Hacker News Reader

Comment by abalone | Hacker News Reader

Apple Pay does offer enhanced privacy by not transmitting your name along with your card number, but it doesn't randomize the number with every transaction. In fact you may not want that as it would disrupt email receipt systems and loyalty programs (absent some parallel mechanism).

Apple Pay does something called tokenization, and the goal is more fraud protection than privacy. It generates one new number at card enrollment and uses that exclusively. By using a unique account number which can only be issued by Apple Pay devices, it means it doesn't matter if someone hacks the merchant and steals your number. They can't use it without the associated Apple Pay generated cryptogram, secured by your PIN / fingerprint.

Honestly the enhanced security of Apple Pay is underhyped. It's really great.

View on HN

I think I just inched toward using Apple Pay. I've been very skeptical until now.

You should read the iOS security guide portion that explains Apple Pay, the security benefits and amount of thought that has gone into the system are pretty amazing.

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Sounds to me like they basically transferred chip-and-pin online.

Maybe it is magical in the American sense, but i can't say i get the big whoop from the European side of the Atlantic...

Apple Pay is a generation ahead of chip and pin. It obviates the need to enter a PIN which is more convenient and invulnerable to attacks on PIN terminals, which have defeated chip and pin in the past.[1]

[1] https://en.m.wikipedia.org/wiki/EMV

What about contactless cards? I personally find contactless cards, common in the UK, much more convenient than having to faff about with my phone, which may be out of battery.

Phone based payments seem to have really failed to gain momentum here in Australia too; we've had contactless cards for a few years now and they've become the norm, using a phone seems to have marginal benefit over that.

I find the opposite. My phone is just in my pocket, I pull it out tap the fingerprint scanner and I'm ready. My card is tucked away in my wallet and takes a bit longer.

Admittedly being out of battery is a hard problem, but I chose my phone partly because it has decent battery life.

I am in Australia and we have had contactless payments for years. Apple Pay with an iPhone was more trouble than using a card. On the other hand since I got my Apple Watch I haven't carried credit cards with me. It started out as a 1 month experiment to see if I could survive and it has never been a problem.

My understanding is that contactless cards have limit of £30 per transaction in the UK. Apple Pay (perhaps it's the same with Android Pay?) has a significantly higher limit.

25 € in Austria. But for higher amounts you can still just hover the card above the terminal and then enter your PIN instead of sticking the card in (at least at some stores).

Interesting. In most stores in Holland my experience is that over a certain amount, or after a certain number of transactions, I get a 'pin required' message. I then have to wait for the cashier to do some voodoo, only then insert my card (before that causes issues), and enter my PIN. This is the case pretty much everywhere.

I love contactless payment, and this occasional complication doesn't cause enough trouble, but it's still really annoying because I'd expect exactly what you describe to be the case.

Two reasons Apple Pay is better than contactless cards. One is security. For purchases over a certain amount, cards make you enter a PIN. This is inconvenient and also susceptible to attack. Apple Pay secures every single transaction with your PIN, made convenient by Touch ID.

Two, if "faffing about" is your concern (thank you for that expression by the way, i'm going to start using it), pulling out a card is not really much different from pulling out a phone. But the Apple Watch supports Apple Pay, and that way you don't have to pull out anything. It's really convenient.

If you're wondering how it works securely with the watch, it's pretty smart. You unlock the watch with a PIN when you put it on. It senses when you've removed it from your wrist, so it just stays unlocked until that point. Therefore all Apple Pay purchases are PIN authorized without having to prompt you for it or a fingerprint. All you have to do is wave your wrist by the terminal and confirm.

Also Apple Pay is always online authorized while contactless cards under a certain amount are often not authorized as a speed hack.

Some merchants I've noticed no matter how much you spend still require a signature, which I don't really understand. Others such as Kroger require a signature if it's over $50 but they don't take Apple Pay.

Reply on news.ycombinator.com