Analysing Apple Pay Transactions | Hacker News Reader

Analysing Apple Pay Transactions

blog.elcomsoft.com

10 pointsGordonS9 comments

So, apparently Apple doesn’t collect or back up transaction data to iCloud, and it can only be obtained by imaging the actual device that made the payment.

In this day and age where every shred of PI is routinely stored forever and sold to anyone who wants it, I find this quite amazing!

I recently wiped my Android phone and put lineage on with microg, to tide me over until I can replace with an iPhone. I'm simply done with the data collection on Android. Maybe I was naive, but I thought a user could switch most of it off, but you can't.

I really admire how Apple are pushing their secure enclave. AFAIK Google Pay uses temporary tokens pulled from their servers, whilst Apple replies soley on the ondevice SE for Apple Pay.

I am a huge Apple Pay user and had always assumed it was all stored in the cloud. Had no idea about this and makes it even more cool that they don't keep any PI info.

It's consistent with Apple's claims, and is indeed impressive. But then, Apple makes its money primarily through selling stuff, not through monetizing users' data.

> Tap-to-pay is easy enough, but today’s users expect evolving, personalized experiences that sync as they shop. They willingly share personal information to foster enhanced experiences with services like Netflix, Amazon,

I'm not sure it's entirely willing. More that they have no idea how much data is being collected, and convenience outways finding out about the other implications.

Apple may not retain the data, but the underlying card issuer does.

I trust Apple more than Visa or HSBC to keep my data from prying eyes.

If someone could make apple pay be backed by a local bitcoin wallet, then I could feel far more secure nobody is going through my payment history.

Card issuer always has to get some info if you want to be able to be reverse transactions and issue chargebacks.

There is nothing in a blockchain that can resolve this issue.

Wouldn't this mean everybody could then go through your public payment history?

Presumably such an implementation would use different wallet addresses for every payment so they couldn't be linked together.

Reply on news.ycombinator.com