Hacker News Reader

Comment by needusername | Hacker News Reader

There is a lot of deliberately confusing marketing. "Tokenization" simply means that a new PAN is generated once per device. This is a normal PAN registered with the payment scheme and your issuer. It has to be a normal PAN, otherwise it would never pass through all the exiting payment infrastructure.

What is generated per transaction is the EMV unpredictable number, but this is part of the EMV protocol and done for any EMV transaction. Think of this like the dynamically generated symmetric key for an SSL session.

View on HN

Why do you say it's deliberately confusing?

Because we have a whole thread with dozens of comments full with people that don't understand what this means but seem to think it is a selling point for Apple.

> What is generated per transaction is the EMV unpredictable number, but this is part of the EMV protocol and done for any EMV transaction.

What about when magstripe emulation is in use, does Apple Pay support that in the US?

Nope, Apple Pay is EMV only.

Only Samsung Pay does magstripe emulation.

Are you sure? Only Samsung (and LG apparently?) have the hardware feature where it tricks a magnetic stripe reader into thinking a card was swiped. However, the kind of magstripe emulation I meant is a feature of EMV where it can provide the same information as a magnetic stripe would, but over NFC, for compatibility with legacy (US) payment systems. Does Apple not support this latter system either? (It's apparently not supported for Apple Card, but Google isn't helping me for Apple Pay.)

EMV is the antithesis of magstripe and the two have absolutely nothing to do with each other. Contactless EMV is NFC.

Unfortunately the United States exists, so there has been a need for magstripe emulation over NFC. I don't know exactly how it works — I think it's some kind of hack on top of EMV — but it does exist.

EMV transactions still use track data format from magstripe world to ensure backward compatibility.

You claim it's "Deliberately confusing"...

Which bit is confusing (or remotely deceptive)?

> When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers, and when you pay, your card numbers are never shared by Apple with merchants.

Are you claiming this is untrue? Or deceptive?

What's actually happening, if I understand it correctly, is that when you setup Apple Pay you essentially get a _second_ card issued to you for that account that otherwise works just like a normal card but is only used by Apple Pay. It's still your card, still stored on the device, and still shared with merchants. If it wasn't you couldn't actually spend money with it.

Hopefully your bank has fraud controls on it to prevent it from being used outside of the way Apple Pay does (which requires your phone or a physical card so prevents theft) but that's not required and without it there is nothing stopping the card from being used like any other.

Reply on news.ycombinator.com