Google Wallet and Softcard | Hacker News Reader

Google Wallet and Softcard

googlecommerce.blogspot.com

64 pointsmrry49 comments

I'm getting tired of "hey guys check out this really cool, half-baked, and for absolutely no reason, single-platform technology". Yeah iMessage/Facetime and Google Hangouts is really cool but we're still using SMS and voice calling because half of my friends have Android and half have iPhones. Worse yet, we're all using Facebook Messenger or Snapchat because at least there is some consistency between vendors there, unlike with SMS. Handoff/Continuity is great, but if I can't hand off calls from my iPhone to my Windows desktop or apps to my Linux laptop, who cares? I'm never going to have a chance to use that. Oh look at this cool site that uses Chrome's new features. What a shame I use Firefox. And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic.

We forced Microsoft to stop locking out their competitors with proprietary versions of things that should be standards, and we did that more than 15 years ago. What progress have we made since then?

Your particular word choice caused me a chuckle.

> check out

http://en.wikipedia.org/wiki/Google_Checkout

"Google Checkout was discontinued on November 20, 2013."

Apple Pay is "for real" and Google will have to be effective on this front, now. Nonetheless, I can't help engaging in a bit of eye roll, to myself.

> And Google Wallet/Apple Pay is nifty, but I have to enter my card info twice if I switch between phones, and if I'm using a Windows Phone, I'm still using my plastic.

Are you personally using two or three phone platforms with such frequency that this is relevant?

I bought a Lumia 920 when it came out in October 2012. I used that as a daily driver until around March of 2013, when I bought a Nexus 4. I wasn't terribly satisfied with it when it came to the camera and GPS navigation, so when I went on trips or to events I would switch the SIM back to the Lumia 920. I got tired of this and bought an iPhone 5c in December 2013. My wife broke her iPhone 4 in June of 2014, so I gave her my 5c and switched back to the Lumia 920 until my work gave me an iPhone 5s in October of 2014. Luckily I'm using a carrier that doesn't care how often you want to switch your phone, doesn't lock their phones, and doesn't make you talk to them to activate a new phone. I think everyone should have that freedom.

So in the last ~2 years, I've used three phone platforms with some regularity. I also have a Windows desktop and I use a RHEL-based laptop for work. I like to use the best that I can get for the task I'm using it for, no matter what platform or ecosystem. Because of that, I make it a habit to not put things in my workflow that are not reasonably cross-platform, unless there is literally no better option.

Maybe he doesnt want to lock himself with a brand, mid-term.

> if I'm using a Windows Phone, I'm still using my plastic.

SoftCard exists for Windows Phone, a couple of people I know have used it and like it. I wonder if this will continue under the new arrangement (my bet is "highly unlikely").

With Google's track record with Windows Phone, I would agree with your bet. When I was using Windows Phone in the past, Google was in the habit of redirecting maps.google.com to the WAP site. They also never made a YouTube app, so Microsoft made one and Google forced them to take it down. With the exception of iOS, Google isn't known to play well with others.

I guess the carriers are scared enough of Apple Pay that they're willing to work with Google now.

Or maybe they just realized that they were just putting good money after bad (because it wasn't succeeding) and decided to cut their losses and avoid the (small?) risk of alienating customers.

Or perhaps Google is scared enough of the carriers' own effort that it felt forced to buy them off.

What I want to know is when will Google Wallet introduce Apple Pay-like tokenization so merchants can't track your purchases?

Google is actually kind of doing the opposite right now. It's tracking your purchases through a virtual credit card number and then giving all that data to merchants. Sure you can reset that number, but since it's not automatic like Apple's tokens, that means it will be used about as much as resetting the advertising IDs on Android phones - so almost never. It also doesn't help that Google is pro-actively giving that data to merchants (and now to carriers, too, I assume).

They already do according to the Google Wallet FAQ:

"Google Wallet stores your credit and debit cards on secure servers and encrypts your payment information with industry-standard SSL (secure socket layer) technology. Your full credit and debit card information is never shown in the app and won't be shared with the merchant. In addition, access to Google Wallet is protected by password or PIN. We also recommend locking your phone with a passcode for additional security."

"Your actual credit card number is not stored. Only the Google Wallet Virtual Card is stored, and Android's native access policies prevent malicious applications from obtaining the data. Even if the data is compromised, Wallet uses dynamically rotating credentials that change with each transaction and are usable for a single payment only. Finally, all transactions are monitored in real-time with Google’s risk and fraud detection systems."

https://www.google.com/wallet/faq.html#tab=faq-security

Keep in mind "Tokenization" has existed in the NFC industry for years, the only thing which changed last year is that the EMV standards body agreed and released a standardized way to do it in March 2014. Apple Pay is a branded solution over that.

So what it really boils down to is whether or not you take Google's word for it that their independent solution is secure. If not, you owe it to yourself to not be using a Google Android phone in the first place.

So there are two issues I was talking about:

1) rotation of tokens/virtual card numbers

2) giving the transaction data to merchants

From what you copied here it seems that Google is rotating the virtual numbers - however, there's no way of knowing if Google isn't still tracking all of those numbers through your account and linking them back together for data mining. I think there's a high probability Google is doing that. Google only says it's rotating the numbers.

And that leads us to #2, which remains completely unanswered. Google says it doesn't give the credit card information to merchants (as in your real credit card number). However it could still give the transaction data.

Google is the payment processor, of course they track and store the transactions.

It already does.

Google Wallet does not utilize any form of tokenization to my knowledge. The best you'll get is a proxy card. But that proxy card is used for all merchants.

From the Wallet FAQ [1]:

> “Wallet also uses dynamically rotating credentials that change with each transaction and are usable for a single payment only.”

Does it means that tokenizes something?

[1] https://www.google.es/wallet/faq.html#tab=faq-security

No. As I understand it, and it can change over time, Google stores your actual card. Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card. It has a finite amount of value to reduce the exposure to fraud (the value is very close the amount you are about to purchase something for). That one time use card then travels the networks very much in the same way that that one time gift card for $50 does. Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant accounts yet) so they recognize the ApplePay specific network token and allow it to act like a normal credit card. The token is reusable unlike the one time use cards. Lose your phone (or have it stolen) and just that token is revoked - not your card and all your other automated billing etc with it.

> Then, when you're ready to make a transaction, they generate a one time use (mastercard) credit card.

This is the definition of tokenization

> Apple uses _network_ tokenization. It too is like a credit card proxy and each token is device specific. The magic here is that the networks are supporting this technology (although not all back end merchant

What?

> The token is reusable unlike the one time use cards

What?

I think you have to re read how Apple Pay works and what tokenization really is because i Think you're a little confused

That you think a one time use card is the definition of a token makes this a non starter in terms of a discussion.

That you think the Apple Pay token is reusable makes this a non starter in terms of a discussion

Can you explain what the difference you think there is between a proxy card and tokenization, if the proxy card was randomly generated each transaction (which wallet supports)

(Hint: There is no difference, both would be valid methods of tokenization by the spec :P)

Google Wallet may support per-transaction proxy card randomization. Does it actually do this? Can you link to a spec or documentation that supports your claims?

Thanks!

AFAIK, it does. But that's just what i'm told, if you have data that says it doesn't, ...

Who told you?

I work in nether finance, nor on the Wallet team, so I don't have information about the details of Wallet's workings.

Regardless, it's proper for the claimant to provide data to support their claim. :)

But the proxy card isn't randomly generated. It's always the same.

Google gets your payment data. Apple doesn't.

Google is the payment processor. The tokenization spec completely supports and expects payment processors who are not issuing banks will have payment data :)

(I know this goes against what some words in blogs on the internet say, but feel free to read the EMV tokenization spec yourself, and you'll see it's true. Tokenization != only issuing bank sees payment data. Maybe some "ecosystems" try to guarantee it, but it's certainly not required)

I think Google Wallet even supports it from the HTML5 requestAutocomplete() API for web stores. Not sure if it's a unique card per transaction, but it's good to know you have some protection.

Check out the HTML demo here:

https://e60696416b5235dfd15e2b9bfc5dab0e3b37ade2.googledrive...

And yet it still doesn't work in Canada which adopted the technology ahead of the US and has a much wider roll out.

Adopted what technology? Canada has had chip tech and tap-to-pay tech in their various debit and credit cards for a while but I've never seen tap-to-pay work with a phone here in Canada. On top of that, Google Wallet has not yet been rolled out to work in Canada or internationally for that matter, even with their physical Google Wallet cards. If you attempt to make a purchase with the physical card, it will be declined and you'll receive a notification saying that international (non-US) purchases are not supported. Apple Pay additionally does not work in Canada. Given the first point made, there's no reason for them to activate it soon anyway because our hardware won't work out of the gate regardless.

What?

Google Wallet not working is completely on Google/the issuing bank. That is entirely a software limitation. If you try using the NFC on the phone and it tells you it's not available internationally, then there's clearly no hardware incompatibility, it's just Google not supporting international transactions.

Apple Pay not rolling out is also, similarly, because Apple is not ready to roll out in Canada, it's entirely software-based. I had my iPhone region set to Canada (I guess I never switched when I moved down) and I couldn't access the settings. Once I switched to US, bam, there it was. There have already been people who confirmed[1] that Apple Pay works perfectly fine in Canada.

NFC transactions are standardized, there is no "hardware won't work" because the entire point of the standard is that it will work. The incompatibilities are completely arbitrary, it's the respective companies not wanting to expand to Canada yet and using software to disable or limit the transactions based on transaction location.

[1]: http://www.itbusiness.ca/news/how-to-use-apple-pay-in-canada...

Posted down-thread as well, but Google Wallet worked in Canada when it first launched. It wouldn't accept a Canadian address, but you could pay if you could get money onto the prepaid card. They added progressively more limitations, until eventually it started erroring at Canadian merchants. It's completely on Google, there's no technical incompatibility.

Do you have any info on the hardware incompatibility ?. I always assumed that mobile payments were meant to work with those existing NFC POS terminals.

Apple Pay does work in Canada, but it only works with American credit cards. I use it in Canada all the time.

Or in Australia, I managed to work around the geo-blocking and get it to work awhile ago but was too unstable at the time to be worth using it.

Australia has been using chip and pin for years now and most (majority) or retailers have "Tap and go" readers at the checkout.

Seems like all they need to do is remove the geo restriction and they would be good to go

AFAIK, Canada's "flash payments" use incompatible physical-layer standards. To make it work, you'd need a phone with two NFC radios in it.

Since phones with both GSM and CDMA radios are extremely recent—despite the need being obvious for a very long time—I doubt we'll see hybrid-radio NFC designs any time soon.

Nope. I had Google Wallet working on my Neuxs S in Canada two years ago, you can use it at any Tim Hortons ;)

Canadian banks do support their own mobile wallets (similar to the ISIS model), but only on a few cherry-picked devices, and with a custom SIM. See http://www.rbcroyalbank.com/mobile/wallet/

Do you mean Interac Flash? Because that's EMV[1], just like Visa's PayWave, MC's PayPass, etc. They're all interchangeable, and they all use the same standard. There's no two radios needed. Plus, most NFC terminals in Canada were first built for PayWave/PayPass, so it would be stupid for them to try and go in a completely separate direction for debit NFC transactions.

[1]: http://www.interac.ca/en/press-releases/mobile-debit-eng under "About mobile Interac Flash"

Do you have a source for this?, I found a list [1] of handsets that are compatible with Visa paywave which i see around a lot. It suggests that at least some handsets are capable of interfacing with existing NFC terminals.

[1] https://technologypartner.visa.com/Download.aspx?id=188

If Google Wallet was to continue to exist this was inevitable because Softcard (formerly ISIS) had locked up the usage of the secure element inside all the Android phones coming from all the US carriers except Sprint and its MVNOs. And ISIS was having a very hard time getting retailers onboard with its platform despite offering 7 figure incentives and covering their implementation costs for integration with their point of sale systems.

Google Wallet works (and has worked) just fine with NFC payments on my Verizon phone. This is much less of an issue with modern phones due to changes in the way the secure element works.

(EDIT: To be clear, I am talking about this: https://developer.android.com/about/versions/kitkat.html#44-...)

Isn't there an EMV-NFC standard that eliminates the need for POS integration? IIRC CurrentC was the one that isn't using the standard.

Yes, there is a standard for payments on the PIN pads. However, the real push for ISIS/Softcard was that they could do more than payments. They wanted to be able to push coupons through the PIN pads to the POS from their app. That was how they were planning to monetize the platform. The fees they would get from banks to hook into the system were minimal.

Even if the PIN pads could support coupons over NFC, most large scale POS software could not. I had experience last year trying to integrate ISIS/Softcard into a large retailer that was running IBM/Toshiba ACE POS software and ISIS/Softcard support wasn't even IBM/Toshiba's radar. Many large retailers run ACE (Kroger, Safeway, Costco, Macys, etc.).

Ah, my mistake. I was thinking of the credit card system as a "dumb pipe" for money. Why would anyone want to build that?

Is this an acquisition?

Google called it a partnership and Softcard said something along the lines of "Google is acquiring Softcard's technology" which leaves me a bit confused but I don't think it's an outright acquisition.

Deleted comment

Thank you for the link. Softcard was pre-installed on my Moto X 2013, so I wonder what's really going to change.

Reply on news.ycombinator.com