4 ms·

Apple Pay only tokenizes card information once when the card is added to the Apple Wallet on a device, not for every transaction. This means that usage for an o

Apple Pay only tokenizes card information once when the card is added to the Apple Wallet on a device, not for every transaction. This means that usage for an on-device tokenized card can still be tracked until the card is removed and re-added.

dhritzkiv 5y ago
I believe while the token is generated once, each transaction is signed with a unique signature (I believe that's the term) that only the payment processor can decipher. The merchant doesn't get any stable/identifiable information that can be used to track you across purchases/sessions/stores.
- lxgr 5y ago
  No, the merchant still does get a stable identifier with every payment (the "device account number"). More recently, an additional identifier uniquely identifying the underlying card has also been added [1]. That one persists even across multiple devices and token deletions. [1] https://www.level2kernel.com/payment_account_reference.html https://www.level2kernel.com/payment_account_reference.html
  - dhritzkiv 5y ago
    Interesting! I stand corrected. Thanks.
- ninkendo 5y ago
  A signature doesn't hide information, it only tells you that it hasn't been modified. All the information that's being signed is by definition already in the payload given to the merchant. If it's actually encrypting information (not just signing it), then that's another thing entirely, but signatures don't hide data.
  - dhritzkiv 5y ago
    Good point about a signature not hiding the data. I got my terminology mixed up. I thought it was encoding it in a way so that only the payment processor could see. But that's not necessarily the case either, as somebody else brought up the fact that identifiers ARE in fact passed to the merchant.
imnotrick 5y ago
I think you can also tap a button in the Wallet app that lets you generate a new token
- lxgr 5y ago
  Are you possibly mixing this up with the Apple Card "request new card number" feature? In general, creating a new token requires deleting and re-adding a card.

dhritzkiv 5y ago

I believe while the token is generated once, each transaction is signed with a unique signature (I believe that's the term) that only the payment processor can decipher. The merchant doesn't get any stable/identifiable information that can be used to track you across purchases/sessions/stores.

lxgr 5y ago
No, the merchant still does get a stable identifier with every payment (the "device account number"). More recently, an additional identifier uniquely identifying the underlying card has also been added [1]. That one persists even across multiple devices and token deletions. [1] https://www.level2kernel.com/payment_account_reference.html https://www.level2kernel.com/payment_account_reference.html
- dhritzkiv 5y ago
  Interesting! I stand corrected. Thanks.
ninkendo 5y ago
A signature doesn't hide information, it only tells you that it hasn't been modified. All the information that's being signed is by definition already in the payload given to the merchant. If it's actually encrypting information (not just signing it), then that's another thing entirely, but signatures don't hide data.
- dhritzkiv 5y ago
  Good point about a signature not hiding the data. I got my terminology mixed up. I thought it was encoding it in a way so that only the payment processor could see. But that's not necessarily the case either, as somebody else brought up the fact that identifiers ARE in fact passed to the merchant.

imnotrick 5y ago

I think you can also tap a button in the Wallet app that lets you generate a new token

lxgr 5y ago
Are you possibly mixing this up with the Apple Card "request new card number" feature? In general, creating a new token requires deleting and re-adding a card.