3 ms·

Could you elaborate on the dozens of identical systems? I haven't yet managed to find one where no one except the credit card networks can see my CC number (and

by surreal 12y ago

Could you elaborate on the dozens of identical systems? I haven't yet managed to find one where no one except the credit card networks can see my CC number (and I thought the tokenization spec was only released 6 months ago...)

mikeash 12y ago
Isn't that how contactless and EMV payments already do it, or am I mistaken?
- giovannibajo1 12y ago
  No, the tokenization spec has just been released and Apple Pay is the first (large scale) implementation. Tokenization is a combo of a token bound to a device, a one-time signature made through a secret store in a non-readable chip, and a personal authentication of the person through a non-static code.
  - mikeash 12y ago
    Does that mean that existing chip and contactless systems just transmit the credit card number, as a sort of fancy version of a magstripe?
DannyBee 12y ago
Virtual credit card provisioning seems common. For example: https://support.google.com/wallet/answer/2740044?hl=en https://support.google.com/wallet/answer/2740044?hl=en Token-like services are also common for contactless payment systems ...
- surreal 12y ago
  Your linked example is drastically different. Although the merchant only sees a virtual card number, Google sees, stores and charges your real credit card number the old-fashioned way.
  - DannyBee 12y ago
    You say "Google sees your real credit card number". (I'll address the rest later) Somebody sees the credit card number, even in token based systems, even if it's only for a moment to acquire a token. In other words, either Apple stills sees it while it acquires a payment token, or someone does to issue the payment token, as it's the only mechanism that identifies the account number to get a token for. The tokenization specification has a whole section on what identification and verification should be taking place to ensure the "primary account number" (credit card number) that the payment token is replacing is one the user has authorization for. So let's focus on the "stores and charges". Yes, Google stores and charges your primary account number. This is just because Google happens to be the one doing the payment processing. Even in a token based system, again, somebody on the other side knows what real primary account number (credit card number) this token links back up to so they know what to subtract money from. The token based stuff is not an full anonymization protocol, it's mainly a way to securely avoid transmitting and storing credit card info to/by random merchants. In that respect, the virtual credit card numbers provide the same protection. They are one time use, and interception or storage by the merchant can not harm you. Secondarily, the payment tokens are also a way to reduce the number of networks your credit card number goes over, when used properly. The virtual credit card numbers perform the same function here too. The person who knows in either system is usually your payment processor (though in case it isn't, it's possible for the tokens to be used there too. however, nothing in Apple Pay currently guarantees this happens with the tokens). Since that is google here, it makes sense they would have the primary account data to do the lookup. If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that. The TL;DR is that virtual credit card numbers are in fact, a method of tokenization. The only reason they went with "token" is because they don't have to be credit card numbers, and because not all virtual credit card implementations have the same guarantees. In any case, if you want fully tokenized systems, those have existed too, just not en masse.
    - natrius 12y ago
      EMVCo payment tokenization is more secure and more private than Google Wallet. With Google Wallet, two people know your card number and purchase history: Google and your issuer. With EMVCo tokenization, just your issuer knows your card number and purchase history. It's better. It's the future. "If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that." I disagree. Care to explain?

by surreal 12y ago

mikeash 12y ago

Isn't that how contactless and EMV payments already do it, or am I mistaken?

giovannibajo1 12y ago
No, the tokenization spec has just been released and Apple Pay is the first (large scale) implementation. Tokenization is a combo of a token bound to a device, a one-time signature made through a secret store in a non-readable chip, and a personal authentication of the person through a non-static code.
- mikeash 12y ago
  Does that mean that existing chip and contactless systems just transmit the credit card number, as a sort of fancy version of a magstripe?

DannyBee 12y ago

Virtual credit card provisioning seems common. For example: https://support.google.com/wallet/answer/2740044?hl=en https://support.google.com/wallet/answer/2740044?hl=en Token-like services are also common for contactless payment systems ...

surreal 12y ago
Your linked example is drastically different. Although the merchant only sees a virtual card number, Google sees, stores and charges your real credit card number the old-fashioned way.
- DannyBee 12y ago
  You say "Google sees your real credit card number". (I'll address the rest later) Somebody sees the credit card number, even in token based systems, even if it's only for a moment to acquire a token. In other words, either Apple stills sees it while it acquires a payment token, or someone does to issue the payment token, as it's the only mechanism that identifies the account number to get a token for. The tokenization specification has a whole section on what identification and verification should be taking place to ensure the "primary account number" (credit card number) that the payment token is replacing is one the user has authorization for. So let's focus on the "stores and charges". Yes, Google stores and charges your primary account number. This is just because Google happens to be the one doing the payment processing. Even in a token based system, again, somebody on the other side knows what real primary account number (credit card number) this token links back up to so they know what to subtract money from. The token based stuff is not an full anonymization protocol, it's mainly a way to securely avoid transmitting and storing credit card info to/by random merchants. In that respect, the virtual credit card numbers provide the same protection. They are one time use, and interception or storage by the merchant can not harm you. Secondarily, the payment tokens are also a way to reduce the number of networks your credit card number goes over, when used properly. The virtual credit card numbers perform the same function here too. The person who knows in either system is usually your payment processor (though in case it isn't, it's possible for the tokens to be used there too. however, nothing in Apple Pay currently guarantees this happens with the tokens). Since that is google here, it makes sense they would have the primary account data to do the lookup. If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that. The TL;DR is that virtual credit card numbers are in fact, a method of tokenization. The only reason they went with "token" is because they don't have to be credit card numbers, and because not all virtual credit card implementations have the same guarantees. In any case, if you want fully tokenized systems, those have existed too, just not en masse.
  - natrius 12y ago
    EMVCo payment tokenization is more secure and more private than Google Wallet. With Google Wallet, two people know your card number and purchase history: Google and your issuer. With EMVCo tokenization, just your issuer knows your card number and purchase history. It's better. It's the future. "If you are expecting tokens to replace credit card numbers all the way to the issuing bank, you are sorely mistaken. The lookup happens much earlier than that." I disagree. Care to explain?