upvote
Importantly, this provides a degree of protection from compromised PoS terminals. Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges, whereas back when I was still tapping, inserting, or swiping my card I’d need to call and get a card or two replaced almost every year.
reply
> Ever since I switched to nearly exclusively using Apple Pay for physical shopping I’ve had no unauthorized charges

BIN attacks [1] are still a thing. Your banks are probably just better at blocking them.

[1] https://stripe.com/en-sg/resources/more/what-are-bin-attacks...

reply
Inserting and tapping is just as safe.

Swiping is where the risk is.

reply
I’m not super familiar with the implementation details but wouldn’t inserting not be as safe since there’s a physical connection?

With tapping I could see how that is more secure but if they’re still providing the card details versus the secure token or something well… maybe it’s not?

reply
Inserting and tapping is mostly the same process, apart from the physical layer of the protocol (NFC vs interfacing the chip directly).

Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.

reply
> Unless there’s a hidden magnetic reader in the chip-reading portion of the terminal, in which case the scammers could read like 1/3 of the magstripe data? Which doesn’t seem that useful tbh.

At least around where I am (Ohio, USA), at gas pumps and ATMs: Inserting the card for contact EMV typically means inserting the whole card.

In doing so, entire card is pushed all the way into the same slot that is also used for reading the magstripe, and to the same depth that is used for magstripe transactions.

This quality leaves the door open for magstripe skimming.

(It may be a stupid way of building things, but things exist in the real world that are built this way anyhow. Whether the information on the mag stripe still has any utility for a would-be thief in 2026 is a different matter.)

reply
The credit cards, I believe, have pledged to eliminate magnetic stripes. Although given how long it takes us to do anything for all I know that will be by 2060. They are also planning to extend credit cards past 16 digits, which may also require the magstripe to go away.
reply
Physical connection doesn't matter. This isn't a Hollywood movie, there isn't some mega-virus which magically seizes controls of trivial objects by passing through a connector.

All three modern technologies ("original" Chip & PIN, wireless or a phone) are basically the EMV protocol, which is a fairly crap protocol which wasn't reviewed by experts before deployment - but is at least designed by people who have heard about cryptographic security and wanted to do that.

The original credit cards are just numbers written on a card. Clerk sees your number, memorizes it, now they can make arbitrary transactions indistinguishable from yours. Basically no security.

Magnetic stripe cards look more sophisticated but the stripe is basically the same numbers again but in a way humans cannot read. "Cloning" is just a matter of a machine copying those numbers onto another card's magnetic stripe. There's no real security improvement, though it is more convenient for the bank...

EMV ("Chip and PIN") is rather more complicated and could in principle be entirely secure - they could make it implausibly expensive to "clone" an EMV card, and require that you actually know your PIN for every transaction, so then crooks would need to learn your PIN and have the actual card, and that's a high bar.

In practice we didn't do much of that because it would be inconvenient, and so there are technical deficiencies, but realistically that XKCD "wrench" thing applies. Difficult technological attacks rarely happen, crooks threaten to stab you if you don't co-operate or they break into your home and steal your stuff, they do not come up with breakthrough cryptanalytic attacks on protocols. Mostly.

reply
There are two forms of wireless. The first was “magstripe emulation” and it’s exactly what you think it is. The card would hand over the exact data on the magstripe.

It’s also exactly as secure as you think: it’s not.

That hasn’t been used for a long time, and I don’t even think people accept it anymore. May not have for years. At least for credit cards. It’s quite possible that’s still how door access cards or maybe gym membership cards work. I don’t really know.

Everything now and for many, many many years, has been EMV over NFC. And you’re right on that one it is essentially identical to sticking your card in the EMV reader.

reply
Or (common in the US) handing your card to a restaurant waiter who walks off with it to do the charge
reply
All EMV transactions (including Apple Pay in a tap to pay scenario) don’t give the retailer the full card number.
reply
don’t be silly, apple displays me exact amount on the screen, in plain fucking text, after each transaction - that’s crazy you wrote this
reply
This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.

The wallet app has a way to get the information, but it’s not from the tap itself. The tap interaction is not able to provide this information back to the phone (because the transaction auth happens long after the tap interaction completes).

Taps are designed to work with fully offline devices (which is why you can tap a plastic card, it is powered by the card terminal for the duration of the tap only, and requires no online interaction)

reply
> This information comes from the card issuer directly, after the transaction has completed. It usually requires the mobile banking app to be installed.

except of course it fucking doesn’t, I don’t have Chase or Amex apps on my phone… and yet my transactions are on my phone and watch and in a list inside my “wallet” and probably in the phone settings somewhere as well :)

reply
Man, its amazing how confident you are about this, considering I know individual people who independently work at Visa, Mastercard, AND Apple, who have worked on mobile payments who independently confirm that none of them know any personal info and that its all pass-through.

So, are you sure you know what you are talking about?

reply
This kind of appeal to authority [believe me because I say so!] doesn't really add much information, does it?

The report, above, is that previous transactions are visible within Apple's payment app. Apple agrees[1]. I'm willing to accept that this observation is based on reality and that it is reported in good faith.

Meanwhile, the suggestion is that Apple has no knowledge of transaction history.

Is there a way in which these two seemingly-conflicting concepts can be constructively combined into an understandable whole?

[1]: https://support.apple.com/en-us/104954

(For my part, I've never used Apple Pay and it's possible that I never will. I do not have a dog in this race.)

reply
This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?

Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.

reply
> This is baffling, there's all sorts of information on my phone that Apple has zero knowledge of, why would the transactions be different?

It's kind of unique. It involves finances, and reporting transactions, and it involves their app with their branding that runs on hardware that they unilaterally control. They apparently even take cut from the middle of each of these transaction.

If Apple does all of this with zero knowledge, then I am willing to accept accept that...

> Do you think Apple has complete copies of everything? I don't understand where this supposed contradiction is supposed to exist, unless you think that Apple has complete knowledge of all phone contents, which would require complete ignorance of the entire platform.

...but I'll only accept it if the functional operation can be explained.

This kind of non-explanatory browbeating doesn't further my understanding of anything at all. I have never endeavored to undertake a faith-based approach to understanding technology, and I'm certainly not going to begin doing so today.

reply
people will people :-)
reply