6 ms·

What I want to know is when will Google Wallet introduce Apple Pay-like tokenization so merchants can't track your purchases? Google is actually kind of doing

What I want to know is when will Google Wallet introduce Apple Pay-like tokenization so merchants can't track your purchases? Google is actually kind of doing the opposite right now. It's tracking your purchases through a virtual credit card number and then giving all that data to merchants. Sure you can reset that number, but since it's not automatic like Apple's tokens, that means it will be used about as much as resetting the advertising IDs on Android phones - so almost never. It also doesn't help that Google is pro-actively giving that data to merchants (and now to carriers, too, I assume).

myko 12y ago
It already does.
- bentruyman 12y ago
  Google Wallet does not utilize any form of tokenization to my knowledge. The best you'll get is a proxy card. But that proxy card is used for all merchants.
  - DannyBee 12y ago
    Can you explain what the difference you think there is between a proxy card and tokenization, if the proxy card was randomly generated each transaction (which wallet supports) (Hint: There is no difference, both would be valid methods of tokenization by the spec :P)
    - thrownaway2424 12y ago
      But the proxy card isn't randomly generated. It's always the same.
    - natrius 12y ago
      Google gets your payment data. Apple doesn't.
      - DannyBee 12y ago
        Google is the payment processor. The tokenization spec completely supports and expects payment processors who are not issuing banks will have payment data :) (I know this goes against what some words in blogs on the internet say, but feel free to read the EMV tokenization spec yourself, and you'll see it's true. Tokenization != only issuing bank sees payment data. Maybe some "ecosystems" try to guarantee it, but it's certainly not required)
    - simoncion 12y ago
      Google Wallet may support per-transaction proxy card randomization. Does it actually do this? Can you link to a spec or documentation that supports your claims? Thanks!
      - DannyBee 12y ago
        AFAIK, it does. But that's just what i'm told, if you have data that says it doesn't, ...
        simoncion 12y ago
        Who told you? I work in nether finance, nor on the Wallet team, so I don't have information about the details of Wallet's workings. Regardless, it's proper for the claimant to provide data to support their claim. :)
  - Oletros 12y ago
    From the Wallet FAQ [1]: > “Wallet also uses dynamically rotating credentials that change with each transaction and are usable for a single payment only.” Does it means that tokenizes something? [1] https://www.google.es/wallet/faq.html#tab=faq-security https://www.google.es/wallet/faq.html#tab=faq-security
    - jusben1369 12y ago
      No. As I understand it, and it can change over time, Google stores your actual card. Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. It has a finite amount of value to reduce the exposure to fraud (the value is very close the amount you are about to purchase something for). That one time use card then travels the networks very much in the same way that that one time gift card for $50 does. Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant accounts yet) so they recognize the ApplePay specific network token and allow it to act like a normal credit card. The token is reusable unlike the one time use cards. Lose your phone (or have it stolen) and just that token is revoked - not your card and all your other automated billing etc with it.
      - Oletros 12y ago
        > Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. This is the definition of tokenization > Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant What? > The token is reusable unlike the one time use cards What? I think you have to re read how Apple Pay works and what tokenization really is because i Think you're a little confused
        jusben1369 12y ago
        That you think a one time use card is the definition of a token makes this a non starter in terms of a discussion.
  - tonyhb 12y ago
    I think Google Wallet even supports it from the HTML5 requestAutocomplete() API for web stores. Not sure if it's a unique card per transaction, but it's good to know you have some protection. Check out the HTML demo here: https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive.com/host/0B28BnxIvH5DueUxvWVNsQXd5dU0/ https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive...
deleted 12y ago
[deleted]
Shooti 12y ago
They already do according to the Google Wallet FAQ: "Google Wallet stores your credit and debit cards on secure servers and encrypts your payment information with industry-standard SSL (secure socket layer) technology. Your full credit and debit card information is never shown in the app and won't be shared with the merchant. In addition, access to Google Wallet is protected by password or PIN. We also recommend locking your phone with a passcode for additional security." "Your actual credit card number is not stored. Only the Google Wallet Virtual Card is stored, and Android's native access policies prevent malicious applications from obtaining the data. Even if the data is compromised, Wallet uses dynamically rotating credentials that change with each transaction and are usable for a single payment only. Finally, all transactions are monitored in real-time with Google’s risk and fraud detection systems." https://www.google.com/wallet/faq.html#tab=faq-security https://www.google.com/wallet/faq.html#tab=faq-security Keep in mind "Tokenization" has existed in the NFC industry for years, the only thing which changed last year is that the EMV standards body agreed and released a standardized way to do it in March 2014. Apple Pay is a branded solution over that. So what it really boils down to is whether or not you take Google's word for it that their independent solution is secure. If not, you owe it to yourself to not be using a Google Android phone in the first place.
- higherpurpose 12y ago
  So there are two issues I was talking about: 1) rotation of tokens/virtual card numbers 2) giving the transaction data to merchants From what you copied here it seems that Google is rotating the virtual numbers - however, there's no way of knowing if Google isn't still tracking all of those numbers through your account and linking them back together for data mining. I think there's a high probability Google is doing that. Google only says it's rotating the numbers. And that leads us to #2, which remains completely unanswered. Google says it doesn't give the credit card information to merchants (as in your real credit card number). However it could still give the transaction data.
  - Oletros 12y ago
    Google is the payment processor, of course they track and store the transactions.

myko 12y ago

It already does.

bentruyman 12y ago
Google Wallet does not utilize any form of tokenization to my knowledge. The best you'll get is a proxy card. But that proxy card is used for all merchants.
- DannyBee 12y ago
  Can you explain what the difference you think there is between a proxy card and tokenization, if the proxy card was randomly generated each transaction (which wallet supports) (Hint: There is no difference, both would be valid methods of tokenization by the spec :P)
  - thrownaway2424 12y ago
    But the proxy card isn't randomly generated. It's always the same.
  - natrius 12y ago
    Google gets your payment data. Apple doesn't.
    - DannyBee 12y ago
      Google is the payment processor. The tokenization spec completely supports and expects payment processors who are not issuing banks will have payment data :) (I know this goes against what some words in blogs on the internet say, but feel free to read the EMV tokenization spec yourself, and you'll see it's true. Tokenization != only issuing bank sees payment data. Maybe some "ecosystems" try to guarantee it, but it's certainly not required)
  - simoncion 12y ago
    Google Wallet may support per-transaction proxy card randomization. Does it actually do this? Can you link to a spec or documentation that supports your claims? Thanks!
    - DannyBee 12y ago
      AFAIK, it does. But that's just what i'm told, if you have data that says it doesn't, ...
      - simoncion 12y ago
        Who told you? I work in nether finance, nor on the Wallet team, so I don't have information about the details of Wallet's workings. Regardless, it's proper for the claimant to provide data to support their claim. :)
- Oletros 12y ago
  From the Wallet FAQ [1]: > “Wallet also uses dynamically rotating credentials that change with each transaction and are usable for a single payment only.” Does it means that tokenizes something? [1] https://www.google.es/wallet/faq.html#tab=faq-security https://www.google.es/wallet/faq.html#tab=faq-security
  - jusben1369 12y ago
    No. As I understand it, and it can change over time, Google stores your actual card. Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. It has a finite amount of value to reduce the exposure to fraud (the value is very close the amount you are about to purchase something for). That one time use card then travels the networks very much in the same way that that one time gift card for $50 does. Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant accounts yet) so they recognize the ApplePay specific network token and allow it to act like a normal credit card. The token is reusable unlike the one time use cards. Lose your phone (or have it stolen) and just that token is revoked - not your card and all your other automated billing etc with it.
    - Oletros 12y ago
      > Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. This is the definition of tokenization > Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant What? > The token is reusable unlike the one time use cards What? I think you have to re read how Apple Pay works and what tokenization really is because i Think you're a little confused
      - jusben1369 12y ago
        That you think a one time use card is the definition of a token makes this a non starter in terms of a discussion.
- tonyhb 12y ago
  I think Google Wallet even supports it from the HTML5 requestAutocomplete() API for web stores. Not sure if it's a unique card per transaction, but it's good to know you have some protection. Check out the HTML demo here: https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive.com/host/0B28BnxIvH5DueUxvWVNsQXd5dU0/ https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive...

deleted 12y ago

[deleted]

Shooti 12y ago

They already do according to the Google Wallet FAQ: "Google Wallet stores your credit and debit cards on secure servers and encrypts your payment information with industry-standard SSL (secure socket layer) technology. Your full credit and debit card information is never shown in the app and won't be shared with the merchant. In addition, access to Google Wallet is protected by password or PIN. We also recommend locking your phone with a passcode for additional security." "Your actual credit card number is not stored. Only the Google Wallet Virtual Card is stored, and Android's native access policies prevent malicious applications from obtaining the data. Even if the data is compromised, Wallet uses dynamically rotating credentials that change with each transaction and are usable for a single payment only. Finally, all transactions are monitored in real-time with Google’s risk and fraud detection systems." https://www.google.com/wallet/faq.html#tab=faq-security https://www.google.com/wallet/faq.html#tab=faq-security Keep in mind "Tokenization" has existed in the NFC industry for years, the only thing which changed last year is that the EMV standards body agreed and released a standardized way to do it in March 2014. Apple Pay is a branded solution over that. So what it really boils down to is whether or not you take Google's word for it that their independent solution is secure. If not, you owe it to yourself to not be using a Google Android phone in the first place.

higherpurpose 12y ago
So there are two issues I was talking about: 1) rotation of tokens/virtual card numbers 2) giving the transaction data to merchants From what you copied here it seems that Google is rotating the virtual numbers - however, there's no way of knowing if Google isn't still tracking all of those numbers through your account and linking them back together for data mining. I think there's a high probability Google is doing that. Google only says it's rotating the numbers. And that leads us to #2, which remains completely unanswered. Google says it doesn't give the credit card information to merchants (as in your real credit card number). However it could still give the transaction data.
- Oletros 12y ago
  Google is the payment processor, of course they track and store the transactions.