Comment by jasode
6 hours ago
> is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all.
Apple doesn't see individual transactions when Apple Pay is used at retail stores' tap-to-pay terminals. The secret card payment token is sent from the phone to the credit-card's issuing bank and bypasses Apple servers. In this way, using Apple Pay is more secure and private than plastic cards because the real card number details remains hidden from the merchant.
The iPhone does contact Apple servers to add a new card to the digital wallet. Apple servers then contacts the issuing bank to get the secret token the bank generates and then puts it in the digital wallet. Conceivably, the "add a new card to digital wallet" could also have been done without Apple in the middle but it would require a much more convoluted, less secure, and more user-hostile workflow to do it. (e.g. the end user would have to know what bank endpoint to contact, manually enter the long and cryptic digits of the secret token, or maybe scan a QR code on a computer screen that's vulnerable to interception and phishing.)
Importantly, this provides a degree of protection from compromised PoS terminals. Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges, whereas back when I was still tapping, inserting, or swiping my card I’d need to call and get a card or two replaced almost every year.
> Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges
BIN attacks [1] are still a thing. Your banks are probably just better at blocking them.
[1] https://stripe.com/en-sg/resources/more/what-are-bin-attacks...
Inserting and tapping is just as safe.
Swiping is where the risk is.
I’m not super familiar with the implementation details but wouldn’t inserting not be as safe since there’s a physical connection?
With tapping I could see how that is more secure but if they’re still providing the card details versus the secure token or something well… maybe it’s not?
6 replies →
Or (common in the US) handing your card to a restaurant waiter who walks off with it to do the charge
All EMV transactions (including Apple Pay in a tap to pay scenario) don’t give the retailer the full card number.
don’t be silly, apple displays me exact amount on the screen, in plain fucking text, after each transaction - that’s crazy you wrote this
This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
The wallet app has a way to get the information, but it’s not from the tap itself. The tap interaction is not able to provide this information back to the phone (because the transaction auth happens long after the tap interaction completes).
Taps are designed to work with fully offline devices (which is why you can tap a plastic card, it is powered by the card terminal for the duration of the tap only, and requires no online interaction)
> This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.
except of course it fucking doesn’t, I don’t have Chase or Amex apps on my phone… and yet my transactions are on my phone and watch and in a list inside my “wallet” and probably in the phone settings somewhere as well :)
1 reply →
Man, its amazing how confident you are about this, considering I know individual people who independently work at Visa, Mastercard, AND Apple, who have worked on mobile payments who independently confirm that none of them know any personal info and that its all pass-through.
So, are you sure you know what you are talking about?
This kind of appeal to authority [believe me because I say so!] doesn't really add much information, does it?
The report, above, is that previous transactions are visible within Apple's payment app. Apple agrees[1]. I'm willing to accept that this observation is based on reality and that it is reported in good faith.
Meanwhile, the suggestion is that Apple has no knowledge of transaction history.
Is there a way in which these two seemingly-conflicting concepts can be constructively combined into an understandable whole?
[1]: https://support.apple.com/en-us/104954
(For my part, I've never used Apple Pay and it's possible that I never will. I do not have a dog in this race.)
3 replies →