7 ms·

Apple Pay: An in-depth look at what's behind the secure payment system

42 points by IBM 12y ago

Someone1234 12y ago
The HK title is identical to the article's title but the article's title is misleading. Even the author goes into great pains in the first paragraph to say that this will look at "[the] process in broad strokes" and not really in-depth. Plus the article is really low-tech (spending a very long time teaching us about tokens) and very pro Apple (e.g. making claims that make no sense like "it may very well be the safest way to make any type of credit card payment" yeah, except those dozens of other identical systems we already have, and have had for at least a year!). I have nothing against Apple Pay at all. I am glad they joined the party. This article though is meh.
- surreal 12y ago
  Could you elaborate on the dozens of identical systems? I haven't yet managed to find one where no one except the credit card networks can see my CC number (and I thought the tokenization spec was only released 6 months ago...)
  - mikeash 12y ago
    Isn't that how contactless and EMV payments already do it, or am I mistaken?
    - giovannibajo1 12y ago
      No, the tokenization spec has just been released and Apple Pay is the first (large scale) implementation. Tokenization is a combo of a token bound to a device, a one-time signature made through a secret store in a non-readable chip, and a personal authentication of the person through a non-static code.
      - mikeash 12y ago
        Does that mean that existing chip and contactless systems just transmit the credit card number, as a sort of fancy version of a magstripe?
  - DannyBee 12y ago
    Virtual credit card provisioning seems common. For example: https://support.google.com/wallet/answer/2740044?hl=en https://support.google.com/wallet/answer/2740044?hl=en Token-like services are also common for contactless payment systems ...
    - surreal 12y ago
      Your linked example is drastically different. Although the merchant only sees a virtual card number, Google sees, stores and charges your real credit card number the old-fashioned way.
      - DannyBee 12y ago
        You say "Google sees your real credit card number". (I'll address the rest later) Somebody sees the credit card number, even in token based systems, even if it's only for a moment to acquire a token. In other words, either Apple stills sees it while it acquires a payment token, or someone does to issue the payment token, as it's the only mechanism that identifies the account number to get a token for. The tokenization specification has a whole section on what identification and verification should be taking place to ensure the "primary account number" (credit card number) that the payment token is replacing is one the user has authorization for. So let's focus on the "stores and charges". Yes, Google stores and charges your primary account number. This is just because Google happens to be the one doing the payment processing. Even in a token based system, again, somebody on the other side knows what real primary account number (credit card number) this token links back up to so they know what to subtract money from. The token based stuff is not an full anonymization protocol, it's mainly a way to securely avoid transmitting and storing credit card info to/by random merchants. In that respect, the virtual credit card numbers provide the same protection. They are one time use, and interception or storage by the merchant can not harm you. Secondarily, the payment tokens are also a way to reduce the number of networks your credit card number goes over, when used properly. The virtual credit card numbers perform the same function here too. The person who knows in either system is usually your payment processor (though in case it isn't, it's possible for the tokens to be used there too. however, nothing in Apple Pay currently guarantees this happens with the tokens). Since that is google here, it makes sense they would have the primary account data to do the lookup. If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that. The TL;DR is that virtual credit card numbers are in fact, a method of tokenization. The only reason they went with "token" is because they don't have to be credit card numbers, and because not all virtual credit card implementations have the same guarantees. In any case, if you want fully tokenized systems, those have existed too, just not en masse.
- orand 12y ago
  The article contains original reporting with newly sourced details not available elsewhere. As a result, as of this moment it's the most detailed article available. It's the best you're going to get, like it or leave it.
- natrius 12y ago
  "claims that make no sense like "it may very well be the safest way to make any type of credit card payment" yeah, except those dozens of other identical systems we already have, and have had for at least a year!" Pause for a second and believe me when I say that you are very wrong. Virtual, one-time use credit card numbers are very different from the EMVCo tokenization specification that Apple Pay implements. These differences have important security and privacy implications. Apple Pay is literally the safest way to use a credit card today. Read the specification if you don't understand why this is true. http://www.emvco.com/specifications.aspx?id=263 http://www.emvco.com/specifications.aspx?id=263 Alternatively, read the best technical summary of EMVCo tokenization: http://clover-developers.blogspot.com/2014/09/apple-pay.html http://clover-developers.blogspot.com/2014/09/apple-pay.html
  - personZ 12y ago
    Apple Pay is literally the safest way to use a credit card today. Credit (and debit) cards in Canada and elsewhere have had NFC functionality for several years now. You never hand your card or numbers to anyone, but instead through chip insertion or proximal NFC it communicates with the identifier on the card, which the payment processor can correlate with you, and using the secret on the card cryptographically signs a transaction. The most secure way I can use my credit card...is to use my credit card: Nothing that can be usurped is passed to the POS terminal. Apple is essentially injecting themselves in a simple process that works extremely well.
    - natrius 12y ago
      EDIT: I think this might be wrong, FYI. Sure, you never hand the card over when you pay with NFC, but that card number is being sent through computer systems that current events prove are very vulnerable. NFC and Chip-and-PIN protect the merchant from fraud, not the user. A malicious customer can't use a stolen card at a merchant that only accepts Chip-and-PIN payments. EMVCo tokenization generates a token that can only be used with one-time cryptograms generated with a secret key that never leaves the device. If someone hacks a merchant you pay via Apple Pay and tries to use your token as a card number online, it will be rejected even though it looks like a card number. EMVCo tokenization is a new thing. It is better than what came before it because it was designed with that goal in mind. People are reluctant to believe this for some reason.
muglug 12y ago
> Note, though, that the precise components of the Apple Pay cryptogram aren't publicly known. So we have a hash function whose workings are known only to Apple and Visa, MasterCard etc. I wonder how long that'll last.
- maccard 12y ago
  Its most likely some existing function, btu they aren't specifying which one.
pradn 12y ago
Only if everybody uses phones with Apple Pay compatible payment systems will every business see the need to support Apple Pay. I hope everyone gets on the same standard soon.
- mcintyre1994 12y ago
  Do they need anything above and beyond an NFC reader that supports contactless cards? Contactless is getting really popular in the UK - it's super cool if it is just that that it needs to work. Contactless on the tube too!
  - lstamour 12y ago
    The ones that roll out alongside chip-and-pin seem to be all that's needed to meet the requirements of this system from a technology standpoint. Behind the scenes, the hardware passes your fake device-account number as it would a credit card, and someone turns that into an actual credit card number deep in a financial system your retailer uses. There's different standards for contactless payment, though, and I bet Apple's partnering with EMV players because it wants to be as compatible as possible with existing arrangements.
- shekyboy 12y ago
  With the upcoming EMV transition most businesses are on that path. New POS terminals will have NFC built into it. Additionally this system offers a secure mechanism to the merchant as well without making a dent to their business processes. That should motivate them to move quickly on it to prevent Target/Home depot style mess. Finally the narrative around this is going to evolve the public perception. They are going to demand this from merchants for security, which should move the ball forward.
- manicdee 12y ago
  Expect to see Visa and Mastercard pushing this technology. As in: if you want to do business with Visa or Mastercard, you must use this technology. The merchant may end up facing higher fees for using card & sign terminals instead of chip & pin or NFC & token.
zecho 12y ago
This is great and all, but of the 9 million merchants that accept credit cards at the point of sale, Apple says only 220,000 locations will accept it at launch. Walmart and Best Buy have gone so far as to basically say they have no plans to implement and maintain NFC at the POS.
- beartime 12y ago
  Best Buy is struggling with getting people to buy anything to begin with..
- lstamour 12y ago
  This will change and quickly. All it takes is retailers being responsible for fraud and bam, new systems appear within 18-24 months, at most. I give it 3 years tops until you're cursing some place that requires you to insert a chip or wondering at the security of handing your card over to someone else to swipe... E.g. http://mainstreetinc.net/retail-pos-prepares-emv-nfc-apple-pay/ http://mainstreetinc.net/retail-pos-prepares-emv-nfc-apple-p... At least here in Canada, we went from "it's announced" to "it's everywhere" in about 2 years. Now.... whether the terminals will accept my contactless card, that's another question. I can't travel with just an iPhone until I know I won't need that card in my back pocket...
- rconti 12y ago
  October 2015 they'll be liable for CC fraud if the transaction in question was not cleared on an NFC+EMV capable terminals. I don't know where your info is from, but it's either old, or they'll change their tune fast. Also, some businesses can avoid PCI audits if 75% of their transactions are cleared on NFC+EMV terminals. The liability shift you keep hearing about bundles NFC+EMV together into a single concept. They're inseparable as far as CC liability is concerned.
  - frogpelt 12y ago
    His info is based on the fact that Walmart is all in with CurrentC another mobile payment system developed by MCX. Unless Apple can show that Walmart will actually lose customers by not doing it, I don't see them adopting Apple Pay soon. EDIT: Nevermind. I wasn't aware that NFC was the only requirement on the merchant-side for Apple Pay to work.
spullara 12y ago
Here is more technical description of how exactly it works if you are interested in the details: http://clover-developers.blogspot.com/2014/09/apple-pay.html http://clover-developers.blogspot.com/2014/09/apple-pay.html

42 points by IBM 12y ago

The HK title is identical to the article's title but the article's title is misleading. Even the author goes into great pains in the first paragraph to say that this will look at "[the] process in broad strokes" and not really in-depth. Plus the article is really low-tech (spending a very long time teaching us about tokens) and very pro Apple (e.g. making claims that make no sense like "it may very well be the safest way to make any type of credit card payment" yeah, except those dozens of other identical systems we already have, and have had for at least a year!). I have nothing against Apple Pay at all. I am glad they joined the party. This article though is meh.

surreal 12y ago
Could you elaborate on the dozens of identical systems? I haven't yet managed to find one where no one except the credit card networks can see my CC number (and I thought the tokenization spec was only released 6 months ago...)
- mikeash 12y ago
  Isn't that how contactless and EMV payments already do it, or am I mistaken?
  - giovannibajo1 12y ago
    No, the tokenization spec has just been released and Apple Pay is the first (large scale) implementation. Tokenization is a combo of a token bound to a device, a one-time signature made through a secret store in a non-readable chip, and a personal authentication of the person through a non-static code.
    - mikeash 12y ago
      Does that mean that existing chip and contactless systems just transmit the credit card number, as a sort of fancy version of a magstripe?
- DannyBee 12y ago
  Virtual credit card provisioning seems common. For example: https://support.google.com/wallet/answer/2740044?hl=en https://support.google.com/wallet/answer/2740044?hl=en Token-like services are also common for contactless payment systems ...
  - surreal 12y ago
    Your linked example is drastically different. Although the merchant only sees a virtual card number, Google sees, stores and charges your real credit card number the old-fashioned way.
    - DannyBee 12y ago
      You say "Google sees your real credit card number". (I'll address the rest later) Somebody sees the credit card number, even in token based systems, even if it's only for a moment to acquire a token. In other words, either Apple stills sees it while it acquires a payment token, or someone does to issue the payment token, as it's the only mechanism that identifies the account number to get a token for. The tokenization specification has a whole section on what identification and verification should be taking place to ensure the "primary account number" (credit card number) that the payment token is replacing is one the user has authorization for. So let's focus on the "stores and charges". Yes, Google stores and charges your primary account number. This is just because Google happens to be the one doing the payment processing. Even in a token based system, again, somebody on the other side knows what real primary account number (credit card number) this token links back up to so they know what to subtract money from. The token based stuff is not an full anonymization protocol, it's mainly a way to securely avoid transmitting and storing credit card info to/by random merchants. In that respect, the virtual credit card numbers provide the same protection. They are one time use, and interception or storage by the merchant can not harm you. Secondarily, the payment tokens are also a way to reduce the number of networks your credit card number goes over, when used properly. The virtual credit card numbers perform the same function here too. The person who knows in either system is usually your payment processor (though in case it isn't, it's possible for the tokens to be used there too. however, nothing in Apple Pay currently guarantees this happens with the tokens). Since that is google here, it makes sense they would have the primary account data to do the lookup. If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that. The TL;DR is that virtual credit card numbers are in fact, a method of tokenization. The only reason they went with "token" is because they don't have to be credit card numbers, and because not all virtual credit card implementations have the same guarantees. In any case, if you want fully tokenized systems, those have existed too, just not en masse.
orand 12y ago
The article contains original reporting with newly sourced details not available elsewhere. As a result, as of this moment it's the most detailed article available. It's the best you're going to get, like it or leave it.
natrius 12y ago
"claims that make no sense like "it may very well be the safest way to make any type of credit card payment" yeah, except those dozens of other identical systems we already have, and have had for at least a year!" Pause for a second and believe me when I say that you are very wrong. Virtual, one-time use credit card numbers are very different from the EMVCo tokenization specification that Apple Pay implements. These differences have important security and privacy implications. Apple Pay is literally the safest way to use a credit card today. Read the specification if you don't understand why this is true. http://www.emvco.com/specifications.aspx?id=263 http://www.emvco.com/specifications.aspx?id=263 Alternatively, read the best technical summary of EMVCo tokenization: http://clover-developers.blogspot.com/2014/09/apple-pay.html http://clover-developers.blogspot.com/2014/09/apple-pay.html
- personZ 12y ago
  Apple Pay is literally the safest way to use a credit card today. Credit (and debit) cards in Canada and elsewhere have had NFC functionality for several years now. You never hand your card or numbers to anyone, but instead through chip insertion or proximal NFC it communicates with the identifier on the card, which the payment processor can correlate with you, and using the secret on the card cryptographically signs a transaction. The most secure way I can use my credit card...is to use my credit card: Nothing that can be usurped is passed to the POS terminal. Apple is essentially injecting themselves in a simple process that works extremely well.
  - natrius 12y ago
    EDIT: I think this might be wrong, FYI. Sure, you never hand the card over when you pay with NFC, but that card number is being sent through computer systems that current events prove are very vulnerable. NFC and Chip-and-PIN protect the merchant from fraud, not the user. A malicious customer can't use a stolen card at a merchant that only accepts Chip-and-PIN payments. EMVCo tokenization generates a token that can only be used with one-time cryptograms generated with a secret key that never leaves the device. If someone hacks a merchant you pay via Apple Pay and tries to use your token as a card number online, it will be rejected even though it looks like a card number. EMVCo tokenization is a new thing. It is better than what came before it because it was designed with that goal in mind. People are reluctant to believe this for some reason.

muglug 12y ago

> Note, though, that the precise components of the Apple Pay cryptogram aren't publicly known. So we have a hash function whose workings are known only to Apple and Visa, MasterCard etc. I wonder how long that'll last.

maccard 12y ago
Its most likely some existing function, btu they aren't specifying which one.

pradn 12y ago

Only if everybody uses phones with Apple Pay compatible payment systems will every business see the need to support Apple Pay. I hope everyone gets on the same standard soon.

mcintyre1994 12y ago
Do they need anything above and beyond an NFC reader that supports contactless cards? Contactless is getting really popular in the UK - it's super cool if it is just that that it needs to work. Contactless on the tube too!
- lstamour 12y ago
  The ones that roll out alongside chip-and-pin seem to be all that's needed to meet the requirements of this system from a technology standpoint. Behind the scenes, the hardware passes your fake device-account number as it would a credit card, and someone turns that into an actual credit card number deep in a financial system your retailer uses. There's different standards for contactless payment, though, and I bet Apple's partnering with EMV players because it wants to be as compatible as possible with existing arrangements.
shekyboy 12y ago
With the upcoming EMV transition most businesses are on that path. New POS terminals will have NFC built into it. Additionally this system offers a secure mechanism to the merchant as well without making a dent to their business processes. That should motivate them to move quickly on it to prevent Target/Home depot style mess. Finally the narrative around this is going to evolve the public perception. They are going to demand this from merchants for security, which should move the ball forward.
manicdee 12y ago
Expect to see Visa and Mastercard pushing this technology. As in: if you want to do business with Visa or Mastercard, you must use this technology. The merchant may end up facing higher fees for using card & sign terminals instead of chip & pin or NFC & token.

zecho 12y ago

This is great and all, but of the 9 million merchants that accept credit cards at the point of sale, Apple says only 220,000 locations will accept it at launch. Walmart and Best Buy have gone so far as to basically say they have no plans to implement and maintain NFC at the POS.

beartime 12y ago
Best Buy is struggling with getting people to buy anything to begin with..
lstamour 12y ago
This will change and quickly. All it takes is retailers being responsible for fraud and bam, new systems appear within 18-24 months, at most. I give it 3 years tops until you're cursing some place that requires you to insert a chip or wondering at the security of handing your card over to someone else to swipe... E.g. http://mainstreetinc.net/retail-pos-prepares-emv-nfc-apple-pay/ http://mainstreetinc.net/retail-pos-prepares-emv-nfc-apple-p... At least here in Canada, we went from "it's announced" to "it's everywhere" in about 2 years. Now.... whether the terminals will accept my contactless card, that's another question. I can't travel with just an iPhone until I know I won't need that card in my back pocket...
rconti 12y ago
October 2015 they'll be liable for CC fraud if the transaction in question was not cleared on an NFC+EMV capable terminals. I don't know where your info is from, but it's either old, or they'll change their tune fast. Also, some businesses can avoid PCI audits if 75% of their transactions are cleared on NFC+EMV terminals. The liability shift you keep hearing about bundles NFC+EMV together into a single concept. They're inseparable as far as CC liability is concerned.
- frogpelt 12y ago
  His info is based on the fact that Walmart is all in with CurrentC another mobile payment system developed by MCX. Unless Apple can show that Walmart will actually lose customers by not doing it, I don't see them adopting Apple Pay soon. EDIT: Nevermind. I wasn't aware that NFC was the only requirement on the merchant-side for Apple Pay to work.

spullara 12y ago

Here is more technical description of how exactly it works if you are interested in the details: http://clover-developers.blogspot.com/2014/09/apple-pay.html http://clover-developers.blogspot.com/2014/09/apple-pay.html