12 ms·

Google Wallet and Softcard

64 points by mrry 12y ago

higherpurpose 12y ago
What I want to know is when will Google Wallet introduce Apple Pay-like tokenization so merchants can't track your purchases? Google is actually kind of doing the opposite right now. It's tracking your purchases through a virtual credit card number and then giving all that data to merchants. Sure you can reset that number, but since it's not automatic like Apple's tokens, that means it will be used about as much as resetting the advertising IDs on Android phones - so almost never. It also doesn't help that Google is pro-actively giving that data to merchants (and now to carriers, too, I assume).
- myko 12y ago
  It already does.
  - bentruyman 12y ago
    Google Wallet does not utilize any form of tokenization to my knowledge. The best you'll get is a proxy card. But that proxy card is used for all merchants.
    - DannyBee 12y ago
      Can you explain what the difference you think there is between a proxy card and tokenization, if the proxy card was randomly generated each transaction (which wallet supports) (Hint: There is no difference, both would be valid methods of tokenization by the spec :P)
      - thrownaway2424 12y ago
        But the proxy card isn't randomly generated. It's always the same.
      - natrius 12y ago
        Google gets your payment data. Apple doesn't.
        DannyBee 12y ago
        Google is the payment processor. The tokenization spec completely supports and expects payment processors who are not issuing banks will have payment data :) (I know this goes against what some words in blogs on the internet say, but feel free to read the EMV tokenization spec yourself, and you'll see it's true. Tokenization != only issuing bank sees payment data. Maybe some "ecosystems" try to guarantee it, but it's certainly not required)
      - simoncion 12y ago
        Google Wallet may support per-transaction proxy card randomization. Does it actually do this? Can you link to a spec or documentation that supports your claims? Thanks!
        DannyBee 12y ago
        AFAIK, it does. But that's just what i'm told, if you have data that says it doesn't, ...
        simoncion 12y ago
        Who told you? I work in nether finance, nor on the Wallet team, so I don't have information about the details of Wallet's workings. Regardless, it's proper for the claimant to provide data to support their claim. :)
    - Oletros 12y ago
      From the Wallet FAQ [1]: > “Wallet also uses dynamically rotating credentials that change with each transaction and are usable for a single payment only.” Does it means that tokenizes something? [1] https://www.google.es/wallet/faq.html#tab=faq-security https://www.google.es/wallet/faq.html#tab=faq-security
      - jusben1369 12y ago
        No. As I understand it, and it can change over time, Google stores your actual card. Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. It has a finite amount of value to reduce the exposure to fraud (the value is very close the amount you are about to purchase something for). That one time use card then travels the networks very much in the same way that that one time gift card for $50 does. Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant accounts yet) so they recognize the ApplePay specific network token and allow it to act like a normal credit card. The token is reusable unlike the one time use cards. Lose your phone (or have it stolen) and just that token is revoked - not your card and all your other automated billing etc with it.
        Oletros 12y ago
        > Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. This is the definition of tokenization > Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant What? > The token is reusable unlike the one time use cards What? I think you have to re read how Apple Pay works and what tokenization really is because i Think you're a little confused
        jusben1369 12y ago
        That you think a one time use card is the definition of a token makes this a non starter in terms of a discussion.
    - tonyhb 12y ago
      I think Google Wallet even supports it from the HTML5 requestAutocomplete() API for web stores. Not sure if it's a unique card per transaction, but it's good to know you have some protection. Check out the HTML demo here: https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive.com/host/0B28BnxIvH5DueUxvWVNsQXd5dU0/ https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive...
- deleted 12y ago
  [deleted]
- Shooti 12y ago
  They already do according to the Google Wallet FAQ: "Google Wallet stores your credit and debit cards on secure servers and encrypts your payment information with industry-standard SSL (secure socket layer) technology. Your full credit and debit card information is never shown in the app and won't be shared with the merchant. In addition, access to Google Wallet is protected by password or PIN. We also recommend locking your phone with a passcode for additional security." "Your actual credit card number is not stored. Only the Google Wallet Virtual Card is stored, and Android's native access policies prevent malicious applications from obtaining the data. Even if the data is compromised, Wallet uses dynamically rotating credentials that change with each transaction and are usable for a single payment only. Finally, all transactions are monitored in real-time with Google’s risk and fraud detection systems." https://www.google.com/wallet/faq.html#tab=faq-security https://www.google.com/wallet/faq.html#tab=faq-security Keep in mind "Tokenization" has existed in the NFC industry for years, the only thing which changed last year is that the EMV standards body agreed and released a standardized way to do it in March 2014. Apple Pay is a branded solution over that. So what it really boils down to is whether or not you take Google's word for it that their independent solution is secure. If not, you owe it to yourself to not be using a Google Android phone in the first place.
  - higherpurpose 12y ago
    So there are two issues I was talking about: 1) rotation of tokens/virtual card numbers 2) giving the transaction data to merchants From what you copied here it seems that Google is rotating the virtual numbers - however, there's no way of knowing if Google isn't still tracking all of those numbers through your account and linking them back together for data mining. I think there's a high probability Google is doing that. Google only says it's rotating the numbers. And that leads us to #2, which remains completely unanswered. Google says it doesn't give the credit card information to merchants (as in your real credit card number). However it could still give the transaction data.
    - Oletros 12y ago
      Google is the payment processor, of course they track and store the transactions.
quadrature 12y ago
And yet it still doesn't work in Canada which adopted the technology ahead of the US and has a much wider roll out.
- derefr 12y ago
  AFAIK, Canada's "flash payments" use incompatible physical-layer standards. To make it work, you'd need a phone with two NFC radios in it. Since phones with both GSM and CDMA radios are extremely recent—despite the need being obvious for a very long time—I doubt we'll see hybrid-radio NFC designs any time soon.
  - quadrature 12y ago
    Do you have a source for this?, I found a list [1] of handsets that are compatible with Visa paywave which i see around a lot. It suggests that at least some handsets are capable of interfacing with existing NFC terminals. [1] https://technologypartner.visa.com/Download.aspx?id=188 https://technologypartner.visa.com/Download.aspx?id=188
  - mynameisvlad 12y ago
    Do you mean Interac Flash? Because that's EMV[1], just like Visa's PayWave, MC's PayPass, etc. They're all interchangeable, and they all use the same standard. There's no two radios needed. Plus, most NFC terminals in Canada were first built for PayWave/PayPass, so it would be stupid for them to try and go in a completely separate direction for debit NFC transactions. [1]: http://www.interac.ca/en/press-releases/mobile-debit-eng http://www.interac.ca/en/press-releases/mobile-debit-eng under "About mobile Interac Flash"
  - alanctgardner3 12y ago
    Nope. I had Google Wallet working on my Neuxs S in Canada two years ago, you can use it at any Tim Hortons ;) Canadian banks do support their own mobile wallets (similar to the ISIS model), but only on a few cherry-picked devices, and with a custom SIM. See http://www.rbcroyalbank.com/mobile/wallet/ http://www.rbcroyalbank.com/mobile/wallet/
- 12y ago
IshKebab 12y ago
I guess the carriers are scared enough of Apple Pay that they're willing to work with Google now.
- eli 12y ago
  Or perhaps Google is scared enough of the carriers' own effort that it felt forced to buy them off.
- MBCook 12y ago
  Or maybe they just realized that they were just putting good money after bad (because it wasn't succeeding) and decided to cut their losses and avoid the (small?) risk of alienating customers.
arthurcolle 12y ago
Is this an acquisition?
- mikeyouse 12y ago
  Google called it a partnership and Softcard said something along the lines of "Google is acquiring Softcard's technology" which leaves me a bit confused but I don't think it's an outright acquisition.
- deleted 12y ago
  [deleted]
  - arthurcolle 12y ago
    Thank you for the link. Softcard was pre-installed on my Moto X 2013, so I wonder what's really going to change.
- deleted 12y ago
  [deleted]
coleca 12y ago
If Google Wallet was to continue to exist this was inevitable because Softcard (formerly ISIS) had locked up the usage of the secure element inside all the Android phones coming from all the US carriers except Sprint and its MVNOs. And ISIS was having a very hard time getting retailers onboard with its platform despite offering 7 figure incentives and covering their implementation costs for integration with their point of sale systems.
- wmf 12y ago
  Isn't there an EMV-NFC standard that eliminates the need for POS integration? IIRC CurrentC was the one that isn't using the standard.
  - coleca 12y ago
    Yes, there is a standard for payments on the PIN pads. However, the real push for ISIS/Softcard was that they could do more than payments. They wanted to be able to push coupons through the PIN pads to the POS from their app. That was how they were planning to monetize the platform. The fees they would get from banks to hook into the system were minimal. Even if the PIN pads could support coupons over NFC, most large scale POS software could not. I had experience last year trying to integrate ISIS/Softcard into a large retailer that was running IBM/Toshiba ACE POS software and ISIS/Softcard support wasn't even IBM/Toshiba's radar. Many large retailers run ACE (Kroger, Safeway, Costco, Macys, etc.).
    - wmf 12y ago
      Ah, my mistake. I was thinking of the credit card system as a "dumb pipe" for money. Why would anyone want to build that?
- jsight 12y ago
  Google Wallet works (and has worked) just fine with NFC payments on my Verizon phone. This is much less of an issue with modern phones due to changes in the way the secure element works. (EDIT: To be clear, I am talking about this: https://developer.android.com/about/versions/kitkat.html#44-hce https://developer.android.com/about/versions/kitkat.html#44-...)
freehunter 12y ago
I'm getting tired of "hey guys check out this really cool, half-baked, and for absolutely no reason, single-platform technology". Yeah iMessage/Facetime and Google Hangouts is really cool but we're still using SMS and voice calling because half of my friends have Android and half have iPhones. Worse yet, we're all using Facebook Messenger or Snapchat because at least there is some consistency between vendors there, unlike with SMS. Handoff/Continuity is great, but if I can't hand off calls from my iPhone to my Windows desktop or apps to my Linux laptop, who cares? I'm never going to have a chance to use that. Oh look at this cool site that uses Chrome's new features. What a shame I use Firefox. And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic. We forced Microsoft to stop locking out their competitors with proprietary versions of things that should be standards, and we did that more than 15 years ago. What progress have we made since then?
- JeremyBanks 12y ago
  > And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic. Are you personally using two or three phone platforms with such frequency that this is relevant?
  - edgarvaldes 12y ago
    Maybe he doesnt want to lock himself with a brand, mid-term.
  - freehunter 12y ago
    I bought a Lumia 920 when it came out in October 2012. I used that as a daily driver until around March of 2013, when I bought a Nexus 4. I wasn't terribly satisfied with it when it came to the camera and GPS navigation, so when I went on trips or to events I would switch the SIM back to the Lumia 920. I got tired of this and bought an iPhone 5c in December 2013. My wife broke her iPhone 4 in June of 2014, so I gave her my 5c and switched back to the Lumia 920 until my work gave me an iPhone 5s in October of 2014. Luckily I'm using a carrier that doesn't care how often you want to switch your phone, doesn't lock their phones, and doesn't make you talk to them to activate a new phone. I think everyone should have that freedom. So in the last ~2 years, I've used three phone platforms with some regularity. I also have a Windows desktop and I use a RHEL-based laptop for work. I like to use the best that I can get for the task I'm using it for, no matter what platform or ecosystem. Because of that, I make it a habit to not put things in my workflow that are not reasonably cross-platform, unless there is literally no better option.

64 points by mrry 12y ago

What I want to know is when will Google Wallet introduce Apple Pay-like tokenization so merchants can't track your purchases? Google is actually kind of doing the opposite right now. It's tracking your purchases through a virtual credit card number and then giving all that data to merchants. Sure you can reset that number, but since it's not automatic like Apple's tokens, that means it will be used about as much as resetting the advertising IDs on Android phones - so almost never. It also doesn't help that Google is pro-actively giving that data to merchants (and now to carriers, too, I assume).

myko 12y ago
It already does.
- bentruyman 12y ago
  Google Wallet does not utilize any form of tokenization to my knowledge. The best you'll get is a proxy card. But that proxy card is used for all merchants.
  - DannyBee 12y ago
    Can you explain what the difference you think there is between a proxy card and tokenization, if the proxy card was randomly generated each transaction (which wallet supports) (Hint: There is no difference, both would be valid methods of tokenization by the spec :P)
    - thrownaway2424 12y ago
      But the proxy card isn't randomly generated. It's always the same.
    - natrius 12y ago
      Google gets your payment data. Apple doesn't.
      - DannyBee 12y ago
        Google is the payment processor. The tokenization spec completely supports and expects payment processors who are not issuing banks will have payment data :) (I know this goes against what some words in blogs on the internet say, but feel free to read the EMV tokenization spec yourself, and you'll see it's true. Tokenization != only issuing bank sees payment data. Maybe some "ecosystems" try to guarantee it, but it's certainly not required)
    - simoncion 12y ago
      Google Wallet may support per-transaction proxy card randomization. Does it actually do this? Can you link to a spec or documentation that supports your claims? Thanks!
      - DannyBee 12y ago
        AFAIK, it does. But that's just what i'm told, if you have data that says it doesn't, ...
        simoncion 12y ago
        Who told you? I work in nether finance, nor on the Wallet team, so I don't have information about the details of Wallet's workings. Regardless, it's proper for the claimant to provide data to support their claim. :)
  - Oletros 12y ago
    From the Wallet FAQ [1]: > “Wallet also uses dynamically rotating credentials that change with each transaction and are usable for a single payment only.” Does it means that tokenizes something? [1] https://www.google.es/wallet/faq.html#tab=faq-security https://www.google.es/wallet/faq.html#tab=faq-security
    - jusben1369 12y ago
      No. As I understand it, and it can change over time, Google stores your actual card. Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. It has a finite amount of value to reduce the exposure to fraud (the value is very close the amount you are about to purchase something for). That one time use card then travels the networks very much in the same way that that one time gift card for $50 does. Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant accounts yet) so they recognize the ApplePay specific network token and allow it to act like a normal credit card. The token is reusable unlike the one time use cards. Lose your phone (or have it stolen) and just that token is revoked - not your card and all your other automated billing etc with it.
      - Oletros 12y ago
        > Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. This is the definition of tokenization > Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant What? > The token is reusable unlike the one time use cards What? I think you have to re read how Apple Pay works and what tokenization really is because i Think you're a little confused
        jusben1369 12y ago
        That you think a one time use card is the definition of a token makes this a non starter in terms of a discussion.
  - tonyhb 12y ago
    I think Google Wallet even supports it from the HTML5 requestAutocomplete() API for web stores. Not sure if it's a unique card per transaction, but it's good to know you have some protection. Check out the HTML demo here: https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive.com/host/0B28BnxIvH5DueUxvWVNsQXd5dU0/ https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive...
deleted 12y ago
[deleted]
Shooti 12y ago
They already do according to the Google Wallet FAQ: "Google Wallet stores your credit and debit cards on secure servers and encrypts your payment information with industry-standard SSL (secure socket layer) technology. Your full credit and debit card information is never shown in the app and won't be shared with the merchant. In addition, access to Google Wallet is protected by password or PIN. We also recommend locking your phone with a passcode for additional security." "Your actual credit card number is not stored. Only the Google Wallet Virtual Card is stored, and Android's native access policies prevent malicious applications from obtaining the data. Even if the data is compromised, Wallet uses dynamically rotating credentials that change with each transaction and are usable for a single payment only. Finally, all transactions are monitored in real-time with Google’s risk and fraud detection systems." https://www.google.com/wallet/faq.html#tab=faq-security https://www.google.com/wallet/faq.html#tab=faq-security Keep in mind "Tokenization" has existed in the NFC industry for years, the only thing which changed last year is that the EMV standards body agreed and released a standardized way to do it in March 2014. Apple Pay is a branded solution over that. So what it really boils down to is whether or not you take Google's word for it that their independent solution is secure. If not, you owe it to yourself to not be using a Google Android phone in the first place.
- higherpurpose 12y ago
  So there are two issues I was talking about: 1) rotation of tokens/virtual card numbers 2) giving the transaction data to merchants From what you copied here it seems that Google is rotating the virtual numbers - however, there's no way of knowing if Google isn't still tracking all of those numbers through your account and linking them back together for data mining. I think there's a high probability Google is doing that. Google only says it's rotating the numbers. And that leads us to #2, which remains completely unanswered. Google says it doesn't give the credit card information to merchants (as in your real credit card number). However it could still give the transaction data.
  - Oletros 12y ago
    Google is the payment processor, of course they track and store the transactions.

quadrature 12y ago

And yet it still doesn't work in Canada which adopted the technology ahead of the US and has a much wider roll out.

derefr 12y ago
AFAIK, Canada's "flash payments" use incompatible physical-layer standards. To make it work, you'd need a phone with two NFC radios in it. Since phones with both GSM and CDMA radios are extremely recent—despite the need being obvious for a very long time—I doubt we'll see hybrid-radio NFC designs any time soon.
- quadrature 12y ago
  Do you have a source for this?, I found a list [1] of handsets that are compatible with Visa paywave which i see around a lot. It suggests that at least some handsets are capable of interfacing with existing NFC terminals. [1] https://technologypartner.visa.com/Download.aspx?id=188 https://technologypartner.visa.com/Download.aspx?id=188
- mynameisvlad 12y ago
  Do you mean Interac Flash? Because that's EMV[1], just like Visa's PayWave, MC's PayPass, etc. They're all interchangeable, and they all use the same standard. There's no two radios needed. Plus, most NFC terminals in Canada were first built for PayWave/PayPass, so it would be stupid for them to try and go in a completely separate direction for debit NFC transactions. [1]: http://www.interac.ca/en/press-releases/mobile-debit-eng http://www.interac.ca/en/press-releases/mobile-debit-eng under "About mobile Interac Flash"
- alanctgardner3 12y ago
  Nope. I had Google Wallet working on my Neuxs S in Canada two years ago, you can use it at any Tim Hortons ;) Canadian banks do support their own mobile wallets (similar to the ISIS model), but only on a few cherry-picked devices, and with a custom SIM. See http://www.rbcroyalbank.com/mobile/wallet/ http://www.rbcroyalbank.com/mobile/wallet/
12y ago

IshKebab 12y ago

I guess the carriers are scared enough of Apple Pay that they're willing to work with Google now.

eli 12y ago
Or perhaps Google is scared enough of the carriers' own effort that it felt forced to buy them off.
MBCook 12y ago
Or maybe they just realized that they were just putting good money after bad (because it wasn't succeeding) and decided to cut their losses and avoid the (small?) risk of alienating customers.

arthurcolle 12y ago

Is this an acquisition?

mikeyouse 12y ago
Google called it a partnership and Softcard said something along the lines of "Google is acquiring Softcard's technology" which leaves me a bit confused but I don't think it's an outright acquisition.
deleted 12y ago
[deleted]
- arthurcolle 12y ago
  Thank you for the link. Softcard was pre-installed on my Moto X 2013, so I wonder what's really going to change.
deleted 12y ago
[deleted]

coleca 12y ago

If Google Wallet was to continue to exist this was inevitable because Softcard (formerly ISIS) had locked up the usage of the secure element inside all the Android phones coming from all the US carriers except Sprint and its MVNOs. And ISIS was having a very hard time getting retailers onboard with its platform despite offering 7 figure incentives and covering their implementation costs for integration with their point of sale systems.

wmf 12y ago
Isn't there an EMV-NFC standard that eliminates the need for POS integration? IIRC CurrentC was the one that isn't using the standard.
- coleca 12y ago
  Yes, there is a standard for payments on the PIN pads. However, the real push for ISIS/Softcard was that they could do more than payments. They wanted to be able to push coupons through the PIN pads to the POS from their app. That was how they were planning to monetize the platform. The fees they would get from banks to hook into the system were minimal. Even if the PIN pads could support coupons over NFC, most large scale POS software could not. I had experience last year trying to integrate ISIS/Softcard into a large retailer that was running IBM/Toshiba ACE POS software and ISIS/Softcard support wasn't even IBM/Toshiba's radar. Many large retailers run ACE (Kroger, Safeway, Costco, Macys, etc.).
  - wmf 12y ago
    Ah, my mistake. I was thinking of the credit card system as a "dumb pipe" for money. Why would anyone want to build that?
jsight 12y ago
Google Wallet works (and has worked) just fine with NFC payments on my Verizon phone. This is much less of an issue with modern phones due to changes in the way the secure element works. (EDIT: To be clear, I am talking about this: https://developer.android.com/about/versions/kitkat.html#44-hce https://developer.android.com/about/versions/kitkat.html#44-...)

freehunter 12y ago

I'm getting tired of "hey guys check out this really cool, half-baked, and for absolutely no reason, single-platform technology". Yeah iMessage/Facetime and Google Hangouts is really cool but we're still using SMS and voice calling because half of my friends have Android and half have iPhones. Worse yet, we're all using Facebook Messenger or Snapchat because at least there is some consistency between vendors there, unlike with SMS. Handoff/Continuity is great, but if I can't hand off calls from my iPhone to my Windows desktop or apps to my Linux laptop, who cares? I'm never going to have a chance to use that. Oh look at this cool site that uses Chrome's new features. What a shame I use Firefox. And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic. We forced Microsoft to stop locking out their competitors with proprietary versions of things that should be standards, and we did that more than 15 years ago. What progress have we made since then?

JeremyBanks 12y ago
> And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic. Are you personally using two or three phone platforms with such frequency that this is relevant?
- edgarvaldes 12y ago
  Maybe he doesnt want to lock himself with a brand, mid-term.
- freehunter 12y ago
  I bought a Lumia 920 when it came out in October 2012. I used that as a daily driver until around March of 2013, when I bought a Nexus 4. I wasn't terribly satisfied with it when it came to the camera and GPS navigation, so when I went on trips or to events I would switch the SIM back to the Lumia 920. I got tired of this and bought an iPhone 5c in December 2013. My wife broke her iPhone 4 in June of 2014, so I gave her my 5c and switched back to the Lumia 920 until my work gave me an iPhone 5s in October of 2014. Luckily I'm using a carrier that doesn't care how often you want to switch your phone, doesn't lock their phones, and doesn't make you talk to them to activate a new phone. I think everyone should have that freedom. So in the last ~2 years, I've used three phone platforms with some regularity. I also have a Windows desktop and I use a RHEL-based laptop for work. I like to use the best that I can get for the task I'm using it for, no matter what platform or ecosystem. Because of that, I make it a habit to not put things in my workflow that are not reasonably cross-platform, unless there is literally no better option.