Hacker News Reader

Comment by syvolt | Hacker News Reader

Or Apple Pay can just be like Google Wallet is on Android? The alternative is not multiple apps.

There is already apple wallet where i can put any of my banking cards…

Not "any". The bank themselves need to partner with Apple Pay and presumably pay Apple the percentage cut from the article.

if apple wallet works on android and I have a choice, that's competititon

if apple wallet requires apple phone, and google wallet require android phone, that not competition.

competition is good. no competition should be regulated out of existence.

Another alternative (in the US, at least) is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all. What an unforced error, to shovel more of your data at them needlessly.

That is much better, but you're still paying visa/mastercard some percentage fee for a service which should be provided by e.g. the central bank.

Yeah. But this is the US. This is all we’ve got. Having the central bank do it would be communism, and that’s bad. I learned about it from Saturday morning cartoons.

Ironically it's the central bank (and associated regulations) that cause these intermediaries to exist to begin with.

A protocol to support decentralized payments is a hobby project for an individual. You give each institution an identifier (e.g. their domain name) and each institution gives each customer an account number. If you're account 123 at Chase then you sign in as #123@chase.com, tell Chase you want to send $5 to #456@bankofamerica.com, they send the money and Bank of America tells their customer they have a new deposit. If you want to collect money from someone, you tell your bank to send their bank a payment request and they can either approve it manually (e.g. so you can deliver the goods for a one-time purchase) or configure some rules for which accounts get approved automatically up to some threshold amount (e.g. for recurring payments). Also no reason for banks in different countries not to all support the same protocol.

That doesn't require a central bank or any centralized third party payments intermediary. All it requires is for banks to know how to send money to other banks, which they obviously already do and the specific implementation of that isn't even relevant to the customer-facing payments protocol. So how does this not exist? It can't be that no one wants it, so it's got to be that someone (e.g. Visa/MasterCard) doesn't want it.

The banks all got together and created Zelle, so it exists. No Visa/Mastercard conspiracy needed.

Zelle is an app rather than a protocol, which is why e.g. PoS terminals and web checkouts don't support it.

Zelle, from my understanding, is a “protocol” – many banks support it in their own apps. (Scare quotes because I’m not entirely sure it’s a proper well-defined protocol.)

And there’s nothing preventing PoS from supporting individual wallet apps – see e.g. WeChat Pay / Alipay in China. (Alipay+ is also a “protocol”, i.e. other banks and wallets support it.)

What I mean by protocol is that there is an RFC or equivalent and anyone who implements the spec and has a bank account can then talk to their bank using the standardized protocol. If that exists for Zelle then where's the spec?

I’ve searched for ‘zelle spec’ and came across this line:

> Zelle® is available in over 2,400 banking and credit union apps.

so I’m pretty sure there is a spec because there is no way in hell this many banks are using ad-hoc protocols to talk to each other and/or a centralized system. But yeah, I don’t see anything published.

Chances are it’s something ISO 20022-ish. (Either that or an Excel spreadsheet.) Speaking of which...

> and has a bank account can then talk to their bank using the standardized protocol

...if you’re a big enough business, you probably can also speak ISO 20022 to your bank. If you want it on your personal account however, well, that makes two of us, but from practical standpoint what I care more about is that I can punch in an account number and send money near instantly, which Zelle seems to provide in the US (but I have to make do with whatever Wise provides, probably regular ACH judging by speeds).

https://api.payments.jackhenry.com/docs/zelle/overview/ Is a white label api that you, as a bank, can implement/hit. Just like your local small business vendor can choose to also take Venmo and CashApp, they can also choose to take Zelle. I've bought a burrito with Zelle before.

That seems to be the protocol that banks use to talk to other banks. The missing piece is the protocol for merchants to use to talk to their own bank (regardless of which bank it is), so that support can be added into generic point of sale terminals or web shopping carts etc.

Having the merchant manually process every payment using the bank-specific app on their personal phone isn't it.

> so that support can be added into generic point of sale terminals or web shopping carts etc

We don’t have a single protocol for acquiring (online) card payments either, and this hasn’t been an issue. Everything just uses plugins or custom integrations.

Not sure about in-person payments. From my experience, banks program their own firmware into the terminal, but it may support some standardized API over USB / Serial. Even then, any given bank can implement some subset of features, and supports only a bunch of models (so if you decide to switch banks and your terminal isn’t “blessed”, you’ll have to buy a new one; thankfully, they’re fairly cheap used).

It’d be nice to have a unified protocol for all payment types IMO, but I’m not sure that’s realistic. Some Chinese payment processors have something like that, with a couple Alipay gateways emulating one protocol established by another gateway, so you can just swap out the API endpoint in case you want to switch. But even that’s just for the simplest case (you have to redirect the user to the processor’s page).

Banks in the Netherlands used to have their own system for 30 years. It was free. It worked.

But it was too much work and didn't make the banks money so now we are also left to the American Visa parasite.

> is tapping a piece of plastic instead of your phone and not inviting any of the tech giants into your transactions at all.

Apple doesn't see individual transactions when Apple Pay is used at retail stores' tap-to-pay terminals. The secret card payment token is sent from the phone to the credit-card's issuing bank and bypasses Apple servers. In this way, using Apple Pay is more secure and private than plastic cards because the real card number details remains hidden from the merchant.

The iPhone does contact Apple servers to add a new card to the digital wallet. Apple servers then contacts the issuing bank to get the secret token the bank generates and then puts it in the digital wallet. Conceivably, the "add a new card to digital wallet" could also have been done without Apple in the middle but it would require a much more convoluted, less secure, and more user-hostile workflow to do it. (e.g. the end user would have to know what bank endpoint to contact, manually enter the long and cryptic digits of the secret token, or maybe scan a QR code on a computer screen that's vulnerable to interception and phishing.)

don’t be silly, apple displays me exact amount on the screen, in plain fucking text, after each transaction - that’s crazy you wrote this

Man, its amazing how confident you are about this, considering I know individual people who independently work at Visa, Mastercard, AND Apple, who have worked on mobile payments who independently confirm that none of them know any personal info and that its all pass-through.

So, are you sure you know what you are talking about?

This kind of appeal to authority [believe me because I say so!] doesn't really add much information, does it?

The report, above, is that previous transactions are visible within Apple's payment app. Apple agrees[1]. I'm willing to accept that this observation is based on reality and that it is reported in good faith.

Meanwhile, the suggestion is that Apple has no knowledge of transaction history.

Is there a way in which these two seemingly-conflicting concepts can be constructively combined into an understandable whole?

[1]: https://support.apple.com/en-us/104954

(For my part, I've never used Apple Pay and it's possible that I never will. I do not have a dog in this race.)

This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?

Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.

> This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?

It's kind of unique. It involves finances, and reporting transactions, and it involves their app with their branding that runs on hardware that they unilaterally control. They apparently even take cut from the middle of each of these transaction.

If Apple does all of this with zero knowledge, then I am willing to accept accept that...

> Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.

...but I'll only accept it if the functional operation can be explained.

This kind of non-explanatory browbeating doesn't further my understanding of anything at all. I have never endeavored to undertake a faith-based approach to understanding technology, and I'm certainly not going to begin doing so today.

people will people :-)

This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.

The wallet app has a way to get the information, but it’s not from the tap itself. The tap interaction is not able to provide this information back to the phone (because the transaction auth happens long after the tap interaction completes).

Taps are designed to work with fully offline devices (which is why you can tap a plastic card, it is powered by the card terminal for the duration of the tap only, and requires no online interaction)

> This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.

except of course it fucking doesn’t, I don’t have Chase or Amex apps on my phone… and yet my transactions are on my phone and watch and in a list inside my “wallet” and probably in the phone settings somewhere as well :)

Importantly, this provides a degree of protection from compromised PoS terminals. Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges, whereas back when I was still tapping, inserting, or swiping my card I’d need to call and get a card or two replaced almost every year.

Inserting and tapping is just as safe.

Swiping is where the risk is.

Or (common in the US) handing your card to a restaurant waiter who walks off with it to do the charge

I’m not super familiar with the implementation details but wouldn’t inserting not be as safe since there’s a physical connection?

With tapping I could see how that is more secure but if they’re still providing the card details versus the secure token or something well… maybe it’s not?

Inserting and tapping is mostly the same process, apart from the physical layer of the protocol (NFC vs interfacing the chip directly).

Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.

> Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.

At least around where I am (Ohio, USA), at gas pumps and ATMs: Inserting the card for contact EMV typically means inserting the whole card.

In doing so, entire card is pushed all the way into the same slot that is also used for reading the magstripe, and to the same depth that is used for magstripe transactions.

This quality leaves the door open for magstripe skimming.

(It may be a stupid way of building things, but things exist in the real world that are built this way anyhow. Whether the information on the mag stripe still has any utility for a would-be thief in 2026 is a different matter.)

The credit cards, I believe, have pledged to eliminate magnetic stripes. Although given how long it takes us to do anything for all I know that will be by 2060. They are also planning to extend credit cards past 16 digits, which may also require the magstripe to go away.

> at gas pumps and ATMs: Inserting the card for contact EMV typically means inserting the whole card.

Fairly standard for ATMs, yeah. I’ve always wondered why they do it like that.

And I think I’ve seen ticket machines like this in Finland – not a typical ATM-like receptacle, but you do insert the card all the way in and it locks it down. (I guess Ohio gas pumps also have something like that?)

So yeah, those things exist, but the “typical” terminal style where you only insert the card halfway is fairly safe at least. :-)

Physical connection doesn't matter. This isn't a Hollywood movie, there isn't some mega-virus which magically seizes controls of trivial objects by passing through a connector.

All three modern technologies ("original" Chip & PIN, wireless or a phone) are basically the EMV protocol, which is a fairly crap protocol which wasn't reviewed by experts before deployment - but is at least designed by people who have heard about cryptographic security and wanted to do that.

The original credit cards are just numbers written on a card. Clerk sees your number, memorizes it, now they can make arbitrary transactions indistinguishable from yours. Basically no security.

Magnetic stripe cards look more sophisticated but the stripe is basically the same numbers again but in a way humans cannot read. "Cloning" is just a matter of a machine copying those numbers onto another card's magnetic stripe. There's no real security improvement, though it is more convenient for the bank...

EMV ("Chip and PIN") is rather more complicated and could in principle be entirely secure - they could make it implausibly expensive to "clone" an EMV card, and require that you actually know your PIN for every transaction, so then crooks would need to learn your PIN and have the actual card, and that's a high bar.

In practice we didn't do much of that because it would be inconvenient, and so there are technical deficiencies, but realistically that XKCD "wrench" thing applies. Difficult technological attacks rarely happen, crooks threaten to stab you if you don't co-operate or they break into your home and steal your stuff, they do not come up with breakthrough cryptanalytic attacks on protocols. Mostly.

There are two forms of wireless. The first was “magstripe emulation” and it’s exactly what you think it is. The card would hand over the exact data on the magstripe.

It’s also exactly as secure as you think: it’s not.

That hasn’t been used for a long time, and I don’t even think people accept it anymore. May not have for years. At least for credit cards. It’s quite possible that’s still how door access cards or maybe gym membership cards work. I don’t really know.

Everything now and for many, many many years, has been EMV over NFC. And you’re right on that one it is essentially identical to sticking your card in the EMV reader.

The exact technologies used for "access cards" have varied over the years, but last time I checked most of them still aren't doing anything even vaguely secure. The card says "I'm card 1234-5678" and the access system checks that is on the list, welcome in. Like magnetic stripes it isn't obvious to the human operator, but just like magnetic stripes you can just clone it by listening and reciting the same, "I'm card 1234-5678".

Now to be fair, you'd often find these systems are so clumsily installed that you don't need to clone a card anyway, the out-of-hours access has an "emergency" generic key you can buy from a hardware store, the controller was placed on the wrong side of the door - that sort of thing. But even a well-installed system is typically vulnerable to a competent intruder.

> Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges

BIN attacks [1] are still a thing. Your banks are probably just better at blocking them.

[1] https://stripe.com/en-sg/resources/more/what-are-bin-attacks...

All EMV transactions (including Apple Pay in a tap to pay scenario) don’t give the retailer the full card number.

>Apple doesn't see individual transactions when Apple Pay is used at retail stores' tap-to-pay terminals.

when I added my credit card to ApplePay, transactions made with the bare card would show up on my phone even though the phone was not involved: you're saying my phone has access to that transaction and Apple does not?

yea, feels like tech giants do not have access to this already? they know where you are and what you do every second of every day, keeping away from ( while they know I was a target ) what was the amount on my receipt is really giving it to them :)

I have used both but I dont know the difference

How does it work on Google Wallet?

Article says Google wallet works just like Apple Pay, except they don’t charge a 0.15% fee.

Why shouldn’t Apple be able to make money for the service they created?

A service for whom? It has already been paid for by the users when they bought the iPhone.

Users aren’t paying the fee though

Of course they are, passed on as increased prices for everyone, which is exactly the problem. Sure the banks here would like these fees gone, but it also hurts society in general.

That’s true of any cost that any company pays for any service.

And customer are also paying cash handling fees, which in the U.K. at higher than card handling fees.

Companies that prefer or only take cash tend to do it for tax evasion rather than cost purposes.

U.K. fees tend to be about 1-1.5% all in, for cash or card (excluding cost of employee taking cash to bank). Things like pix, net, grocers about 0.5-1%. Nets QR is cheaper than Nets rfid.

The phone holds on to a credit card number and some extra information. What service is happening here? Is Apple doing something meaningful every payment?

The phone doesn't store your card number. Apple brokers a token at setup, secures it on-device, and manages it afterward (suspend, re-issue).

So it doesn't generate a second card number like other things I've used?

But anyway it sounds like the answer to my question is no, Apple is not doing anything meaningful per payment. They play a role in setting up a card and that's it. Is that accurate?

When you add a card, your bank creates a device-specific Device Account Number, encrypts it, and sends it to Apple w/ a key used to generate a unique sec code for each transaction.

And is that information stored on the phone? Do Apple's servers need to be running for me to make a purchase?

Not if you're tapping in a store. Apple's servers re-encrypt the payment data for specific merchants if you buy in an app or on a website. Apple brokers requests for adding a card, or suspending one via Find My, or setting one up again whenever a person changes phones.

Do you mean this part?

> It points to Google's Android, which supports multiple wallets and does not collect a fee from card issuers for contactless payments. It suggests Apple would not be able to continue to charge "substantial fees" if it were forced to support other mobile wallets on Apple devices.

This described supporting multiple wallets, which I don’t care about. I don’t want multiple wallets, I want one wallet.

Android supporting multiple wallets isn’t a feature of Google Pay, it’s a feature of Android. Although the implication in the article is that Google not being able to charge the fee is a side effect of any app being able to act as a “wallet.” Which I’m not 100% sure is true.

Reply on news.ycombinator.com