Re:Stripe – Apple Pay
by adamfeldman on Monday October 20, 2014 @03:40PM
(#8484055)
Thanks for clearing that up. Assuming the Secure Enclave has a level of security comparable to the Secure Element, it'd be nice if the payment networks would trust it, but they're so notoriously conservative...and understandably want everyone using the same base tech to keep complexity lower.
I think the bulk of my disappointment is that I upgraded to a 5s anticipating I wouldn't be totally shut out of Apple's (at the time rumored) impending launch of a payments product. Oh well, at least we get TouchID auth for apps.
Re:Stripe – Apple Pay
by sliverstorm on Monday October 20, 2014 @06:20PM
(#8484852)
I upgraded to a 5s anticipating I wouldn't be totally shut out of Apple's impending launch of...
I thought Apple was pretty notoriously bad about this sort of thing?
Re:Stripe – Apple Pay
by wodenokoto on Tuesday October 21, 2014 @01:03AM
(#8485962)
No, they are actually pretty good at this. Probably the best within the mobile phone space.
They're notoriously good about this. If a phone's processor lacks a component necessary to make it function, it will be difficult to compensate for that through software. I'm sure Apple would've loved to get an extra 50m folks using a payment network that they get a cut of, but they couldn't, so buy an iPhone 6 if you want to use it.
The iPhone 5 is fully supported under iOS 8.1, as far as what is technically possible (no touchID, for example).
Find out which flagship Android phones have an official 5.0 ROM and let us know.
There is no support for T-Mobile's Wi-Fi Calling on the iPhone 5, even though its almost identical to the iPhone 5C.
'"Cards" in the java-card-OS are cryptographically "personalized" by the payment network (VISA, AMEX, MasterCard) with per-device keys and the device personal account number (DPAN)--the tokenized device only credit card.'
Is this 'tokenized device only credit card' the same concept as the Point-of-Sale seeing a unique CC # (generated) for the transaction? (What I believe is one of the selling points for Apple Pay). Are there other products that do this?
Re:Stripe – Apple Pay
by matthewarkin on Monday October 20, 2014 @07:18PM
(#8485072)
According to the email I got from American Express, the POS will see the DPAN. So every POS transaction would see the same unique card number.
Just to add to this, there is a body that covers "secure chip" technology: GlobalPlatform[1].
The SEP is a ARM TrustZone-like separate processor running a stripped down L4 derived microkernel. This manages encryption keys, the secure boot-loader and OS update signing.
The Apple Pay Secure Element is a separate chip which runs a Java-Card-OS. "Cards" in the java-card-OS are cryptographically "personalized" by the payment network (VISA, AMEX, MasterCard) with per-device keys and the device personal account number (DPAN)--the tokenized device only credit card.
This is the same java-card + payment network personalization that physical chip-and-pin cards, Google Wallet and most other NFC payments use.
So my guess is that the Payment Networks were not comfortable using the Secure Enclave Processor and preferred to reuse the same technology used by chip-and-pin, with a separate Secure Element chip.
Source: https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20...