminal they bring over. It's strange how regional those types of things are though. I am always surprised traveling in the US when I'm asked to sign (even with chip or contactless, which makes zero sense).
- thom 7y agoI believe in the UK it's by the card issuers as a security measure (it's definitely a flat £30 for most cards). They're happy to be liable for that amount a few times until the fraud prevention measures kick in, but not more. Apple's appetite for risk is perhaps a little bigger. I don't think I've signed anything for 10+ years tbh, but the UK went pretty heavily for chip and pin early one. But honestly it's a coinflip whether I remember my pin these days.
- oneplane 7y agoApple probably requires fully authenticated bi-device on-line transactions making the risk much smaller. The EMV part requires the merchant device to be online or the process won't happen and the phone part requires user authentication; you'd have to break both at the same time to abuse it. Probably still possible, but much harder than stealing a card and using it until you hit the limit or get flagged. Probably also why EMV contactless without PIN and EMV contactless with PIN have different limits (amount of transactions and transaction amounts).
- rconti 7y agoAlso, overseas with a US CC you almost always have to sign, even if you have a PIN on the card, because the card are set to prefer signature (sometimes you can get away with a PIN; eg, in a parking garage with no cashier). However, with Apple (okay, now Garmin) Pay, I never have to sign.
- hakfoo 7y agoI went to the UK last year and made great efforts to contact Citibank in advance to get a PIN added to my card. When it finally arrived in the mail (a week after request, literally hours before my flight), it turns out it's not even a Chip-and-PIN PIN, it's for cash advances. I still did a lot of signing reciepts and waiting for poor underpaid M&S cashiers to sort things out.
- Z3UX 7y agoAren't you confusing Apple Pay vs Apple Card? I think only Apple Card as the beaver you talk about, rolling a new number every time you use it.
- awinder 7y agoThe lack of discount codes for Apple Pay always puts me in a quandary of whether I want to just save the time or if it’s worth the hassle. From my experience it seems like I run into a lot of Shopify-backed sites, so I’m not sure if this is due to inherent Apple Pay problems or if it’s that a widely-deployed solution doesn’t support it.
- jdminhbg 7y agoAs far as I can tell, that's just poor design on Shopify's part. You can work around it by adding a discount code while checking out with a different method, bailing out, then going back through Apple Pay. It's kind of crazy that it's been broken for so long.
- hermanradtke 7y agoApple’s UX guidelines make things like discount codes and expedited shipping harder to implement.
- pfranz 7y agoI've never implemented it, but their examples show expedited shipping and it looks pretty straightforward. https://applepaydemo.apple.com https://applepaydemo.apple.com Unfortunately, their docs are explicit about discount codes, "Do not ask the user to perform any other tasks before presenting the payment request. For example, if the user needs to enter a discount code, you must ask for the code before they press the Apple Pay button." https://developer.apple.com/library/archive/ApplePay_Guide/CreateRequest.html https://developer.apple.com/library/archive/ApplePay_Guide/C...
- huebomont 7y agoWhy? Just make me choose shipping and discount options, then present me payment options. All Apple needs to know is the total to charge. Shopify just fucks this up by only having an option to enter a discount code after you've already missed your change to choose Apple Pay.
- tzs 7y agoAnother nice feature thing about Apple Pay (and maybe some others?) is automatic updating. Some place I could not use Apple Pay with was involved in a breach, and so my bank notified me that I was getting a new card, and to start using it as soon as it came in the mail. At about the same time as I got the email notice that this was happening, I got a notification on my iPhone that the card had been updating in Apple Pay to the new one. No action was required on my part. I have no idea how they did that. I know there is a credit card updater service provided by at least Visa, MC, Discover, and AmEx that allows merchants with those cards on-file to ask for updates. We use that where I work, but the interface to it involves posting a file that contains one record per card we want updated in a fixed field format straight out of the punched char days (but wider than punched card). Then, typically in two or three days, a similar file comes back with update records for some of those cards. More updates trickle in that way over the next few days. And some never get a response. Anyone know what it takes to get access to the kind of updates Apple is getting, where apparently the banks push the updates and they are very timely? Is this something only very high volume entities can get?
- Wowfunhappy 7y agoThat's cool, but it must not be universal, because I've always had to re-setup my debit card.
- jimktrains2 7y agoIt's up to the issuer to support the service, not just the company charging the card. https://developer.visa.com/capabilities/vau https://developer.visa.com/capabilities/vau
- derrick_jensen 7y agoI've come across this in the Stripe API as a standard feature of a lot of cards. I haven't had one do this myself, but I also haven't lost a credit/debit card.
- hanley 7y ago
- commandar 7y ago>More and more gas stations are upgrading their pump POS pads so i can refuel my bike without digging under my armour for my wallet. This is literally the first time I've heard a use case that would actually make me care about contactless versus a swipe/insert. Grabbing my phone off the RAM mount would be considerably easier pulling my gloves off and trying to fish out my wallet. In the past, I've always been incredibly apathetic toward the "convenience" factor of contactless, but that's a real -- if niche -- win.
- fphhotchips 7y agoI've always found contactless to be significantly faster than insert and more reliable than swipe - have you not found the same thing?
- Consultant32452 7y agoI find insert/chip is much slower because I have to leave the card in the device and pay close attention to the screen to figure out when I'm allowed to remove it. With a swipe pulling my card out, swiping, putting card can in wallet is a single action.
- fphhotchips 7y agoSure, but that's not contactless, that's chip and pin. Contactless is exactly that; you need not touch the machine (though many do).
- 72deluxe 7y agoI always thought it would save you touching the communally-used PIN pad and thereby avoid potential contagion.
- blntechie 7y agoIf you have an Apple Watch, you don’t even have to grab the phone.
- ogre_codes 7y agoNot only is the actual authentication faster, most of the time when I use Apple Pay signature is not required. Even with large transactions it blasts right through and prints out a no-signature receipt. It's all stuff which I never cared much about but definitely enjoy when it works right. It doesn't hurt that with the Apple Card I get 2% cash back when I use the phone.
- djannzjkzxn 7y agoTo clarify for readers (doesn’t matter for you), terminals that support Apple Pay probably also support tap room pay with credit cards that have that feature. It’s just as fast as Apple Pay (once you have your card out).
- artificial 7y agoWould you say it’s faster without having to use FaceID?
- djannzjkzxn 7y agoI’d say if you’re already using your phone while waiting in line, Apple Pay is faster. Otherwise, tapping a credit card is faster.
- hinkley 7y ago> not having to make an account for that merchant I had forgotten that was a thing. I'll have to remember to reach for the phone the the next time I'm ordering something off of a second- or third-choice website.