Apple Said to Be Using Tokenization Technology to Secure Mobile Payments Service

[jrswizzle]

No, everyone knows why people don't use 2-part-authentication. It is a pain in the ass and unnecessary for most applications.

It's honestly not that difficult.....

Maybe setting it up takes a little time. But if you're concerned about privacy, taking an extra 10 minutes to maximize your security isn't worth it?

I have it turned on - but personally, I'm not all that concerned with people stealing pictures of my dog or my mostly empty bank account numbers. Far bigger fish out there than I.

 

[iSee]

sure looks like NFC from Apple is no its way.

I didn't think they'd do it... for a powered device, bluetooth LE seems to do everything NFC does and more. And it doesn't really seem like NFC-based payment networks have really taken off, though I realize I have a US perspective on that.

But just a day before the reveal, I can't believe all the leaks are wrong.

Not that I'm complaining, I just didn't expect it... if it helps mobile payment systems take off then it's all good to me.

 

[TallManNY]

You don't have these in the US? I must admit I was not sure at first but it does have some security. Firstly you have the card with you and hold it next to the terminal. Secondly there is a limit to how many times you can use it and how much you can spend before it asks for a PIN number. So I guess if someone does steal it at least they can't spend too much before the card would ask for a PIN or you report it stolen and it's immediately blocked.

I'm not sure it's all that less secure than a chip and PIN debit card which can be skimmed by the cashier without you even knowing. That way they get your PIN number and access to a whole lot more cash at the ATM.

It's a handy and quick way to pay for small purchases. The idea is to replace cash wherever possible which I like the idea of. If there was an alternative option to pre-load my iPhone with cash and use the that as a wireless payment device instead I would prefer that as it wouldn't be linked to my bank account.

I've always been suspicious of debit cards. I've never seen an advantage to the consumer, but there is a clear advantage to the bank (they use your money instead of theirs to pay the store) and a clear disadvantage to the consumer (if you get it hacked/stolen, your money is gone from your bank account and then you have to convince the bank to put their money back in place of it). Hence I prefer to have less access points to my bank account. And I certainly don't want to use an access point repeatedly through the day at various locations.

 

[gotluck]

I've always been suspicious of debit cards. I've never seen an advantage to the consumer, but there is a clear advantage to the bank (they use your money instead of theirs to pay the store) and a clear disadvantage to the consumer (if you get it hacked/stolen, your money is gone from your bank account and then you have to convince the bank to put their money back in place of it). Hence I prefer to have less access points to my bank account. And I certainly don't want to use an access point repeatedly through the day at various locations.

Indeed, I basically never use my debit card and have it for emergency purposes / atm cash withdrawals. Credit Card is the way to go (except for cash of course).

 

[Mums]

So many different kinds of tokenization going on at Apple...

 

[ThisIsNotMe]

It's honestly not that difficult.....

Maybe setting it up takes a little time. But if you're concerned about privacy, taking an extra 10 minutes to maximize your security isn't worth it?

I have it turned on - but personally, I'm not all that concerned with people stealing pictures of my dog or my mostly empty bank account numbers. Far bigger fish out there than I.

I had it turned on until I ran into a situation where my phone was in the car and I needed to log in. Too much of a pain in the ass.

I do use it for wire transfer authorizations and other financial transactions but that is about it.

 

[bradl]

I hope it's not retailer specific otherwise it will take years to implement. I don't know much about this technology but it surely has to work with what's out there in the retailers already to gain widespread adoption. I just recently got a new debit card from my bank with Wireless function. I just hold it next to the terminal and it's paid. Hopefully I will be able to do the same with my iPhone.

I'm with Shaun, UK on this topic. I hope it works with the established standard rather than require a new level of adoption. To implement something proprietary, for every big chain (CVS, Nordstroms, Walgreens), there are probably hundreds of "mom & pops" that would also need to make a deal with Apple. Then, think about the pace of that on a global scale so this could work well everywhere.

Is this going to be something like wifi (which just works everywhere) or something more closed like FaceTime? We'll find out in the next few days.

Luckily, it isn't down to the merchant (retailer). This would occur between the credit card processor, and the bank(s) who would handle the payment. All of that happens behind the scenes of the retailer. In fact, all of this happens pretty much after the swipe of the card.

Now, how Apple will handle that is a good question, especially if they are getting into the PCI business, and that's a hard one to get into.

BL.

 

[name99]

We can do even better

"Financial institutions -- card issuers and networks -- prefer token technology because it replaces primary account numbers, those 16-digit card numbers on the front of credit and debit cards. Instead, the tokenization technology uses complex codes that are easily transmittable over the air and between devices, but that are used only once, so even if they are intercepted, are of no use to fraudsters."

This is nice, but I continue to be surprised at how limited is the thinking behind these payment schemes (certainly Android in what we've seen, perhaps with Apples system).

For example, all these systems appear to be based on using the phone to perform some sort of challenge-response, plus fingerprint (or equivalent, like password) for authentication. That's nice, but you could do so much more.

What I'd suggest as the bare minimum more would be that the phone ALSO takes photos (front, back cameras + screen capture) at the same time as its doing all this work.
What would this do?
One direction this could go is simple convenience for the user. When one sees an unfamiliar charge, one could look at the photo(s) record to see what was being bought. Obviously if the user doesn't care, the photo record is useless, but the user has the option to, at the appropriate time, point the camera at the McDonalds menu, or at the computer screen for an internet purchase, or the gas station or whatever.
A second direction this could go is to insist that the "selfie" version of the photo include a human face (as opposed to the camera pointed off nowhere) which looks more or less like the authenticated user. This provides something that can be used for dispute resolution by the bank, the merchant, or the buyer. Obviously you can imagine problems with this --- nothing is perfect --- but having a trail like this seems like it would help IMMENSELY in shutting down fraud because it provides a kind of visceral "I'm not going to get away with this" that is less obvious (and thus less compelling to your stupider criminal) than IP tracking, password cracking, fingerprint spoofing and so on.

 

[Beta]

I work with tokenised transactions, and here in Australia at least they work differently to how this article and others have described. The merchant registers a card with the bank, and the bank returns a single token to represent that card for all future transactions. The token never changes. They are considered safe because any payment processed using that token will settle in the account of the merchant that requested it. There is no incentive for a third party to use/steal/intercept that token.

 

[randian]

Maybe setting it up takes a little time. But if you're concerned about privacy, taking an extra 10 minutes to maximize your security isn't worth it?

Not when you have strong passwords. 2FA just wastes your time and adds aggravation in that case. That's why I use a password manager like 1Password or Lastpass: the password takes longer to crack than the useful lifetime of the information to be gained.

 

[Tech198]

"data with disposable, one-time use codes. "

I like what i see..

 

[Bahroo]

So basically Android fanboys are gonna bash isheeeepz for finally getting NFC, but fail to realize that Apple is going to revolutionize NFC and now be the ultimate leader and transform NFC tommorow and now pave the way for all NFC, with Android doing nothing by following suit. Just one of many things Apple has took and has dramatically improved and has outexecuted the competition on.

-Tokenization transactions

-Secure Enclaves onboard to protect fingerprint/credit card/personal information data

-Fingerprint transactions

 

[Tech198]

So basically Android fanboys are gonna bash isheeeepz for finally getting NFC, but fail to realize that Apple is going to revolutionize NFC and now be the ultimate leader and transform NFC tommorow and now pave the way for all NFC, with Android doing nothing by following suit. Just one of many things Apple has took and has dramatically improved and has outexecuted the competition on.

-Tokenization transactions

-Secure Enclaves onboard to protect fingerprint/credit card/personal information data

-Fingerprint transactions

bash....bash....bash....bash

 

[AllieNeko]

Not when you have strong passwords. 2FA just wastes your time and adds aggravation in that case. That's why I use a password manager like 1Password or Lastpass: the password takes longer to crack than the useful lifetime of the information to be gained.

If you believe this, you have no understanding of the purpose of two-factor authentication. Hint - it is NOT to protect against people brute-forcing your password! Two-factor authentication is to protect against INTERCEPTION of your password. "IUiuendaJNWIUH3988942HQ8U(*H#*(32MGNEIH(*@90120" is no strong of a password than "dog" if it is intercepted! Interception may not always be obvious, and isn't necessarily a virus. Hardware keyloggers, work computers, malicious WiFi, etc.

While, on paper, a strong password on a secure, trustworthy system is adequate, Target, Home Depot, etc have shown us that even corporations with enormous IT budgets can't necessarily trust their own tightly controlled systems. How can you begin to trust every place you might ever need to check your email?

As annoying as it might be (and you get used to it), two-factor authentication is CRITICAL, and totally unrelated to strong passwords (though, obviously, a second authentication factor does help offset a weak password. I'd much rather have a weak password and good two-factor auth than have a strong password as the only factor).

Now, back on topic - payment tokenisation. I don't really believe it. There IS an EMV payment tokenisation specification - http://www.emvco.com/specifications.aspx?id=263

BUT - there are issues. It's relatively new. It wouldn't necessarily work at every terminal supporting contactless, especially as I BELIEVE these cannot be presented as a magnetic stripe. Right now, many contactless payment terminals in the US do NOT conduct a full EMV transaction, but rather use elements from the chip to construct a magnetic stripe transaction. This is allowed for contactless. Likewise, many contactless cards that exist (including Google Wallet), present only enough data to do this construction. This is called "Contactless Magnetic Stripe Data."

I'm not sure if tokenisation works in this environment, and if it doesn't - that'd mean some terminals wouldn't support Apple's solution until next year (when EMV is mandated Oct 2015 - contactless magnetic stripe will no longer be supported - or rather, support is no longer mandatory for contactless acceptance in the US).

Second would be in cities like London where contactless is now supported for TfL - will they be able to properly de-tokenise and track these transactions? I'd hope London could since contactless is brand new there, but what about other cities? Google Wallet is strictly US only (and contactless MSD), so this doesn't come up.

Tokenisation is nice, but definitely not a requirement to make such a system very secure. I doubt it'll happen immediately. If it does, good on Apple - that'll push tokenisation support.

Remember, all the idiots saying the US should skip EMV and go to tokenisation after Target? TOKENISATION IS PART OF THE EMV SPEC, and EMV is NECESSARY to make tokenisation work. You can't tokenise a magnetic stripe (well, unless you use something like Coin's tech to re-write it but that makes EMV look dirt cheap)! Hopefully, Apple will give tokenisation the push it needs to be widely supported but... I doubt it. Apple is all about things just working. And that is sending normal contactless EMV in a way that can support EMV or constructed magnetic stripe processing.

 

[kdarling]

So basically Android fanboys are gonna bash isheeeepz for finally getting NFC, but fail to realize that Apple is going to revolutionize NFC and now be the ultimate leader and transform NFC tommorow and now pave the way for all NFC, with Android doing nothing by following suit. Just one of many things Apple has took and has dramatically improved and has outexecuted the competition on.

Widespread NFC support is coming to the USA even if Apple disappeared tomorrow. MC and Visa are pushing it because it causes up to 25% more sales. The addition of the iPhone will of course make it more well known to iPhone users.

Google already revolutionized NFC by making Host Card Emulation acceptable by banks. Apple is following in their footsteps, and will wrap and market it a lot better, while of course also tying people to their own products and skimming a percentage. Because, Apple.

-Tokenization transactions

Google Wallet.

-Secure Enclaves onboard to protect fingerprint/credit card/personal information data

Secure Elements are part of the NFC spec. They're even built into NFC chips and SIMs.

However, both Apple and Google are doing their own.

-Fingerprint transactions

This part is nice. It's quite possible that Apple looked at the coming EMV card transition, and decided to roll out fingerprint early to wring out any bugs.

Fingerprints are more convenient that using a PIN, if/when a payment PIN is needed. For smaller transactions, they are not.

Now, back on topic - payment tokenisation. I don't really believe it. ....

Already in use. Started last year with Canada's RBC bank, and now used in Google Wallet.

To the POS terminal, it's just another PAN and CVV. It has no idea that it's a temporary account token. That is all handled by the backend systems.

Btw, magstripe emulation is for older RFID cards, not for EMV.

Hopefully, Apple will give tokenisation the push it needs to be widely supported but... I doubt it. Apple is all about things just working. And that is sending normal contactless EMV in a way that can support EMV or constructed magnetic stripe processing.

Apple is probably jumping in now partly because Google paved the way around the Secure Element inside phones, which the carriers control.

People often say, Oh well Google Wallet didn't take off. What they don't understand is that the ISIS (now Softcard) cartel controlled NFC payments by controlling their own NFC SE inside the phone. That's how NFC on many Android phones was blocked, because Google didn't want to play along.

Google recently implemented a way around that, and has opened the way for everyone, including Apple, to implement their own payment apps without having to have them provisioned as Java applets in the phone's NFC SE.

.

 

[Bahroo]

Widespread NFC support is coming to the USA even if Apple disappeared tomorrow. MC and Visa are pushing it because it causes up to 25% more sales. The addition of the iPhone will of course make it more well known to iPhone users.

Google already revolutionized NFC by making Host Card Emulation acceptable by banks. Apple is following in their footsteps, and will wrap and market it a lot better, while of course also tying people to their own products and skimming a percentage. Because, Apple.



Google Wallet.



Secure Elements are part of the NFC spec. They're even built into NFC chips and SIMs.

However, both Apple and Google are doing their own.



This part is nice. It's quite possible that Apple looked at the coming EMV card transition, and decided to roll out fingerprint early to wring out any bugs.

Fingerprints are more convenient that using a PIN, if/when a payment PIN is needed. For smaller transactions, they are not.



Already in use. Started last year with Canada's RBC bank, and now used in Google Wallet.

To the POS terminal, it's just another PAN and CVV. It has no idea that it's a temporary account token. That is all handled by the backend systems.

Btw, magstripe emulation is for older RFID cards, not for EMV.



Apple is probably jumping in now partly because Google paved the way around the Secure Element inside phones, which the carriers control.

People often say, Oh well Google Wallet didn't take off. What they don't understand is that the ISIS (now Softcard) cartel controlled NFC payments by controlling their own NFC SE inside the phone. That's how NFC on many Android phones was blocked, because Google didn't want to play along.

Google recently implemented a way around that, and has opened the way for everyone, including Apple, to implement their own payment apps without having to have them provisioned as Java applets in the phone's NFC SE.

.

Dude the carriers have absolutely nothing to do with the Secure Elements on board lol, they use ARM TrustZone for that, ARM made it, and there is no tokenization method for credit card transaction on Android, your point is moot, Brand new TrustZone technology and architecture came with ArmV8, and Apple fine tuned it, NFC growth statistics have been extremely poor, Apple is not only going to give NFC a spark and boom, its going to make pretty much everyone now know what NFC is and hop on board because Apple will have implemented the most safest securest NFC implementation known

-secure enclaves
-iBeacon as a extra security layer at stores
-Tokenization
-Fingerprint scanner

this level of security simply wont be matched by Android for some time.

 

[kdarling]

Dude the carriers have absolutely nothing to do with the Secure Elements on board lol, they use ARM TrustZone for that, ARM made it, and there is no tokenization method for credit card transaction

You are confusing NFC Secure Element and CPU Secure Enclave.

They are not the same term.

The carriers / payment providers control the former. The OS writers control the latter.

That's why Apple and Google are bypassing the first.

 

[PJL500]

Watches (and btw, U2)

have gone the sway of the buggy whip or iWhip as it was known back in the day. Bring on Google glass (and maybe make it iOS compatible.)

 

[AllieNeko]

At least those in the UK have to be really blimmin' close to the reader.

I use the contactless-payment ability of my debit card every day at the newsagent two doors down from my house. Get a newspaper and a drink every day. Takes about a second to pay. Only thing is, 'contactless' is a bit of a misnomer, since the card seems to actually have to touch the terminal to work. It doesn't work with the card in my wallet (I've tried -- and it's just a normal leather wallet, not a paranoia-laden tin foil-wrapped wallet).

No, it's not a misnomer - you misunderstand the meaning. "Contactless" isn't referring to physical contact, it is referring to electrical contact. E.g. you don't have to insert the chip contact pad into the reader and have electrical contact made with the chip. Instead, you communicate with the chip through radio waves - no electrical contact. Oh, and you don't really NEED physical contact either, you can be a centimetre or so away no problem. But that's harder to do than just tapping the thing.

 

[foodog]

Wow! I'm surprised Apple hasn't been using Token tech for their ( my ) payments. I've been writing token payment code for a little over two years.

It's not like it's a new idea.

----------


AND choose NOT to use two-part authentication.

----------

Same way as your credit card mate. Just swipe your phone near the 'pad'.

Just to scare everyone, I could easily setup a capture at the fuel pump and grab your swipe. I'm curious on how 'they' can make this secure, possibly include a manual PIN?

Not sure grabbing a one-time use number is useful.

 

[960design]

Not sure grabbing a one-time use number is useful.

You are correct. Apple seems to have thought it out pretty well. Here's what I ( any bad person ) could do.
1) Capture millions of useless keys

That's pretty much it.

Now, IF I could get my hands on the physical device, then possibly I could do some magic, but from the tech specs, it really looks like even if I had the device, I really couldn't do too much. Just thinking here. I'm sure you'll hear about it if we find a weakness.

My faith has been restored. I really think Apple Pay, is THE way of the future. I'm certainly going to implement it in all the online stores I admin.

----------

Now, how Apple will handle that is a good question, especially if they are getting into the PCI business, and that's a hard one to get into.

BL.

I'm not a PCI rules expert by any means. But my understanding of the way Apple has implemented Apple Pay, PCI compliance rules will not apply directly to Apple. Sure some standards will be met, but not the hardcore rules.

 

[AllieNeko]

I was wrong, Mastercard has clarified that Apple is using EMV tokenisation. This, frankly, shocks me as Tim Cook did NOT mention this in the keynote (one-time transaction codes and tokenisation are different things), and you'd think it'd be a major deal and the phrase "EMV tokenisation" would have came up numerous times...

I wonder if Apple or the card networks are afraid of compatibility issues and don't want it blamed on EMV? We shall see.