Hacker Newsnew | past | comments | ask | show | jobs | submit | bret791's commentslogin

Mostly there, you get a tokenized PAN (DPAN) for every card enrollment. Remove, and re-add a card to your digital wallet and you'll get a new DPAN.

The unpredictable number is an (of a few) inputs into the generation of the CVV3, which is also based on a dynamic key from the issuer. Key rotation is on the order of weeks to months (depending on issuer). This is the "unique number" per transaction (part of tag 57 https://emvlab.org/emvtags/show/t57/ )

DPAN is only good for card-present transactions, provided CVV3, transaction counters, etc.


> Remove, and re-add a card to your digital wallet and you'll get a new DPAN.

Has anyone made a habit of rotating DPANs on a regular basis like this? Does Apple or your bank get irritated at some point?


I would avoid doing this. Mastercard guidance (and I assume Visa is the same) is to treat this behaviour as fraudulent.

I once had a very long call trying to explain to a very upset Mastercard person why this behaviour wasn’t an issue. I don’t think they understood.


Mastercard client/user or Mastercard support/staff?


Mastercard staff member responsible for Apply Pay best practices.


I do. Every update of watchOS since version 6 seems to break activity syncing between my watch and phone. So I end up having to restore from backup every time, and thus reset ApplePay.

So far my banks have not complained.


Only possible problem I can think of is that you would trigger some of the fraud rules on Apple’s, network’s or issuer’s side as all theses parties have the ability to trigger yellow or red flows during the token provisioning. You would then probably have to call your issuer for assistance every time you want to provision new card to your device.


I involuntarily do this (annually), when getting a new iPhone every year. My iOS Wallet app resets, and I'm forced re-add all my cards (although it does remember what cards where added previously). Never thought too much about it.


Why would you do this?


So that retailers won't be able to use DPAN to uniquely identify me across transactions.


On the flip side, the ability to look up your past purchases can enable returns without receipts.

The other week a store clerk failed to look up my purchase when using my physical credit card, but succeeded when using the same credit card via Apple Pay. I would have been out of luck if I had rotated my Apple Pay number.


Or perhaps your device could store previous identifiers and offer those to the vendor to lookup in their system? Assuming the vendor isn't doing something shady like building an association table between identifiers, this would preserve your privacy and let you change your identifier as much as you like.


I think there's also a button in settings to get a new card number?


That's an Apple Card thing I believe, not Apple Pay--and it rotates a different card number than the one in your physical Apple Card or device-specific card number. It's the one you're supposed to use on legacy online stores and rotating it is similar to ShopSafe, etc.


Depending on the situation, disabling autopilot is not the correct thing to do. That was identified as a contributing factor in TransAsia 235 https://www.asc.gov.tw/upload/cont_att/9b051632-ebf6-427f-b0...

Through simulations they think a crash would have actually been avoided had autopilot been left on.


I think the bigger issue is the "Round-Up Ready" crops and the fact that they produce sterile seeds.

Using Round-Up ready seeds allows the use of Round-Up for weed control on your fields, but this can have negative affects on neighboring farms. For example on Field A, populated with Round-Up ready seeds, Round Up is used to control the weeds. However this same spray can affect neighboring field B, which is not populated by Round-Up Ready seeds, causing weeds and crop die or reduced yields... So basically if your neighbor is using Round-Up, you need to also, and your neighbor...etc. So now everyone is locked into Round-Up ready seeds they have to buy every year.


> the fact that they produce sterile seeds

An interesting fact, to be sure, since Terminator^TM technology hasn't been used in fields .. ever.

https://en.wikipedia.org/wiki/Genetic_use_restriction_techno...

Also interesting, Terminator was developed (primarily by the USDA) to address environmental concerns about potentially contaminating wild populations with transgenes. But of course, it's Monsanto (not actually, though) so it's evil!

You may be confused about hybrid seed, which is germplasm developed from particular parental lines to produce a unusually vigorous progeny. This 'hybrid vigor' only lasts one generation, though. Hybrid seed has been the rule since about the 1950s, well before transgenes, but don't let that pollute the narrative about GMO killing seed saving!

It's also interesting to mention overspray with regard to RoundUp; one of the major selling points for Glyphosate is that you don't need to apply much, and it doesn't persist long in the soil, both highly beneficial traits for eliminating overspray issues. That's not to say there aren't any concerns with Glyphosate, but as far as herbicides go, it's pretty tame. As a bonus, Glyphosate has enabled a huge rise in no-till agriculture, which is terrific for preserving fragile soils, reducing fossil fuel use, etc.


Round-up Ready crops are not sterile.

Farmers spraying their neighbours' fields could be a problem I guess. But its a problem that would pre-date GMOs. Farmers have been spraying their crops for hundreds of years? (well at least decades)


This has actually been a frequent cause of conflict between farmers for several generations now.


Well looks like you're right, I found a shit source (and believed it based on something I'd heard before... https://monsanto.com/company/media/statements/terminator-see... http://web.mit.edu/demoscience/Monsanto/about.html

It seems the drifting argument is a interpretation on Dicamba issues.. Which could go either way: https://www.agweb.com/article/dicamba-lawsuits-mounting--naa...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: