Hacker News Reader

A signature doesn't hide information, it only tells you that it hasn't been modified. All the information that's being signed is by definition already in the payload given to the merchant.

If it's actually encrypting information (not just signing it), then that's another thing entirely, but signatures don't hide data.

View on HN

Good point about a signature not hiding the data. I got my terminology mixed up. I thought it was encoding it in a way so that only the payment processor could see.

But that's not necessarily the case either, as somebody else brought up the fact that identifiers ARE in fact passed to the merchant.

Reply on news.ycombinator.com