10 ms·

Misunderstanding about the details of how Apply Pay works

277 points by CharlesW 3y ago

moi2388 3y ago
Nice post!
mikestew 3y ago
Where did Gruber say that “only Apple Pay does this”? The writer goes on to point out a few mistakes (or rather, didn’t quite get the details right) Gruber made, and that’s seems to be it.
- cassianoleal 3y ago
  Yeah there's a very big difference between "Apple Pay does this" and "only Apple Pay does this". It seems like Gruber said the former, but the author somehow read the latter.
- addicted 3y ago
  > I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Birchler points out that the banks did do this. And Gruber has acknowledged his mistake. Gruber is an open fanboi but for the most part he would at least get his facts straight and would be open about what he didn’t understand and would link to experts in the field. However, since the EU DMA actions on Apple he seems to have completely lost his objectivity. First by pretending to understand the legalese better than apparently the EC does, then by applying American lawmaking approaches to European ones which are very different and then finally by taking Apple’s bad faith statements at face value (Gruber’s turn has coincided with Apple’s very weird bad faith approach to the EU so maybe the fundamental issue is his trust in Apple). And he seems to be carrying over that to the U.S. govt’s antitrust action as well. Also, to be fair, social media is absolutely filled with Apple people pretending to be legal experts but being completely wrong about almost everything. So it might be hard for him to even see opposing viewpoints from legitimate folks.
  - madeofpalk 3y ago
    Gruber never pretends to be objective - he likes what he likes, and he dislikes what he dislikes. Notably, he has a pretty strong "pro-business" streak in him that objects to anything resembeling workers rights or unions, and government regulation/interference in businesses. The EU tends to do a lot of that, so overall he's very critical of it. And at the moment there's a lot of governments telling Apple what to do, so it's the perfect storm of getting his knickers in a twist constantly.
    - lnxg33k1 3y ago
      [flagged]
    - kemayo 3y ago
      I don't think I've seen him do opposition to workers rights / unions? He hasn't been constantly yelling about supporting them either, but that's different. E.g. a quick google for "daring fireball unions" turned up mostly articles like this one which were pro union-demands: https://daringfireball.net/linked/2021/11/24/wirecutter-union https://daringfireball.net/linked/2021/11/24/wirecutter-unio... Closest to a negative I found in that quick search was him making fun of the Maryland Apple Store union that was asking to be allowed to request tips from Apple Store customers... while also saying that the rest of their demands sounded like good things to ask for.
      - MBCook 3y ago
        Oh man I had forgotten about that.
  - ineedaj0b 3y ago
    I think you should reconsider your judgement on the EU ruling being good. If you can’t argue the EU ruling is bad (and not because Apple is greedy or shortsighted etc), you are missing something. Apple has a vision - the EU has a vision and they do not align. The EU is poor. It has been mismanaging itself for years: they should be doing better than they are. Is this caused by outside vectors or the leadership, or maybe the structure (too many cooks in EU kitchen)? Is the vision of the world the EU wants 15-25 years out strong? Is the world the EU would create good for the EU - 30 years out? I’d argue it’d be a comfortable one. But a poor and weaker one. I’m not trying to defend Apple. I’m trying to say that the EU leadership is likely bad - my hunch is anyone truly good would work in the state department of the respective nation. Kinda like how UN ambassadors for the US are never our best - our best maybe might once in a blue moon take the post like a retirement phase. Now take the ruling, are you sure they made a smart long term move?
- lnxg33k1 3y ago
  https://daringfireball.net/linked/2024/03/21/garland-monopoly?ref=birchtree.me https://daringfireball.net/linked/2024/03/21/garland-monopol... [Update: Whoops, I was wrong about that. Matt Birchler, who works in the payments industry, has a great explainer about how this works, and it turns out major banks and credit cards do generate per-merchant “DPAN” numbers for tap-to-pay transactions. I stand by my argument that Apple Wallet is at least as, if not more secure than, any digital payment app provided by a card issuer.] --- From the original author (Gruber)
  - ryukoposting 3y ago
    The DOJ doesn't have a case, but WOW the last paragraph of that blog is an extraordinary wall of brand fellatio.
    - lnxg33k1 3y ago
      Brand fellatio has just become my new favorite concept :D
    - internetter 3y ago
      Gruber has always been an Apple fanboy, but in the past few months it's taken a turn into ragebait territory, and i'm this close to stopping reading it
      - ksec 3y ago
        How many things that most people ( within Apple Fans circle ) commonly believes that are plain wrong was started by him? Apple invented USB-C and turned it over to USB-IF The original AirPod was sold at cost. These are the two I remember well, others including Modem, CPU, Unified Memory, and now Payment. Although arguably Payment doesn't count because he did admit he is wrong. Basically Gruber and Daniel Eran Dilger from AppleInsider have similar traits, they have made their own conclusion and they derived their explanation backwards.
        lnxg33k1 3y ago
kibwen 3y ago
You don't need a digital wallet app to do this, either. Plenty of credit card companies let you generate burner numbers to avoid giving out your real number. EDIT: Would someone like to explain why this is downvoted? This statement is objectively true; for example, Capital One calls these "virtual card numbers".
- adrr 3y ago
  How do I key in a credit card number when I am at a target store checking out?
  - deleted 3y ago
    [deleted]
  - kibwen 3y ago
    To continue to use the example of Capital One, you can use their virtual cards with digital wallets; the point is to demonstrate that this is neither a new capability nor something that is exclusive to digital wallet apps.
- hgfghj 3y ago
  Because you can’t use those burner numbers to make brick and mortar purchases. Your assertion was objectively false.
  - kibwen 3y ago
    Cashiers in brick and mortar stores can enter card details manually. You've never had a card reader break and then had the cashier have to type it in by hand?
    - hgfghj 3y ago
      I have never convinced a cashier to use digits provided by me or off my phone screen. That is fundamentally different from getting them to manually enter a card. But I understand you’re making irrelevant bad faith comments, because you’re too weak to admit that you were wrong about something unimportant. kibwen, learn to take an L.
deleted 3y ago
[deleted]
idbehold 3y ago
The author should not be using pixilation as a method to redact information from his screenshots.
- actionfromafar 3y ago
  The proper way is to replace the text you want to redact with some other text, then use pixelation after that. Much more fun to be had. :-D
praseodym 3y ago
The post by Matt Birchler has been amended with the paragraph "A previous version of this post suggested the DPAN changes between merchants, but that was a mistake. Serves me right for cranking this post out too quickly. Seriously, my bad.". However, the rest of the post still suggests that there is a unique DPAN per merchant, but I can't find any basis for that. Even Apple's own documentation at https://support.apple.com/en-us/HT203027 https://support.apple.com/en-us/HT203027 says that the DPAN (called Device Account Number here) is only unique per device. When a card is added to Apple Pay a DPAN is created for that device, and it never gets changed afterwards unless the card is removed and re-added. So whereas you can't be tracked by using the same card on two devices (e.g. iPhone and Apple Watch) because they will have two different DPANs, I'm pretty sure data brokers can track you when using the same card on the same device across different merchants.
- adrr 3y ago
  Different PANS doesn’t make a difference when your bank is selling your credit card data anyway.
  - MBCook 3y ago
    It makes a difference for credit card thieves. Not for transaction list privacy. As long as your bank is involved you’re just going to have to put up with them and trust them.
    - adrr 3y ago
      Credit theft affects the banks and merchants. They are out of the money not me. Its for their benefit. I just suffer the inconvenience of getting a new card.
- arcticbull 3y ago
  > hen a card is added to Apple Pay a DPAN is created for that device, and it never gets changed afterwards unless the card is removed and re-added. They're not generally considered stable in the payments world. They can get rolled periodically, even outside of card addition and removal.
hoistbypetard 3y ago
When Apple Pay first started to become common, I looked hard at it through the lens of my own retail payment processing experience. One of the things that impressed me most about it at the time was just how rooted in industry standards it was. None of it from the radio back was Apple-specific at all at the time, and by my read of this piece, that has held up through the present. At the time, I recall a few merchants who were intentionally accepting card-based tap-to-pay needing to alter their systems because they found themselves accidentally accepting the very standards-based Apple tap-to-pay, and they didn't want to. (CVS comes specifically to mind... IIRC they were part of a competing scheme, and they wanted the fact that their competing scheme was accepted at their retail locations to help differentiate that scheme from Apple Pay.) I'm goad the author took the time to do a more current review in this context, because when the "only Apple Pay does this" mythology started to emerge recently, I was scratching my head, wondering if something had changed since I had last gotten to look.
- jjcm 3y ago
  Sharing a personal anecdote - when Apple Pay first launched, it only worked in the US. A more accurate statement though was it could only be set up in the US. I very shortly after moved to Australia, where tap-to-pay is the standard. It was kind of crazy because despite not officially being supported, Apple Pay worked everywhere in Australia. Whereas only a small handful of merchants supported it in the US, 99% of point of sales in Australia supported it because it was based off the standard.
  - patch_cable 3y ago
    I had a similar experience. After it was released in the US, I took a trip to the Netherlands. I had a lot of “how did you do that?” reactions from merchants when I paid for things with my phone.
    - Schiendelman 3y ago
      I had a similar experience traveling in Europe! More than one merchant thought I had “hacked” them initially.
RandallBrown 3y ago
> Apple did a great job mainstreaming digital wallets like this, what they do is not unique in the industry. I may misremember, but I think Apple Pay was pretty unique when it first launched, which is why it was supported at so few places. Other phone payment systems (like I think the original Samsung Pay) just sent the card number straight to the machine.
- adrr 3y ago
  EMVCO specs for contactless was always a tokenized card number. Maybe Samsung Pay was passing the PAN for online payments.
  - bebopfunk 3y ago
    They may be thinking of MST
    - lelandbatey 3y ago
      For context, MST or magnetic secure transmission, allows a phone to transmit an EM signal that emulates the physical action of swiping a magstripe based card. As in, it works with all the legacy "card swipe" terminals. Samsung phones up to like the S20(?) supported this, allowing them to technically work basically everywhere with no integration needed.
      - mrguyorama 3y ago
        That's straight Voodoo shit. Getting that to work with most cheapo POS's sounds immensely challenging.
- sunshowers 3y ago
  In the US it was uncommon. Contactless payments had been supported in Europe and Asia for a while (2007 in the UK), though with fairly low limits at least in the UK. Interestingly, it seems like the UK still has a £100 limit, while in the US I've paid well over $2000 with a contactless payment using my Android phone.
jahrichie 3y ago
This was a fun read, appreciate your work. Did you read anything about iCloud Private Relay emails and how they get used with apple pay?
danielhep 3y ago
It says that Apple Pay protects your privacy by randomizing the number, but Clover based stores seem to have no trouble tracking my loyalty rewards once I linked my phone number to my virtual card. Same for transit like OMNY in NYC. It tracks my virtual card enough to implement fare capping.
- SOLAR_FIELDS 3y ago
  There must be at least some truth to the fact that it makes the process more difficult. In Central Texas the most prominent grocery retailer by far is HEB, who has purposefully and intentionally not supported any sort of NFC payments, presumably because it somehow makes it easier to track people’s purchases over time by preventing NFC. FWIW they are the only holdout. You can pay with NFC at Walmart, Costco, gas stations, regular retail outlets, etc almost anywhere else in Central Texas. HEB absolutely sticks out like a sore thumb in their lack of NFC support. And it’s not that they aren’t tech savvy - they own and maintain an Uber-Eats like app here called Favor that works pretty well. They clearly understand technology
  - easton 3y ago
    Are you sure about Walmart? They’ve always held out because they want you to use Walmart pay I thought.
    - astura 3y ago
      I guess it could vary by location. My local Walmart is the only place I go to regularly where I have to insert my card instead of tapping.
  - cptskippy 3y ago
    I wouldn't be surprised they'd just completed an infrastructure upgrade that didn't support NFC prior to it's growth in popularity and now they're unwilling to pay that upgrade toll all over again. But that's just pure uninformed speculation on my part.
troad 3y ago
Funnily enough, Apple Pay launched in Australia following a multi-year push by local big banks to increase the use of contactless payments. So all the infrastructure was already there, built out by the banks themselves, when Apple came in demanding a US-style cut, as though they built the thing. The local big banks held out for years on supporting Apple Pay, before the customer pressure became too overwhelming and they relented. They're all still very upset about this, and would drop Apple Pay in a second if the NFC chip were forced open by a regulator, but to date they've found it hard to find anyone too sympathetic to a sob story from - well - the nation's biggest banks.
- threeseed 3y ago
  Everyone along the payment food chain takes a cut so was always surprised that people thought Apple wouldn't. Especially when they are adding a value add on top. And banks are free to drop Apple Pay. Customers will simply move their business to those who do support it. Just like happened when Apple Pay first launched in Australia and banks like Commonwealth Bank held out.
- CharlesW 3y ago
  https://www.apple.com/newsroom/2024/01/apple-announces-changes-to-ios-safari-and-the-app-store-in-the-european-union/#:~:text=As%20announced%20by%20the%20European,throughout%20the%20European%20Economic%20Area https://www.apple.com/newsroom/2024/01/apple-announces-chang....
- joshl32532 3y ago
  > They're all still very upset about this, and would drop Apple Pay in a second if the NFC chip were forced open by a regulator Not if the users have anything to say about that. Canadian banks tried to do their own contactless payment on Android (TD Pay, lol), but nobody wants it. In the end they caved and finally offered Google Pay. I predict it's gonna be similar. Even if Apple opens up NFC payment, nobody will use them and prefer 1st party support like Apple Pay or Google Pay. Just see how many people actually use Samsung pay vs Google Pay.
  - Xeamek 3y ago
codethief 3y ago
Can anyone ELI5 how Apple & Google Pay work in detail? I used to think they simply pass on my CC details to the merchant or the merchant's chosen payment gateway in one way or another (obfuscated or not), and the OP suggests the same. Moreover, I noticed that some merchants refuse my payment when I use e.g. Google Pay with my Amex instead of my MasterCard. However, I'm sometimes under the impression that Apple/Google take on the role of a payment gateway or a payment method themselves. After all, they collect all my transaction data, and it also seems payment terminals at the grocery store needed special support for the Apple/Google Pay apps. Interestingly, this comment[0] is saying the opposite, namely that at least Apple Pay is very much rooted in standards. But what is Apple and Google's special proprietary sauce then? Why are these apps so hard/impossible to replace by open-source alternatives? Is it because only Apple/Google get full access to the NFC chips on iOS/Android? [0]: https://news.ycombinator.com/item?id=39845805 https://news.ycombinator.com/item?id=39845805
- tekno45 3y ago
  Good info here https://blog.bytebytego.com/p/ep25-how-applegoogle-pay-handle-card https://blog.bytebytego.com/p/ep25-how-applegoogle-pay-handl...
- refulgentis 3y ago
  Correct. Though it's not the same on Android, you can be not-Google and do payments just fine, provided you have the same business relationships with the CC companies as a big merchant processor (good luck) Not a huge fan of Android, but Android's pretty damn open, the open advocacy orgs unfortunately tend to conflate "you have to say "yes" to a dialog about untrusted apps in Android! intentionally difficult!" with the debacle the years-long Apple stuff has turned into. I suspect we'll see less of that equivocation now that the petulance is nakedly visible, and gratefully, there's no longer billions spent on things like the "Privacy™" ad campaign, rushed after 100s of celebs had their nudes leaked from iCloud due to bad customer support.
- mundays 3y ago
  The biggest difference is that no internet connection is required for the authentication because the bank trusts the user's device. CC number is randomized per transaction so that the merchant does not receive the real CC number. I've seen cases contactless payment is not supported only for a particular brand and I believe it's because of missing software update on the payment terminal.
adam_arthur 3y ago
Why are SSO and mobile pay not standard interfaces that anybody can build a provider for? Why is there "Login with Google" or "Login with Apple" instead of "Login with [my default configured SSO provider]". Or "Pay with [my default configured pay provider]" Even worse, many times vendors/sites only support a subset of these providers, making SSO not really SSO at all. I'm sure the reasons are out there, but I haven't researched it in-depth. It seems to me there should be a common agreed upon spec that all vendors adhere to. If not, it will probably be legislated to this standard sometime in the future
- MBCook 3y ago
  Why do we need SSO? Passkeys seems perfect to me. Easy sign on anywhere I sign up. No central whoever that knows every time I log in anywhere.
  - lxgr 3y ago
    Passkeys are great(-ish) for authentication, but don't offer identification at all. It's just not in scope (and I think that's a good thing; the two problems are pretty different, and WebAuthN is already extremely overloaded with features serving conflicting goals).
- Scarblac 3y ago
  To support "Login with Google" you have to do some config on the Google side. You have to tell them, this ils my app, this is the URL you have to redirect back to after authenticating, and do on. Otherwise there would be security problems.
- soared 3y ago
  Because user verification varies significantly between businesses, and so they need to vet and trust SSO vendors to uphold the standards they require. If there are a million sso vendors, who knows what standards each upholds.
  - ndriscoll 3y ago
lolive 3y ago
Off-topic, but I still don’t understand why Apple Pay cannot display on the screen the sum currently to be paid before I validate the transaction. I suppose it is not a UX issue, but I suppose that sum is simply not known by the Apple device. Any idea?
- jen729w 3y ago
  Just think of your phone like a plastic card. It's listening for the request from an NFT reader, at which point it beams out your 'card number', and that is that. This took me a while to grok. I couldn't understand how Apple Pay could work when my phone was in Airplane mode. But of course it does! Your existing Visa card works just fine without an internet connection. Fundamentally, they're the same thing. That's why, if everyone is playing by the standards, there's nothing extra to 'support'. See jjcm's sibling comment here. https://news.ycombinator.com/item?id=39846117 https://news.ycombinator.com/item?id=39846117 So I dare say the NFT reader isn't 'broadcasting' the amount to pay. Why would it be? Your plastic card had no way of dealing with that information. And so your iPhone has no way of receiving it, and telling the NFT reader to hold on a second while you swipe-to-accept.
  - gruez 3y ago
    >NFT reader NFC reader
  - lxgr 3y ago
    It actually is most of the time, but it’s often a placeholder amount (some POSes let you tap before the check is finalized), so it’s too unreliable to display in the wallet directly. The phone would also not have any way to verify if the terminal actually sent the payment online, causing confusion in case of having to tap again (that would then look like a double booking). > Your plastic card had no way of dealing with that information. You'd be surprised! Plastic cards can do all kinds of elaborate things, like deduct that amount from an offline transaction balance, replenishing that balance the next time it gets to talk to the issuer during a chip-dipped payment (assuming the card is still in good standing), update currency conversion rate tables used abroad, maybe even play doom – but probably not all of them.
grpt 3y ago
> the merchant chooses how much personal info they want or need to collect, and Apple Pay doesn’t prevent them from asking you for that at checkout. Does this happen when shopping in-person? > of course that info would be there! In this example, my checkout page was for a physical item so I needed the customer’s shipping info. They don't need my name and address if I'm buying eggs in a grocery store. Does Apple/Google require my consent to share that info when it's obviously not required? Is it similar to a terms & conditions, or shrink-wrapped EULA? (ie take it or leave it) I've never used these payment systems.
- lxgr 3y ago
  For POS payments, usually only the device account number (DPAN) is shared with the merchant. Even the name is usually redacted, similar to contactless and as opposed to chip or magstripe payments. All of the additional details mentioned in the article are only shared when you pay "online" – but that includes scanning a QR code on your phone and paying in Safari or an App Clip, which is something I've seen in a few restaurants these days. That way, the restaurant gets as much as they ask for, which can include your name, your address, and your email address. I think this is usually displayed on the payment sheet, but it didn't really register for me the first time I used it in some restaurant. Now I make sure to ask the waiter for an actual terminal to tap or just give them my physical card.
deleted 3y ago
[deleted]
lxgr 3y ago
Something that's missing from all of these discussions is that transactions on Apple Pay (and all similar wallets like Google Pay, Samsung Pay etc.) are now just as trackable as those done using the underlying card number. While the DPAN is unique to a given device, the merchant's payment service provider these days can receive a unique identifier called PAR in the authorization response from the card network. That identifier is consistent across all DPANs for the same card (and aspirationally even across card number changes on the same underlying account). The PAR can't be charged by any merchant, so this is not a security problem, but don't expect your digital wallet payments to be any more private than those done using your regular card or card number. https://wcapra.com/payment-account-reference-capraplus-your-source-for-insight/ https://wcapra.com/payment-account-reference-capraplus-your-... https://www.securetechalliance.org/wp-content/uploads/EMVCo-PAR-WP-FINAL-April-2018.pdf https://www.securetechalliance.org/wp-content/uploads/EMVCo-...
- mattmaroon 3y ago
  I would never expect anything to get more private ever again short of acts of government.
  - ljlolel 3y ago
    Try reading the book Seeing like a State
- worthless-trash 3y ago
  > (and aspirationally even across card number changes on the same underlying account). My local Australian bank (NAB) does this. I imagine it's pretty normal across most credit cards here.
- astrange 3y ago
  Not true in Japan, Apple Pay uses anonymous ICOCA (aka Suica) cards which you can delete and recreate if you want.
  - klausa 3y ago
WirelessGigabit 3y ago
I am not sure if I'm losing it but the following statement doesn't make sense in my head: > Your same card used through Apple Pay on your iPhone and iPad will show different DPANs, though since each device gets its own number. That 'though' does not compute. > Basically, when that Apple Pay card pops up when you’re checking out, expect everything on that card to be sent to the merchant Apple Pay. But what about Apple Pay? You know, the one in store, where you hold your phone against the NFC reader?
- w-ll 3y ago
  I might be wrong but they are acutally differnt CC numbers, with the prefix linked to ApplePay, and then they resolve or proxy to your acutally CC. You can use NFC Sniffers like the Flipper to see this in action. Same how ApplePay on the watch works without network, cuz it has already preset the AppleCC prefix on ur watch, and its just emulating that AppleCC to the card receiver. Same for the phone.
- p_l 3y ago
  It will transmit everything in EMV contactless spec, tokenized like always. DPAN is just token to represent a combination of device+card.
  - WirelessGigabit 3y ago
    But it will not contain my address right? So if I use Apple Pay in store, at say Kroger for 100 times, can they track me? Or do I get a new credit card number every time?
    - p_l 3y ago
      You'll get every time the same card number, with said card being specific to the device. So they will be able to track that the same buyer is doing the purchase, which is what most POS-based analytics are interested in. Way more important is the (sometimes filtered) dump of everything on your bill that is passed on to various corporations (Nielsen, sometimes direct to suppliers), and how in-store analytics then build data at neighbourhood or per-store level. Store analytics need not know that specifically "WirelessGigabit" bought something, store analytics is more interested in "we have repeated customers with such and such spending and purchases" and "in this zip code we have this kind of population with associated types of buyers" and "This is how much people are buying certain products and when, so that suppliers can plan campaigns and production"
grahamgooch 3y ago
Look up Network token - or EMV token.
ojbyrne 3y ago
@dang @CharlesW typo. Please fix.
- CharlesW 3y ago
  I submitted the article title and can’t change this amended one, but you can reach @dang at hn@ycombinator.com.
jesprenj 3y ago
Apply Pay?
figassis 3y ago
Can we fix the typo in the title?
rob74 3y ago
There seems to be a misunderstanding about the details of how Apple Pay is spelled here...
madsbuch 3y ago
> Apple Pay through Wallet obfuscates your actual credit card numbers, which retailers infamously use to track customers. It’s far more private than using your credit card itself. I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Maybe someone can answer whether this is already solved by GDPR? If I do not give explicit consent to use my credit card details for anything else but withdrawing the agreed upon amount, that would be illegal (... in EU countries). Edit: It seems like this is, at least in some capacity, a commentary on the DMA. I understand the concerns about privacy in a US context, but these issues should already be solved in an EU context. So what Apple will most probably do, keep US companies from implementing NFC wallets but allow EU companies to implement NFC wallets, seems to be a really good compromise for the author - Privacy is kept both for the EU and the US users.
fennecfoxy 3y ago
That's a really good break down. >I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Yeah, that's just more FUD around "Apple protects consumers therefore they should be able to do what they want", very topical atm. Idk why people glorify Apple and expect them to protect consumers when we should really be asking this of our governments (ie GDPR, the way that governments hold banks to particular standards) this is something the EU should push harder and expand on, imo - rules that are applicable to all companies. What's interesting is Apple's evolution in their marketing of privacy+security, because it's not something they've always done and it seemed to have started when they realised all their competitors have fragmented platforms and that Apple can compete since they do not need the revenue from onselling consumer data.

277 points by CharlesW 3y ago

Nice post!

Where did Gruber say that “only Apple Pay does this”? The writer goes on to point out a few mistakes (or rather, didn’t quite get the details right) Gruber made, and that’s seems to be it.

cassianoleal 3y ago
Yeah there's a very big difference between "Apple Pay does this" and "only Apple Pay does this". It seems like Gruber said the former, but the author somehow read the latter.
addicted 3y ago
> I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Birchler points out that the banks did do this. And Gruber has acknowledged his mistake. Gruber is an open fanboi but for the most part he would at least get his facts straight and would be open about what he didn’t understand and would link to experts in the field. However, since the EU DMA actions on Apple he seems to have completely lost his objectivity. First by pretending to understand the legalese better than apparently the EC does, then by applying American lawmaking approaches to European ones which are very different and then finally by taking Apple’s bad faith statements at face value (Gruber’s turn has coincided with Apple’s very weird bad faith approach to the EU so maybe the fundamental issue is his trust in Apple). And he seems to be carrying over that to the U.S. govt’s antitrust action as well. Also, to be fair, social media is absolutely filled with Apple people pretending to be legal experts but being completely wrong about almost everything. So it might be hard for him to even see opposing viewpoints from legitimate folks.
- madeofpalk 3y ago
  Gruber never pretends to be objective - he likes what he likes, and he dislikes what he dislikes. Notably, he has a pretty strong "pro-business" streak in him that objects to anything resembeling workers rights or unions, and government regulation/interference in businesses. The EU tends to do a lot of that, so overall he's very critical of it. And at the moment there's a lot of governments telling Apple what to do, so it's the perfect storm of getting his knickers in a twist constantly.
  - lnxg33k1 3y ago
    [flagged]
  - kemayo 3y ago
    I don't think I've seen him do opposition to workers rights / unions? He hasn't been constantly yelling about supporting them either, but that's different. E.g. a quick google for "daring fireball unions" turned up mostly articles like this one which were pro union-demands: https://daringfireball.net/linked/2021/11/24/wirecutter-union https://daringfireball.net/linked/2021/11/24/wirecutter-unio... Closest to a negative I found in that quick search was him making fun of the Maryland Apple Store union that was asking to be allowed to request tips from Apple Store customers... while also saying that the rest of their demands sounded like good things to ask for.
    - MBCook 3y ago
      Oh man I had forgotten about that.
- ineedaj0b 3y ago
  I think you should reconsider your judgement on the EU ruling being good. If you can’t argue the EU ruling is bad (and not because Apple is greedy or shortsighted etc), you are missing something. Apple has a vision - the EU has a vision and they do not align. The EU is poor. It has been mismanaging itself for years: they should be doing better than they are. Is this caused by outside vectors or the leadership, or maybe the structure (too many cooks in EU kitchen)? Is the vision of the world the EU wants 15-25 years out strong? Is the world the EU would create good for the EU - 30 years out? I’d argue it’d be a comfortable one. But a poor and weaker one. I’m not trying to defend Apple. I’m trying to say that the EU leadership is likely bad - my hunch is anyone truly good would work in the state department of the respective nation. Kinda like how UN ambassadors for the US are never our best - our best maybe might once in a blue moon take the post like a retirement phase. Now take the ruling, are you sure they made a smart long term move?
lnxg33k1 3y ago
https://daringfireball.net/linked/2024/03/21/garland-monopoly?ref=birchtree.me https://daringfireball.net/linked/2024/03/21/garland-monopol... [Update: Whoops, I was wrong about that. Matt Birchler, who works in the payments industry, has a great explainer about how this works, and it turns out major banks and credit cards do generate per-merchant “DPAN” numbers for tap-to-pay transactions. I stand by my argument that Apple Wallet is at least as, if not more secure than, any digital payment app provided by a card issuer.] --- From the original author (Gruber)
- ryukoposting 3y ago
  The DOJ doesn't have a case, but WOW the last paragraph of that blog is an extraordinary wall of brand fellatio.
  - lnxg33k1 3y ago
    Brand fellatio has just become my new favorite concept :D
  - internetter 3y ago
    Gruber has always been an Apple fanboy, but in the past few months it's taken a turn into ragebait territory, and i'm this close to stopping reading it
    - ksec 3y ago
      How many things that most people ( within Apple Fans circle ) commonly believes that are plain wrong was started by him? Apple invented USB-C and turned it over to USB-IF The original AirPod was sold at cost. These are the two I remember well, others including Modem, CPU, Unified Memory, and now Payment. Although arguably Payment doesn't count because he did admit he is wrong. Basically Gruber and Daniel Eran Dilger from AppleInsider have similar traits, they have made their own conclusion and they derived their explanation backwards.
      - lnxg33k1 3y ago

kibwen 3y ago

You don't need a digital wallet app to do this, either. Plenty of credit card companies let you generate burner numbers to avoid giving out your real number. EDIT: Would someone like to explain why this is downvoted? This statement is objectively true; for example, Capital One calls these "virtual card numbers".

adrr 3y ago
How do I key in a credit card number when I am at a target store checking out?
- deleted 3y ago
  [deleted]
- kibwen 3y ago
  To continue to use the example of Capital One, you can use their virtual cards with digital wallets; the point is to demonstrate that this is neither a new capability nor something that is exclusive to digital wallet apps.
hgfghj 3y ago
Because you can’t use those burner numbers to make brick and mortar purchases. Your assertion was objectively false.
- kibwen 3y ago
  Cashiers in brick and mortar stores can enter card details manually. You've never had a card reader break and then had the cashier have to type it in by hand?
  - hgfghj 3y ago
    I have never convinced a cashier to use digits provided by me or off my phone screen. That is fundamentally different from getting them to manually enter a card. But I understand you’re making irrelevant bad faith comments, because you’re too weak to admit that you were wrong about something unimportant. kibwen, learn to take an L.

deleted 3y ago

[deleted]

idbehold 3y ago

The author should not be using pixilation as a method to redact information from his screenshots.

actionfromafar 3y ago
The proper way is to replace the text you want to redact with some other text, then use pixelation after that. Much more fun to be had. :-D

praseodym 3y ago

The post by Matt Birchler has been amended with the paragraph "A previous version of this post suggested the DPAN changes between merchants, but that was a mistake. Serves me right for cranking this post out too quickly. Seriously, my bad.". However, the rest of the post still suggests that there is a unique DPAN per merchant, but I can't find any basis for that. Even Apple's own documentation at https://support.apple.com/en-us/HT203027 https://support.apple.com/en-us/HT203027 says that the DPAN (called Device Account Number here) is only unique per device. When a card is added to Apple Pay a DPAN is created for that device, and it never gets changed afterwards unless the card is removed and re-added. So whereas you can't be tracked by using the same card on two devices (e.g. iPhone and Apple Watch) because they will have two different DPANs, I'm pretty sure data brokers can track you when using the same card on the same device across different merchants.

adrr 3y ago
Different PANS doesn’t make a difference when your bank is selling your credit card data anyway.
- MBCook 3y ago
  It makes a difference for credit card thieves. Not for transaction list privacy. As long as your bank is involved you’re just going to have to put up with them and trust them.
  - adrr 3y ago
    Credit theft affects the banks and merchants. They are out of the money not me. Its for their benefit. I just suffer the inconvenience of getting a new card.
arcticbull 3y ago
> hen a card is added to Apple Pay a DPAN is created for that device, and it never gets changed afterwards unless the card is removed and re-added. They're not generally considered stable in the payments world. They can get rolled periodically, even outside of card addition and removal.

hoistbypetard 3y ago

When Apple Pay first started to become common, I looked hard at it through the lens of my own retail payment processing experience. One of the things that impressed me most about it at the time was just how rooted in industry standards it was. None of it from the radio back was Apple-specific at all at the time, and by my read of this piece, that has held up through the present. At the time, I recall a few merchants who were intentionally accepting card-based tap-to-pay needing to alter their systems because they found themselves accidentally accepting the very standards-based Apple tap-to-pay, and they didn't want to. (CVS comes specifically to mind... IIRC they were part of a competing scheme, and they wanted the fact that their competing scheme was accepted at their retail locations to help differentiate that scheme from Apple Pay.) I'm goad the author took the time to do a more current review in this context, because when the "only Apple Pay does this" mythology started to emerge recently, I was scratching my head, wondering if something had changed since I had last gotten to look.

jjcm 3y ago
Sharing a personal anecdote - when Apple Pay first launched, it only worked in the US. A more accurate statement though was it could only be set up in the US. I very shortly after moved to Australia, where tap-to-pay is the standard. It was kind of crazy because despite not officially being supported, Apple Pay worked everywhere in Australia. Whereas only a small handful of merchants supported it in the US, 99% of point of sales in Australia supported it because it was based off the standard.
- patch_cable 3y ago
  I had a similar experience. After it was released in the US, I took a trip to the Netherlands. I had a lot of “how did you do that?” reactions from merchants when I paid for things with my phone.
  - Schiendelman 3y ago
    I had a similar experience traveling in Europe! More than one merchant thought I had “hacked” them initially.

RandallBrown 3y ago

> Apple did a great job mainstreaming digital wallets like this, what they do is not unique in the industry. I may misremember, but I think Apple Pay was pretty unique when it first launched, which is why it was supported at so few places. Other phone payment systems (like I think the original Samsung Pay) just sent the card number straight to the machine.

adrr 3y ago
EMVCO specs for contactless was always a tokenized card number. Maybe Samsung Pay was passing the PAN for online payments.
- bebopfunk 3y ago
  They may be thinking of MST
  - lelandbatey 3y ago
    For context, MST or magnetic secure transmission, allows a phone to transmit an EM signal that emulates the physical action of swiping a magstripe based card. As in, it works with all the legacy "card swipe" terminals. Samsung phones up to like the S20(?) supported this, allowing them to technically work basically everywhere with no integration needed.
    - mrguyorama 3y ago
      That's straight Voodoo shit. Getting that to work with most cheapo POS's sounds immensely challenging.
sunshowers 3y ago
In the US it was uncommon. Contactless payments had been supported in Europe and Asia for a while (2007 in the UK), though with fairly low limits at least in the UK. Interestingly, it seems like the UK still has a £100 limit, while in the US I've paid well over $2000 with a contactless payment using my Android phone.

jahrichie 3y ago

This was a fun read, appreciate your work. Did you read anything about iCloud Private Relay emails and how they get used with apple pay?

danielhep 3y ago

It says that Apple Pay protects your privacy by randomizing the number, but Clover based stores seem to have no trouble tracking my loyalty rewards once I linked my phone number to my virtual card. Same for transit like OMNY in NYC. It tracks my virtual card enough to implement fare capping.

SOLAR_FIELDS 3y ago
There must be at least some truth to the fact that it makes the process more difficult. In Central Texas the most prominent grocery retailer by far is HEB, who has purposefully and intentionally not supported any sort of NFC payments, presumably because it somehow makes it easier to track people’s purchases over time by preventing NFC. FWIW they are the only holdout. You can pay with NFC at Walmart, Costco, gas stations, regular retail outlets, etc almost anywhere else in Central Texas. HEB absolutely sticks out like a sore thumb in their lack of NFC support. And it’s not that they aren’t tech savvy - they own and maintain an Uber-Eats like app here called Favor that works pretty well. They clearly understand technology
- easton 3y ago
  Are you sure about Walmart? They’ve always held out because they want you to use Walmart pay I thought.
  - astura 3y ago
    I guess it could vary by location. My local Walmart is the only place I go to regularly where I have to insert my card instead of tapping.
- cptskippy 3y ago
  I wouldn't be surprised they'd just completed an infrastructure upgrade that didn't support NFC prior to it's growth in popularity and now they're unwilling to pay that upgrade toll all over again. But that's just pure uninformed speculation on my part.

troad 3y ago

Funnily enough, Apple Pay launched in Australia following a multi-year push by local big banks to increase the use of contactless payments. So all the infrastructure was already there, built out by the banks themselves, when Apple came in demanding a US-style cut, as though they built the thing. The local big banks held out for years on supporting Apple Pay, before the customer pressure became too overwhelming and they relented. They're all still very upset about this, and would drop Apple Pay in a second if the NFC chip were forced open by a regulator, but to date they've found it hard to find anyone too sympathetic to a sob story from - well - the nation's biggest banks.

threeseed 3y ago
Everyone along the payment food chain takes a cut so was always surprised that people thought Apple wouldn't. Especially when they are adding a value add on top. And banks are free to drop Apple Pay. Customers will simply move their business to those who do support it. Just like happened when Apple Pay first launched in Australia and banks like Commonwealth Bank held out.
CharlesW 3y ago
https://www.apple.com/newsroom/2024/01/apple-announces-changes-to-ios-safari-and-the-app-store-in-the-european-union/#:~:text=As%20announced%20by%20the%20European,throughout%20the%20European%20Economic%20Area https://www.apple.com/newsroom/2024/01/apple-announces-chang....
joshl32532 3y ago
> They're all still very upset about this, and would drop Apple Pay in a second if the NFC chip were forced open by a regulator Not if the users have anything to say about that. Canadian banks tried to do their own contactless payment on Android (TD Pay, lol), but nobody wants it. In the end they caved and finally offered Google Pay. I predict it's gonna be similar. Even if Apple opens up NFC payment, nobody will use them and prefer 1st party support like Apple Pay or Google Pay. Just see how many people actually use Samsung pay vs Google Pay.
- Xeamek 3y ago

codethief 3y ago

Can anyone ELI5 how Apple & Google Pay work in detail? I used to think they simply pass on my CC details to the merchant or the merchant's chosen payment gateway in one way or another (obfuscated or not), and the OP suggests the same. Moreover, I noticed that some merchants refuse my payment when I use e.g. Google Pay with my Amex instead of my MasterCard. However, I'm sometimes under the impression that Apple/Google take on the role of a payment gateway or a payment method themselves. After all, they collect all my transaction data, and it also seems payment terminals at the grocery store needed special support for the Apple/Google Pay apps. Interestingly, this comment[0] is saying the opposite, namely that at least Apple Pay is very much rooted in standards. But what is Apple and Google's special proprietary sauce then? Why are these apps so hard/impossible to replace by open-source alternatives? Is it because only Apple/Google get full access to the NFC chips on iOS/Android? [0]: https://news.ycombinator.com/item?id=39845805 https://news.ycombinator.com/item?id=39845805

tekno45 3y ago
Good info here https://blog.bytebytego.com/p/ep25-how-applegoogle-pay-handle-card https://blog.bytebytego.com/p/ep25-how-applegoogle-pay-handl...
refulgentis 3y ago
Correct. Though it's not the same on Android, you can be not-Google and do payments just fine, provided you have the same business relationships with the CC companies as a big merchant processor (good luck) Not a huge fan of Android, but Android's pretty damn open, the open advocacy orgs unfortunately tend to conflate "you have to say "yes" to a dialog about untrusted apps in Android! intentionally difficult!" with the debacle the years-long Apple stuff has turned into. I suspect we'll see less of that equivocation now that the petulance is nakedly visible, and gratefully, there's no longer billions spent on things like the "Privacy™" ad campaign, rushed after 100s of celebs had their nudes leaked from iCloud due to bad customer support.
mundays 3y ago
The biggest difference is that no internet connection is required for the authentication because the bank trusts the user's device. CC number is randomized per transaction so that the merchant does not receive the real CC number. I've seen cases contactless payment is not supported only for a particular brand and I believe it's because of missing software update on the payment terminal.

adam_arthur 3y ago

Why are SSO and mobile pay not standard interfaces that anybody can build a provider for? Why is there "Login with Google" or "Login with Apple" instead of "Login with [my default configured SSO provider]". Or "Pay with [my default configured pay provider]" Even worse, many times vendors/sites only support a subset of these providers, making SSO not really SSO at all. I'm sure the reasons are out there, but I haven't researched it in-depth. It seems to me there should be a common agreed upon spec that all vendors adhere to. If not, it will probably be legislated to this standard sometime in the future

MBCook 3y ago
Why do we need SSO? Passkeys seems perfect to me. Easy sign on anywhere I sign up. No central whoever that knows every time I log in anywhere.
- lxgr 3y ago
  Passkeys are great(-ish) for authentication, but don't offer identification at all. It's just not in scope (and I think that's a good thing; the two problems are pretty different, and WebAuthN is already extremely overloaded with features serving conflicting goals).
Scarblac 3y ago
To support "Login with Google" you have to do some config on the Google side. You have to tell them, this ils my app, this is the URL you have to redirect back to after authenticating, and do on. Otherwise there would be security problems.
soared 3y ago
Because user verification varies significantly between businesses, and so they need to vet and trust SSO vendors to uphold the standards they require. If there are a million sso vendors, who knows what standards each upholds.
- ndriscoll 3y ago

lolive 3y ago

Off-topic, but I still don’t understand why Apple Pay cannot display on the screen the sum currently to be paid before I validate the transaction. I suppose it is not a UX issue, but I suppose that sum is simply not known by the Apple device. Any idea?

jen729w 3y ago
Just think of your phone like a plastic card. It's listening for the request from an NFT reader, at which point it beams out your 'card number', and that is that. This took me a while to grok. I couldn't understand how Apple Pay could work when my phone was in Airplane mode. But of course it does! Your existing Visa card works just fine without an internet connection. Fundamentally, they're the same thing. That's why, if everyone is playing by the standards, there's nothing extra to 'support'. See jjcm's sibling comment here. https://news.ycombinator.com/item?id=39846117 https://news.ycombinator.com/item?id=39846117 So I dare say the NFT reader isn't 'broadcasting' the amount to pay. Why would it be? Your plastic card had no way of dealing with that information. And so your iPhone has no way of receiving it, and telling the NFT reader to hold on a second while you swipe-to-accept.
- gruez 3y ago
  >NFT reader NFC reader
- lxgr 3y ago
  It actually is most of the time, but it’s often a placeholder amount (some POSes let you tap before the check is finalized), so it’s too unreliable to display in the wallet directly. The phone would also not have any way to verify if the terminal actually sent the payment online, causing confusion in case of having to tap again (that would then look like a double booking). > Your plastic card had no way of dealing with that information. You'd be surprised! Plastic cards can do all kinds of elaborate things, like deduct that amount from an offline transaction balance, replenishing that balance the next time it gets to talk to the issuer during a chip-dipped payment (assuming the card is still in good standing), update currency conversion rate tables used abroad, maybe even play doom – but probably not all of them.

grpt 3y ago

> the merchant chooses how much personal info they want or need to collect, and Apple Pay doesn’t prevent them from asking you for that at checkout. Does this happen when shopping in-person? > of course that info would be there! In this example, my checkout page was for a physical item so I needed the customer’s shipping info. They don't need my name and address if I'm buying eggs in a grocery store. Does Apple/Google require my consent to share that info when it's obviously not required? Is it similar to a terms & conditions, or shrink-wrapped EULA? (ie take it or leave it) I've never used these payment systems.

lxgr 3y ago
For POS payments, usually only the device account number (DPAN) is shared with the merchant. Even the name is usually redacted, similar to contactless and as opposed to chip or magstripe payments. All of the additional details mentioned in the article are only shared when you pay "online" – but that includes scanning a QR code on your phone and paying in Safari or an App Clip, which is something I've seen in a few restaurants these days. That way, the restaurant gets as much as they ask for, which can include your name, your address, and your email address. I think this is usually displayed on the payment sheet, but it didn't really register for me the first time I used it in some restaurant. Now I make sure to ask the waiter for an actual terminal to tap or just give them my physical card.

deleted 3y ago

[deleted]

lxgr 3y ago

Something that's missing from all of these discussions is that transactions on Apple Pay (and all similar wallets like Google Pay, Samsung Pay etc.) are now just as trackable as those done using the underlying card number. While the DPAN is unique to a given device, the merchant's payment service provider these days can receive a unique identifier called PAR in the authorization response from the card network. That identifier is consistent across all DPANs for the same card (and aspirationally even across card number changes on the same underlying account). The PAR can't be charged by any merchant, so this is not a security problem, but don't expect your digital wallet payments to be any more private than those done using your regular card or card number. https://wcapra.com/payment-account-reference-capraplus-your-source-for-insight/ https://wcapra.com/payment-account-reference-capraplus-your-... https://www.securetechalliance.org/wp-content/uploads/EMVCo-PAR-WP-FINAL-April-2018.pdf https://www.securetechalliance.org/wp-content/uploads/EMVCo-...

mattmaroon 3y ago
I would never expect anything to get more private ever again short of acts of government.
- ljlolel 3y ago
  Try reading the book Seeing like a State
worthless-trash 3y ago
> (and aspirationally even across card number changes on the same underlying account). My local Australian bank (NAB) does this. I imagine it's pretty normal across most credit cards here.
astrange 3y ago
Not true in Japan, Apple Pay uses anonymous ICOCA (aka Suica) cards which you can delete and recreate if you want.
- klausa 3y ago

WirelessGigabit 3y ago

I am not sure if I'm losing it but the following statement doesn't make sense in my head: > Your same card used through Apple Pay on your iPhone and iPad will show different DPANs, though since each device gets its own number. That 'though' does not compute. > Basically, when that Apple Pay card pops up when you’re checking out, expect everything on that card to be sent to the merchant Apple Pay. But what about Apple Pay? You know, the one in store, where you hold your phone against the NFC reader?

w-ll 3y ago
I might be wrong but they are acutally differnt CC numbers, with the prefix linked to ApplePay, and then they resolve or proxy to your acutally CC. You can use NFC Sniffers like the Flipper to see this in action. Same how ApplePay on the watch works without network, cuz it has already preset the AppleCC prefix on ur watch, and its just emulating that AppleCC to the card receiver. Same for the phone.
p_l 3y ago
It will transmit everything in EMV contactless spec, tokenized like always. DPAN is just token to represent a combination of device+card.
- WirelessGigabit 3y ago
  But it will not contain my address right? So if I use Apple Pay in store, at say Kroger for 100 times, can they track me? Or do I get a new credit card number every time?
  - p_l 3y ago
    You'll get every time the same card number, with said card being specific to the device. So they will be able to track that the same buyer is doing the purchase, which is what most POS-based analytics are interested in. Way more important is the (sometimes filtered) dump of everything on your bill that is passed on to various corporations (Nielsen, sometimes direct to suppliers), and how in-store analytics then build data at neighbourhood or per-store level. Store analytics need not know that specifically "WirelessGigabit" bought something, store analytics is more interested in "we have repeated customers with such and such spending and purchases" and "in this zip code we have this kind of population with associated types of buyers" and "This is how much people are buying certain products and when, so that suppliers can plan campaigns and production"

grahamgooch 3y ago

Look up Network token - or EMV token.

ojbyrne 3y ago

@dang @CharlesW typo. Please fix.

CharlesW 3y ago
I submitted the article title and can’t change this amended one, but you can reach @dang at hn@ycombinator.com.

jesprenj 3y ago

Apply Pay?

figassis 3y ago

Can we fix the typo in the title?

rob74 3y ago

There seems to be a misunderstanding about the details of how Apple Pay is spelled here...

madsbuch 3y ago

> Apple Pay through Wallet obfuscates your actual credit card numbers, which retailers infamously use to track customers. It’s far more private than using your credit card itself. I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Maybe someone can answer whether this is already solved by GDPR? If I do not give explicit consent to use my credit card details for anything else but withdrawing the agreed upon amount, that would be illegal (... in EU countries). Edit: It seems like this is, at least in some capacity, a commentary on the DMA. I understand the concerns about privacy in a US context, but these issues should already be solved in an EU context. So what Apple will most probably do, keep US companies from implementing NFC wallets but allow EU companies to implement NFC wallets, seems to be a really good compromise for the author - Privacy is kept both for the EU and the US users.

fennecfoxy 3y ago

That's a really good break down. >I highly doubt any banks or credit card issuers would do this themselves if given access to NFC tap-to-pay. Yeah, that's just more FUD around "Apple protects consumers therefore they should be able to do what they want", very topical atm. Idk why people glorify Apple and expect them to protect consumers when we should really be asking this of our governments (ie GDPR, the way that governments hold banks to particular standards) this is something the EU should push harder and expand on, imo - rules that are applicable to all companies. What's interesting is Apple's evolution in their marketing of privacy+security, because it's not something they've always done and it seemed to have started when they realised all their competitors have fragmented platforms and that Apple can compete since they do not need the revenue from onselling consumer data.