News for hackers. Stuff that matters.
Re:Hands on with Apple Pay Competitor CurrentC by prplhaz4 on Thursday November 05, 2015 @09:36AM (#10513494)
I believe CurrentC's (Paydiant's) QR code tokenization works the same as you've described Apple Pay tokenization - the merchant POS does not see any payment info other than a one-time-use token.

This was another decent teardown of Paydiant's Subway app - but it looks like someone high up has had some of the code redacted :) http://randywestergren.com/reverse-engineering-the-subway-an...

Functionally, it looks like CurrentC only has two advantages over *Pays - loyalty integration and big box retailer backing. Not likely enough, but will be interesting to see how it plays out in the lower end market where a flagship device is not required...

Re:Hands on with Apple Pay Competitor CurrentC by coleca on Thursday November 05, 2015 @10:47AM (#10513944)
Loyalty integration is already being integrated into ApplePay. Walgreens went live with it today. Kohls also announced support for their house-brand credit / loyalty card.

The retailers are going to find that their "loyal" customers are much more loyal to their iPhones and Android phones then they are to the retailer's brand.

Consumers like the loyalty programs because they are a benefit to them (lower prices without clipping coupons and points programs such as .10 off a gallon of gas for every $100 purchased in store). The consumer isn't interested in helping the retailer build a database about their habits for "targeted marketing". Most people if left to think about it, find the programs creepy and would actively use any alternative if it was just as convenient as having the little card on their keychain.

That's not even to mention the ridiculous amount of barriers CurrentC will have asking for people's bank accounts from the same retailers (Target, Home Depot, etc.) that lost their credit card information. At least with the credit cards the consumer is protected. Not so much with their checking accounts.

Re:Hands on with Apple Pay Competitor CurrentC by ascagnel_ on Thursday November 05, 2015 @10:20AM (#10513763)
As far as loyalty integration, there is some of that in Apple Pay -- it supports my local supermarket and drug store (Wegman's and Walgreen's, respectively).
Re:Hands on with Apple Pay Competitor CurrentC by prplhaz4 on Thursday November 05, 2015 @10:26AM (#10513810)
Any chance you can point me to a good demo? I haven't seen a good single-scan loyalty/payment demo for ApplePay yet, and the SamsungPay demo seems to imply it but isn't very clear...
Re:Hands on with Apple Pay Competitor CurrentC by MBCook on Thursday November 05, 2015 @10:48AM (#10513946)
That's new with iOS 9, it wasn't possible when Apple Pay launched.

I wasn't aware anyone was using it yet. That's neat.

Re:Hands on with Apple Pay Competitor CurrentC by gergles on Thursday November 05, 2015 @10:11AM (#10513703)
The checking account number listed in the screenshot is also printed on the receipt, so they don't appear to be tokenizing from a casual inspection.
Re:Hands on with Apple Pay Competitor CurrentC by prplhaz4 on Thursday November 05, 2015 @10:22AM (#10513772)
I have worked with APIs in the past that would only make masked account numbers or last 4 digits available.

Stripe is a great example - after the initial card is created, everything is tokenized, and they only allow you to pull the last 4 digits as an identifier.

Re:Hands on with Apple Pay Competitor CurrentC by jszumski on Thursday November 05, 2015 @11:39AM (#10514294)
Even if the transaction itself is tokenized, CurrentC controls the metadata and can allow MCX retailers access to that database after the fact. Apple on the other hand doesn't offer that type of access to anyone outside the company (if they store it at all).
Re:Hands on with Apple Pay Competitor CurrentC by prplhaz4 on Thursday November 05, 2015 @04:23PM (#10516202)
More secure payment systems like CurrentC also employ tokenization to enhance user privacy and security throughout the payment process. This means that merchants are never given an actual bank account number, instead they are given a one-time use token that can be redeemed by a payment processor as if it was a valid bank account number.