6 ms·

> It rolls a new number every time I use it, so i can pay at sketchy gas stations at 2 AM Nope. That's deliberately confusing Apple marketing. You get one PAN

> It rolls a new number every time I use it, so i can pay at sketchy gas stations at 2 AM Nope. That's deliberately confusing Apple marketing. You get one PAN per device. The new "number" is just the EMV unpredictable number. You get that with any EMV card. https://emvlab.org/emvtags/show/t9F37/ https://emvlab.org/emvtags/show/t9F37/ > and not care about skimming. Because the PAN is only valid for online authorized EMV transactions.

anamexis 7y ago
So, yep? They didn't claim it was a unique feature of Apple Pay.
- needusername 7y ago
  They make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a "token" instead of a PAN is used for the transaction. This is very misleading. If you read it very carefully they are not wrong, but for the uninitiated a wrong impression is crated. They are using an industry standard protocol that is 25 years old.
  - reaperducer 7y ago
    suggest that a "token" instead of a PAN is used for the transaction Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.
    - bcrosby95 7y ago
      Your average customer doesn't know what either really mean.
      - lilyball 7y ago
        I know that a "token" is some value that is used in the transaction. I still have no idea what a PAN is.
        MXfive 7y ago
        Primary account number, the 16 digit card number.
  - function_seven 7y ago
    > but for the uninitiated a wrong impression is created I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.
  - sjwright 7y ago
    You are right that the core of Apple Pay security is functionally identical to chip and contactless transactions. However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used. This reduces the scope for downgrade attacks.
    - alextheparrot 7y ago
      Insightful commentary on some of the value-adds of Apple Pay. I do wonder if the security gain is significant enough to make Apple Pay integration a gross-positive for all parties. Apple appears to charge a ~0.1-0.2% fee per transaction made via Apple Pay [0], so it might be reasonable that the security adds enough value in its own right to make sense from a fraud/insurance perspective. Might also be the fact that possibly being "Top of wallet" on Apple Pay (Which users might use anyway, irrespective of if their normal card is supported) provides enough value to take a small hit in fees. [0] https://appleinsider.com/articles/16/02/22/apple-halved-transaction-fee-to-get-apple-pay-into-china-report-says https://appleinsider.com/articles/16/02/22/apple-halved-tran...
    - muppetman 7y ago
      I live in New Zealand and both Google Pay and my Garmin watch have unique numbers. This doesn't seem to be Apple exclusive at all? I have 2 Garmin watches, 2 Google Pay capable devices and a single physical card and the numbers are all different. At least, the last four digits are.
      - sjwright 7y ago
        Nobody said it was an Apple exclusive. But to be fair, after trying to do payments in various other ways, Google eventually built their Android payments platform to be an almost perfect 1:1 recreation of Apple Pay. (And this is a recurring theme with Android. I'm not saying Google aren't within their rights to build things however they wish, but it is remarkable how often Google make loud smug noises about how they've done things differently to Apple—only for those points of differentiation to quietly disappear a few years later. Say what you will about Apple, a company that makes plenty of horrible mistakes, but it's remarkable how often they do get things exactly right the first time.)
jonknee 7y ago
Yes, so unlike almost all the gas pumps before that used just the mag stripe it's much more secure. Contactless at the pump is great.
bret791 7y ago
Mostly there, you get a tokenized PAN (DPAN) for every card enrollment. Remove, and re-add a card to your digital wallet and you'll get a new DPAN. The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ https://emvlab.org/emvtags/show/t57/ ) DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.
- CKN23-ARIN 7y ago
  > Remove, and re-add a card to your digital wallet and you'll get a new DPAN. Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?
  - SiNTEx 7y ago
    Only possible problem I can think of is that you would trigger some of the fraud rules on Apple’s, network’s or issuer’s side as all theses parties have the ability to trigger yellow or red flows during the token provisioning. You would then probably have to call your issuer for assistance every time you want to provision new card to your device.
  - robk 7y ago
    Why would you do this?
    - CKN23-ARIN 7y ago
      So that retailers won't be able to use DPAN to uniquely identify me across transactions.
      - divbzero 7y ago
        On the flip side, the ability to look up your past purchases can enable returns without receipts. The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.

anamexis 7y ago

So, yep? They didn't claim it was a unique feature of Apple Pay.

needusername 7y ago
They make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a "token" instead of a PAN is used for the transaction. This is very misleading. If you read it very carefully they are not wrong, but for the uninitiated a wrong impression is crated. They are using an industry standard protocol that is 25 years old.
- reaperducer 7y ago
  suggest that a "token" instead of a PAN is used for the transaction Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.
  - bcrosby95 7y ago
    Your average customer doesn't know what either really mean.
    - lilyball 7y ago
      I know that a "token" is some value that is used in the transaction. I still have no idea what a PAN is.
      - MXfive 7y ago
        Primary account number, the 16 digit card number.
- function_seven 7y ago
  > but for the uninitiated a wrong impression is created I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.
- sjwright 7y ago
  You are right that the core of Apple Pay security is functionally identical to chip and contactless transactions. However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used. This reduces the scope for downgrade attacks.
  - alextheparrot 7y ago
    Insightful commentary on some of the value-adds of Apple Pay. I do wonder if the security gain is significant enough to make Apple Pay integration a gross-positive for all parties. Apple appears to charge a ~0.1-0.2% fee per transaction made via Apple Pay [0], so it might be reasonable that the security adds enough value in its own right to make sense from a fraud/insurance perspective. Might also be the fact that possibly being "Top of wallet" on Apple Pay (Which users might use anyway, irrespective of if their normal card is supported) provides enough value to take a small hit in fees. [0] https://appleinsider.com/articles/16/02/22/apple-halved-transaction-fee-to-get-apple-pay-into-china-report-says https://appleinsider.com/articles/16/02/22/apple-halved-tran...
  - muppetman 7y ago
    I live in New Zealand and both Google Pay and my Garmin watch have unique numbers. This doesn't seem to be Apple exclusive at all? I have 2 Garmin watches, 2 Google Pay capable devices and a single physical card and the numbers are all different. At least, the last four digits are.
    - sjwright 7y ago
      Nobody said it was an Apple exclusive. But to be fair, after trying to do payments in various other ways, Google eventually built their Android payments platform to be an almost perfect 1:1 recreation of Apple Pay. (And this is a recurring theme with Android. I'm not saying Google aren't within their rights to build things however they wish, but it is remarkable how often Google make loud smug noises about how they've done things differently to Apple—only for those points of differentiation to quietly disappear a few years later. Say what you will about Apple, a company that makes plenty of horrible mistakes, but it's remarkable how often they do get things exactly right the first time.)

jonknee 7y ago

Yes, so unlike almost all the gas pumps before that used just the mag stripe it's much more secure. Contactless at the pump is great.

bret791 7y ago

Mostly there, you get a tokenized PAN (DPAN) for every card enrollment. Remove, and re-add a card to your digital wallet and you'll get a new DPAN. The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ https://emvlab.org/emvtags/show/t57/ ) DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.

CKN23-ARIN 7y ago
> Remove, and re-add a card to your digital wallet and you'll get a new DPAN. Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?
- SiNTEx 7y ago
  Only possible problem I can think of is that you would trigger some of the fraud rules on Apple’s, network’s or issuer’s side as all theses parties have the ability to trigger yellow or red flows during the token provisioning. You would then probably have to call your issuer for assistance every time you want to provision new card to your device.
- robk 7y ago
  Why would you do this?
  - CKN23-ARIN 7y ago
    So that retailers won't be able to use DPAN to uniquely identify me across transactions.
    - divbzero 7y ago
      On the flip side, the ability to look up your past purchases can enable returns without receipts. The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.