A Comprehensive Outline of the Security Behind Apple Pay

[avanpelt]

I have no clue as to why Apple is making us wait. Code isn't complete? Don't know.

I do know that's it's just NFC and it'll work everywhere Google Wallet currently works at. You know, the 220,000 stores that Apple said that Apple Pay will work at. Yeah, Google Wallet already works at all those places.

Apple just has to turn it on.

They'd better be testing the hell out of it -- and I'm sure they are. Given the news of the last two weeks or so, Apple should be checking the code obsessively. They know that if they screw up Apple Pay and people start having strange transactions showing up on their bank statements because some group figured out some off the wall way to compromise the system in a way Apple hadn't anticipated, Apple Pay is toast.

 

[knemonic]

Though I am behind this, since it sounds so much more secure than a regular cc, I hope smaller merchants don't drage their feet cause I still end up having to carry around a cc. Would be nice to just be able to carry my phone with me, for example to a bar.

 

[greytmom]

Folks, if you are being held at gun or knife point so that a thief can get your pin or password, you've got bigger issues than the thief going on a shopping spree.

 

[kas23]

It’s a money thing. I don’t have the funds to spend on a new phone, and I’m on the s upgrade cycle with my carrier. So it’ll be another year before I’m looking at a phone with NFC.

I know. I was just pulling your leg.

 

[thiagos]

After all these flawed iOS 8 releases, how will Apple give their customers the peace of mind with Apple Pay?
Yesterday I texted a friend via iMessage, another friend of mine got the text. And I don't mean it as in I did it by mistake. It opened up an entire other person. I've never had this happened to me before.
The iPhone crashes on landscape mode, freezes, sometimes even shuts off.

How has Apple sunk this low?

 

[xPad]

How do you get refunds?

Like you always do. The merchant and the bank will have a transaction ID they can reference. Just as the bank knows who to charge, they know who to credit for a reversal.

The difference is that the merchant doesn't have your CC#, so they can't issue fraudulent charges going forward, nor can they be hacked in such a way that someone else could.

 

[Tech198]

This is actually kind of funny when u think about it..

We all have Touch ID, and Apple claims it's secure... (Yes, secure, by no one else an get at it *except* you can compelled by a court to use your finger)

Password, something we know, based on how complex we entered them in originally, they will hold up in any court, since u aren't forced to revel your password anyway. But your finger-print ? Very true...

Turns out, Touch ID may not be as secure as we think isn't as secure as we think is it?

Personally, my passwords, stay as "my" passwords and i only know a few off hand. I do use Touch ID, but not for important stuff.

 

[j2004p]

That's my number one concern. Rather than inventing trivial, elaborate scenarios about theft I want to know how I can return an item I purchased.

Our company accepts pre-authorised emv tokens from ecommerce sites so we can then process payments when we despatch goods. We never see any customer account details other than the card type.

This token and refund amount (along with a payment reference) gets passed back to the payment provider who then refund back to the original card.

From what I've read the apple pay system is just an extension of this type of transaction with some additional security features

 

[GeneralChang]

I know. I was just pulling your leg.

Is THAT why my knee is so sore? Jees, thanks.

 

[ebika]

Apple pay sounds like a nice system. It also sounds like it won't work to replace the Chicago mass transit cards, like you can do with Google Wallet and NFC. That's kind of a bummer.

And to those that worry about the finger poachers, realize your iPhone 6 Plus has the security feature of being easily and quickly folded in half to thwart bad guys (those of us with iPhone 6s will just have to come up with other plans to overcome the defect of ruggedness).

 

[Tech198]

Apple's pushing us to a "one phone, to rule them all".

 

[GeneralChang]

This is actually kind of funny when u think about it..

We all have Touch ID, and Apple claims it's secure... (Yes, secure, by no one else an get at it *except* you can compelled by a court to use your finger)

Password, something we know, based on how complex we entered them in originally, they will hold up in any court, since u aren't forced to revel your password anyway. But your finger-print ? Very true...

Turns out, Touch ID may not be as secure as we think isn't as secure as we think is it?

Personally, my passwords, stay as "my" passwords and i only know a few off hand. I do use Touch ID, but not for important stuff.

So your biggest concern is that a court is going to order you to unlock your phone with your fingerprint? That’s… an interesting concern.

Simple solution for you. Before you show up for your court date, do an activation lock on your phone, then refuse to enter your password. Way to stick it to the man, bro!

On another note, what does the court wanting to unlock your phone have to do with Apple Pay? Are they planning on using it to order breakfast?

 

[Menel]

Sorry, Tokenisation is already standard practice outside the US - its one of the definition features of Chip cards.

Exactly! No portion of this is particularly "new", nor does it offer end users any real security benefits.

If you have a non-US issued contactless credit/debit card you have very similar technology in your wallet already.

False and false.
You two FUD spreaders are why this article and articles like it exist.

The tokenization standard was published in March, OF THIS YEAR, EMV Chips are much older, and do not support this.

Some quick research of public docs to help you guys understand. THIS IS ALL NEW.

"Even with EMV [chip], they still would have suffered this breach because they have no tokenization in place and card not present is still fair game [with stolen data]," says Julie Conroy, senior analyst and fraud expert with Boston-based Aite Group.

http://www.paymentssource.com/news/...traction-in-target-breach-case-3016716-1.html

In particular, there are key areas of vulnerability in the payments process that EMV alone does not address:
1. From the point of card insertion or tap, when the card data is transmitted in the clear to the processor or is later
stored by the merchant post-authorization

The singular focus on card-level fraud leaves a key gap in today’s EMV implementations. EMV does not address merchant-specific risks such as the interception of card numbers in transmission on the merchant network or attacks against repositories of card information within the merchant, acquirer, processor, network or issuer environment. The PCI Security Standards Council notes: “in EMV environments, the PAN [primary account number] is not kept confidential at any point in the transaction.”4 The largest breaches of card information in the U.S. have come from vulnerabilities within the merchant or processor environment that EMV does not address.

Currently, in the majority of both EMV and non-EMV transactions, payment card information is sent from the point-of-capture to the acquirer/processor “in the clear,” i.e., in an unencrypted form. Historically, when the majority of transactions traversed private phone lines, this was less problematic. However, as more and more terminals and point-of-sale systems have begun using Internet technology for data transmission, the ability to capture that data “in flight” has been exploited by criminals to steal millions of card numbers from unsuspecting merchants. While a dynamic cryptogram provides some level of protection, the payment card information still travels in the clear and could theoretically be counterfeited onto a magnetic stripe or used in a card-not-present environment. The primary method of eliminating this form of attack is to encrypt the payment card information at the point-of-capture, rendering the data unusable to thieves.

Another key point of exposure is that many merchants retain payment card data after the transaction in long-term data stores. Small merchants hold hundreds of card numbers on their terminals or in their point-of-sale systems. Large retailers have data warehouses containing hundreds of millions of card numbers that they use for marketing and analysis of customer purchasing behavior. The massive volume and value of this information makes these data stores a prime target for criminals.

http://www.firstdata.com/downloads/thought-leadership/EMV-Encrypt-Tokenization-WP.PDF

EMV chip is **** compared to EMV tokenization... which Apple Pay implements, and is the first to implement.

 

[gnasher729]

I'd be nervous about the security of the Apple Watch. It's only slightly more secure than a Chip and PIN system. If someone sees you enter your password or PIN on the watch then all they need is the watch. The same goes for the chipped card and your PIN. With all the cameras around, someone could watch you enter your password or PIN, then steal your watch or wallet.

It's a lot safer, because you don't enter your PIN in public. You put on your watch, enter the PIN (likely in your bathroom) and it works as long as you don't take off the watch. Nobody sees you entering the PIN.

 

[SirLance99]

Correct me if I'm wrong, as I'm still reading up on both implementations. But from what I understand, Google Wallet is only encrypted part of the way. Google Wallet takes the card out between the user and the merchant, but between the merchant and the bank the account number is still sent.

Also, you need to store your credit card number with Google. If your phone is compromised you have to contact your credit card company to cancel your card and get issued a replacement.

Apple doesn't store your credit card number, with the exception of the one associated with your iTunes account. And if your iPhone is compromised you only need to deactivate that device for payments; there is no need to cancel your card and get a replacement.

You're partly right and wrong. If you stole my phone, you'd have to know my pin to get into the phone. After you figured that out and found the Google Wallet app, you'd have to know my pin (which is different) to get into the app. Even then you can only see the 4 digits of the card. By then I would have had the phone remotely wiped anyways.

 

[Tech198]

So your biggest concern is that a court is going to order you to unlock your phone with your fingerprint? That’s… an interesting concern.

Simple solution for you. Before you show up for your court date, do an activation lock on your phone, then refuse to enter your password. Way to stick it to the man, bro!

On another note, what does the court wanting to unlock your phone have to do with Apple Pay? Are they planning on using it to order breakfast?

Totally irrelevant of Apple Pay.

 

[sik08amg]

I'm curious about some things.

Do we sign anything for credit card purchases over 50 dollars?

I am also curious about mobile to mobile payments, where the Square Card Reader would be used currently. Can I use my iPhone 6 and pay someone else who has a iPhone 6?

 

[SirLance99]

That's my number one concern. Rather than inventing trivial, elaborate scenarios about theft I want to know how I can return an item I purchased.

----------



Well stupid cheapos should just get a 5s or newer iPhone then! Problem solved!!! If you have a 5 or a 5c then you deserve to get robbed!!! (just joking of course)

Simple. You take the item back and return it. I've done it with Google Wallet and the money showed back up just like normal.

----------

It’s a money thing. I don’t have the funds to spend on a new phone, and I’m on the s upgrade cycle with my carrier. So it’ll be another year before I’m looking at a phone with NFC.

It'll be another year before this really takes off anyways. For Apple Pay or Google Wallet. So no need to worry.

 

[Ntombi]

I'd like to know how to get my credit union on board with Apple Pay. They are not nationwide and are only locally operated but I'd love to have this on my iPhone 6.

I have emailed my (city) credit union already, and plan to follow up in person. That's what you need to do, remind them that they have members who are interested in using this secure technology. Remember, the point of a credit union was originally that it met the needs of its members.

As a victim of the Target data breach, and only days outside of the Home Depot data breach dates, I'm very excited at the prospect of Apple Pay, and am trying to encourage my credit union to move on this quickly.

 

[SirLance99]

I hope so. I hope within the next 12 months, we'll see Apple Pay roll out to pretty much every major retailer and many small retailers. If it takes Apple Pay more than 12 months to catch on, I'll fear that it's going the way of iBeacons -- which, except for a few select places, is basically a flop as of right now.

However, because Apple Pay has the support of the major credit card companies and large banks, it seems to me that Apple Pay is almost guaranteed to be a mainstream payment method within the next 12 months.

Which is why I'm excited for Apple Pay. The more places that put NFC POS terminals in their stores, the more places I can use Google Wallet.

----------

Maybe coordination with the banks and credit card companies. They have to do stuff on their end too, right?

Yes, backend software

 

[macduke]

Credit cards are designed for a bygone era. Actual secure information is just written on them in plain text, complete with raised letters that were able to be carbon copied (in my teens I worked at a bank and had to do this for cash advances). You have to hand your card to a waitress, who takes it to some back area to process the transaction. Scary stuff. Security involves signing it. I can't wait until this new payment system is widespread. For as many imaginary things people list that could defeat this system, the current system is much more flawed and easy to hack. People just don't like change—but this is certainly an instance where we should welcome it. I'm excited to get started!

 

[SirLance99]

You're quite mistaken. Google Wallet stores your credit cards on their servers (you got that part right), then issues you a new PAN (CC#) which does not change from transaction to transaction. By storing your CC's, they can track all your purchases, and this allows for CC fraud by skimming, Target/Home Depot level hacks, etc.

Apple never even stores your credit card info anywhere. And if someone gets your token (Google Wallet does not use tokens), they cannot use it!

So what is the token I get when I make a purchase from Google Wallet?

 

[Menel]

There's not a single novel thing about Apple Pay that hasn't been done by Goigle Wallet.

Tokenization was already done there. The "cryptogram" is a CVV3/dynamic CVV.

The only semi interesting thing is using Touch ID to unlock the Secure Element. And storing card details on device instead of man in the middling like Wallet.

Not even close. Google Wallet is nothing like ApplePay. Google Wallet pre-dates the March 2014 EMVco tokenization standard ApplePay is based on. How could it implement something that did not exist?

Google Wallet doesn't issue transaction specific tokens. ApplePay does.
GW holds your credit card number. ApplePay does not.
GW processes transactions on a proxy CC. ApplePay does not.
GW you don't get merchant specific rewards. ApplePay you do.

 

[SirLance99]

Apple's pushing us to a "one phone, to rule them all".

That will never happen.

 

[eac25]

Chip and PIN is very secure if you are careful. You cover the PIN pad with your other hand when you put the PIN in. No one has to see.

I wonder how many people mistype their PIN because they can't see what they're typing because their hand is covering the PINpad... ;-)

On the other hand - everything is secure if you're careful enough... If you're careful to never get a card you actually achieve zero risk. Well, on that front, anyway.

Food for thought: "When trying to create a system that is foolproof, one should never underestimate the creativity of a fool." [Or nearly that.] -- Douglas Adams