3 ms·

I think I'm missing something. How does Apple Pay have enough info to generate the larger payload they're looking for if you add cards by typing in the number?

by wilde 12y ago

ploxiln 12y ago
Apple Pay gets the lower rate just because they decided it does, there's no real technical reason. The technical answer was just re-iterating that with the full technical terms. If you think about it, until chip-and-pin is required in the US, there's not really more security for card-present transactions in the US. Anything they read from the card when they swipe and use to validate the transaction could be intercepted, saved, and written to another card. So it's all arbitrary. Sometimes they ask for your zip code, so they get a better rate. Sometimes (often) they ask for the csc online, so they get a better rate. I guess the statistics work out, but from a technical security point of view, it all seems not really secure.
- ghshephard 12y ago
  You can't just add a credit card to an iPhone - it has to be validated against the owners account. The data Being sent to the Nfc terminal can't be used for anything other than that transaction, and it's generated by the secure element on the iPhone.
  - stock_toaster 12y ago
    > it has to be validated against the owners account Indeed. I had to actually call my bank and get them to authorize my card for apple pay. * take picture of card, enter CSC/code * call bank (tell them a bunch of things about me to verify I am me) * bank authorizes card for apple pay
prostoalex 12y ago
http://www.zdnet.com/apple-pay-and-security-could-tokenization-be-the-tool-that-curbs-data-breaches-7000033585/ http://www.zdnet.com/apple-pay-and-security-could-tokenizati... [Apple Pay] "Tokenization removes the actual credit card number and replaces it with a randomly generated number. That number, or token, can be configured to expire after one purchase or made specific to a certain transaction, making it a useless target for hackers or fraudsters. But what's more, tokenization removes a huge storage burden from merchants, since they never see a person's actual credit card information and it never enters their POS system or online payment portal. Now, Apple didn't invent tokenization. But by taking the tokenization route, the Cupertino powerhouse could be looking to ride the security wave all the way to payment success, especially considering the rising number of merchant data breaches and instances of stolen credit card information that continue to hit the payment and retail industries."
- fpgeek 12y ago
  > But what's more, tokenization removes a huge storage burden from merchants, since they never see a person's actual credit card information and it never enters their POS system or online payment portal. Yes, merchants think that getting additional customer-identifying information that forces them to run extra analyses on the mountains of transaction data they warehouse is a huge burden they'd like to be relieved of. </sarcasm>
  - prostoalex 12y ago
    Don't most of them use loyalty cards for that purpose anyways? Target's data http://www.usatoday.com/story/money/business/2014/03/11/target-customer-traffic/6262059/ http://www.usatoday.com/story/money/business/2014/03/11/targ... showed showed that customer visits, sales and profits decreased significantly following the breach. They would probably be happy to offload that nightmare onto somebody else.
    - fpgeek 12y ago
      As I understand it, retailers use loyalty cards to improve their customer-level data and as a way to act on that data (e.g. targeted coupons), but even the baseline they can extract without loyalty cards is very important to them. In fact, even after last year's breach, Target clearly isn't happy offloading that nightmare. They're currently teting CurrentC: http://www.dispatch.com/content/stories/business/2014/11/10/target-testing-its-own-mobile-app-hopeful-that-it-can-rival-apple-pay.html http://www.dispatch.com/content/stories/business/2014/11/10/...
  - eldelshell 12y ago
    With a CC you don't get that much data since there's no relation between CC number (the one you store) and a customers data (address, age, gender). That's why they invented loyalty cards. We're talking about brick&mortar retailers, online is different since you (may) ask all this data before any payment.
evanspa 12y ago
When you provision a card to Apple Pay by taking a photo of your card or entering the info manually, what happens next is that the iPhone makes a call to the card network (Visa/MC/Amex) to verify the card data (the card network will also make a call to the issuing bank of the card for a validity check), and if all is well, the network will return the same information that is effectively provisioned to physical ICC chips that you see in newer credit/debit cards. These parameters are stored in the iPhone 6's secure element, and allow the iPhone to perform full EMV transactions. One difference between these parameters and those provisioned to a physical ICC on a new debit/credit card, is that the card number (PAN) is not used; instead a payment token is used (it looks like a PAN - it has the same number of digits, etc). This allows Apple Pay transactions to run on the same infrastructure as chip+pin/signature transactions.

I think I'm missing something. How does Apple Pay have enough info to generate the larger payload they're looking for if you add cards by typing in the number?

by wilde 12y ago

I think I'm missing something. How does Apple Pay have enough info to generate the larger payload they're looking for if you add cards by typing in the number?

ploxiln 12y ago

Apple Pay gets the lower rate just because they decided it does, there's no real technical reason. The technical answer was just re-iterating that with the full technical terms. If you think about it, until chip-and-pin is required in the US, there's not really more security for card-present transactions in the US. Anything they read from the card when they swipe and use to validate the transaction could be intercepted, saved, and written to another card. So it's all arbitrary. Sometimes they ask for your zip code, so they get a better rate. Sometimes (often) they ask for the csc online, so they get a better rate. I guess the statistics work out, but from a technical security point of view, it all seems not really secure.

ghshephard 12y ago
You can't just add a credit card to an iPhone - it has to be validated against the owners account. The data Being sent to the Nfc terminal can't be used for anything other than that transaction, and it's generated by the secure element on the iPhone.
- stock_toaster 12y ago
  > it has to be validated against the owners account Indeed. I had to actually call my bank and get them to authorize my card for apple pay. * take picture of card, enter CSC/code * call bank (tell them a bunch of things about me to verify I am me) * bank authorizes card for apple pay

prostoalex 12y ago

http://www.zdnet.com/apple-pay-and-security-could-tokenization-be-the-tool-that-curbs-data-breaches-7000033585/ http://www.zdnet.com/apple-pay-and-security-could-tokenizati... [Apple Pay] "Tokenization removes the actual credit card number and replaces it with a randomly generated number. That number, or token, can be configured to expire after one purchase or made specific to a certain transaction, making it a useless target for hackers or fraudsters. But what's more, tokenization removes a huge storage burden from merchants, since they never see a person's actual credit card information and it never enters their POS system or online payment portal. Now, Apple didn't invent tokenization. But by taking the tokenization route, the Cupertino powerhouse could be looking to ride the security wave all the way to payment success, especially considering the rising number of merchant data breaches and instances of stolen credit card information that continue to hit the payment and retail industries."

fpgeek 12y ago
> But what's more, tokenization removes a huge storage burden from merchants, since they never see a person's actual credit card information and it never enters their POS system or online payment portal. Yes, merchants think that getting additional customer-identifying information that forces them to run extra analyses on the mountains of transaction data they warehouse is a huge burden they'd like to be relieved of. </sarcasm>
- prostoalex 12y ago
  Don't most of them use loyalty cards for that purpose anyways? Target's data http://www.usatoday.com/story/money/business/2014/03/11/target-customer-traffic/6262059/ http://www.usatoday.com/story/money/business/2014/03/11/targ... showed showed that customer visits, sales and profits decreased significantly following the breach. They would probably be happy to offload that nightmare onto somebody else.
  - fpgeek 12y ago
    As I understand it, retailers use loyalty cards to improve their customer-level data and as a way to act on that data (e.g. targeted coupons), but even the baseline they can extract without loyalty cards is very important to them. In fact, even after last year's breach, Target clearly isn't happy offloading that nightmare. They're currently teting CurrentC: http://www.dispatch.com/content/stories/business/2014/11/10/target-testing-its-own-mobile-app-hopeful-that-it-can-rival-apple-pay.html http://www.dispatch.com/content/stories/business/2014/11/10/...
- eldelshell 12y ago
  With a CC you don't get that much data since there's no relation between CC number (the one you store) and a customers data (address, age, gender). That's why they invented loyalty cards. We're talking about brick&mortar retailers, online is different since you (may) ask all this data before any payment.

evanspa 12y ago

When you provision a card to Apple Pay by taking a photo of your card or entering the info manually, what happens next is that the iPhone makes a call to the card network (Visa/MC/Amex) to verify the card data (the card network will also make a call to the issuing bank of the card for a validity check), and if all is well, the network will return the same information that is effectively provisioned to physical ICC chips that you see in newer credit/debit cards. These parameters are stored in the iPhone 6's secure element, and allow the iPhone to perform full EMV transactions. One difference between these parameters and those provisioned to a physical ICC on a new debit/credit card, is that the card number (PAN) is not used; instead a payment token is used (it looks like a PAN - it has the same number of digits, etc). This allows Apple Pay transactions to run on the same infrastructure as chip+pin/signature transactions.