4 ms·

They make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a

They make it sound like there is a special "Apple sauce" that they built and strongly suggest they generate a new PAN for every transaction. The suggest that a "token" instead of a PAN is used for the transaction. This is very misleading. If you read it very carefully they are not wrong, but for the uninitiated a wrong impression is crated. They are using an industry standard protocol that is 25 years old.

reaperducer 7y ago
suggest that a "token" instead of a PAN is used for the transaction Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.
- bcrosby95 7y ago
  Your average customer doesn't know what either really mean.
  - lilyball 7y ago
    I know that a "token" is some value that is used in the transaction. I still have no idea what a PAN is.
    - MXfive 7y ago
      Primary account number, the 16 digit card number.
function_seven 7y ago
> but for the uninitiated a wrong impression is created I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.
sjwright 7y ago
You are right that the core of Apple Pay security is functionally identical to chip and contactless transactions. However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used. This reduces the scope for downgrade attacks.
- alextheparrot 7y ago
  Insightful commentary on some of the value-adds of Apple Pay. I do wonder if the security gain is significant enough to make Apple Pay integration a gross-positive for all parties. Apple appears to charge a ~0.1-0.2% fee per transaction made via Apple Pay [0], so it might be reasonable that the security adds enough value in its own right to make sense from a fraud/insurance perspective. Might also be the fact that possibly being "Top of wallet" on Apple Pay (Which users might use anyway, irrespective of if their normal card is supported) provides enough value to take a small hit in fees. [0] https://appleinsider.com/articles/16/02/22/apple-halved-transaction-fee-to-get-apple-pay-into-china-report-says https://appleinsider.com/articles/16/02/22/apple-halved-tran...
- muppetman 7y ago
  I live in New Zealand and both Google Pay and my Garmin watch have unique numbers. This doesn't seem to be Apple exclusive at all? I have 2 Garmin watches, 2 Google Pay capable devices and a single physical card and the numbers are all different. At least, the last four digits are.
  - sjwright 7y ago
    Nobody said it was an Apple exclusive. But to be fair, after trying to do payments in various other ways, Google eventually built their Android payments platform to be an almost perfect 1:1 recreation of Apple Pay. (And this is a recurring theme with Android. I'm not saying Google aren't within their rights to build things however they wish, but it is remarkable how often Google make loud smug noises about how they've done things differently to Apple—only for those points of differentiation to quietly disappear a few years later. Say what you will about Apple, a company that makes plenty of horrible mistakes, but it's remarkable how often they do get things exactly right the first time.)

reaperducer 7y ago

suggest that a "token" instead of a PAN is used for the transaction Maybe because people know the word "token" and don't know what a "PAN" is. Apple has built a trillion-dollar company by speaking at the level of its customers, not technobabble.

bcrosby95 7y ago
Your average customer doesn't know what either really mean.
- lilyball 7y ago
  I know that a "token" is some value that is used in the transaction. I still have no idea what a PAN is.
  - MXfive 7y ago
    Primary account number, the 16 digit card number.

function_seven 7y ago

> but for the uninitiated a wrong impression is created I'm somewhat uninitiated, and I definitely got the wrong impression. So thanks for your clear-up.

sjwright 7y ago

You are right that the core of Apple Pay security is functionally identical to chip and contactless transactions. However a seemingly trivial but important difference with Apple Pay is that it doesn't use your physical card number—instead it uses a different card number randomly assigned to your device. The payment networks can therefore recognise Apple Pay-assigned numbers and know to demand full Apple Pay authentication when they are used. This reduces the scope for downgrade attacks.

alextheparrot 7y ago
Insightful commentary on some of the value-adds of Apple Pay. I do wonder if the security gain is significant enough to make Apple Pay integration a gross-positive for all parties. Apple appears to charge a ~0.1-0.2% fee per transaction made via Apple Pay [0], so it might be reasonable that the security adds enough value in its own right to make sense from a fraud/insurance perspective. Might also be the fact that possibly being "Top of wallet" on Apple Pay (Which users might use anyway, irrespective of if their normal card is supported) provides enough value to take a small hit in fees. [0] https://appleinsider.com/articles/16/02/22/apple-halved-transaction-fee-to-get-apple-pay-into-china-report-says https://appleinsider.com/articles/16/02/22/apple-halved-tran...
muppetman 7y ago
I live in New Zealand and both Google Pay and my Garmin watch have unique numbers. This doesn't seem to be Apple exclusive at all? I have 2 Garmin watches, 2 Google Pay capable devices and a single physical card and the numbers are all different. At least, the last four digits are.
- sjwright 7y ago
  Nobody said it was an Apple exclusive. But to be fair, after trying to do payments in various other ways, Google eventually built their Android payments platform to be an almost perfect 1:1 recreation of Apple Pay. (And this is a recurring theme with Android. I'm not saying Google aren't within their rights to build things however they wish, but it is remarkable how often Google make loud smug noises about how they've done things differently to Apple—only for those points of differentiation to quietly disappear a few years later. Say what you will about Apple, a company that makes plenty of horrible mistakes, but it's remarkable how often they do get things exactly right the first time.)