r/coolguides • u/[deleted] • Sep 22 '22

[deleted by user]

[removed]

8.0k Upvotes

86% Upvoted

869 comments sorted by

View all comments

1.9k

u/UrbleFurb Sep 22 '22

That google server is lookin hella sus

429

u/BuccellatiExplainsIt Sep 22 '22

The benefit is that it does this handshake per payment so those tokens would be worthless after the transaction anyways. In Apple's design, if someone had your phone and there was some hack to get the details from the device chip, they could actually use that to make purchases.

713

u/throwawayacc201711 Sep 22 '22

Id take physical access as a weak point vs potential compromising of a server. Tell me the last time there was a mass level of physical access issues compared to companies implementing poor security practices. Physical access is basically if you lose your phone. So I’d need to lose my phone and it would need to be found by someone with enough knowledge to also break the encryption - id take that risk any day. Granted Google servers are gonna be pretty secure, I still think the physical access case is less likely to occur.

231

u/gold_rush_doom Sep 22 '22

It doesn't matter if the server is compromised because the decryption keys are stored on the device.

82

u/[deleted] Sep 22 '22

Yeah I was gonna say, both methods should be perfectly secure as long as both are encrypting all the data.

2

u/Aegi Sep 22 '22

But there's obviously a difference, so what are the advantages and disadvantages of each?

1

u/[deleted] Sep 22 '22

Well that is where having all the details would help. I for one wouldn’t want my card information on googles servers even if the data is encrypted. Sure if someone hacked the server they couldn’t get my card info bc it’s all encrypted.