Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

121–130 of 360 posts

Re: Japan facing credit card number shortage

#121

Post by ericlewis »

michannne wrote: post #107
ReactiveJelly wrote: post #106

Earlier quoted context omitted.

It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.

At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards

Skimmers.

Re: Japan facing credit card number shortage

#122

Post by owenversteeg »

Semi-off-topic, but does anyone know about the "churning" culture in Japan vs the US? What are the numbers? Here in the US you can generally expect sign up bonuses of a few hundred dollars, and a return of around 2% on your transactions, with category bonuses up to 5%. What do people get in Japan? I've just Googled it, and apparently some cards get 1 mile per 100 JPY (approximately 1%) - do some get more than that? What about sign up bonuses?

To give the European perspective, there's much less "churning", available, partly because of laws that limit transaction fees. Sign up bonuses are usually around $50-$150, and many cards have no benefits _and_ an annual fee. Cashback, if you do get it, is usually 1% or less, with exceptions going up to 1.5% or so.

Re: Japan facing credit card number shortage

#123

Post by nip180 »

remote_phone wrote: post #113
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…

Fraud results in higher prices for consumers through higher prices and credit card interest/fees.

Re: Japan facing credit card number shortage

#124

Post by thewebcount »

sgjohnson wrote: post #115
viraptor wrote: post #15

Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…

I've got a Diners Club card and it's 14 digits. I've never seen a Diners Club card that's got more than 14.

Doesn't AmEx own Diner's Club? If so, their CCV is usually 4 digits instead of 3. So the number becomes the 14 on the front of the card plus the 4 of the CCV for 18 total.

Re: Japan facing credit card number shortage

#125

Post by ryanwatkins »

nouveaux wrote: post #114
remote_phone wrote: post #113

Earlier quoted context omitted.

Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…

Fraud liability usually falls on the business. Maybe the credit card companies shoulder the responsibility in some cases but I think its unlikely.

The liability is usually with the card issuer (bank), unless the merchant fails to meet liability shift requirements - like processes a card via the manually entered numbers or magstripe, rather than the chip in the card if the terminal supports it.

This the way card networks have encouraged migration to systems that support tokens and cryptograms to limit fraud.

See https://www.creditcards.com/credit-card-news/understanding-e...

Re: Japan facing credit card number shortage

#127

Post by bleepblorp »

AmericanChopper wrote: post #108
devy wrote: post #101

Earlier quoted context omitted.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…

I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents.

Obviously, using government-controlled PKI for communications would be unwise, but there's very little risk to using government PKI for financial transactions as governments already have warrantless access to this data.

Re: Japan facing credit card number shortage

#128

Post by sgjohnson »

donor20 wrote: post #30

This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of stru…

No bank does addressing like that.

Amex for example have got only 6 digits per prefix. 15 digit card number, 6 digit BIN, 7 digit account number, 1 digit representing which card it is (1 for the first, and it gets bumped up with any replacements), and 2 digits for the position on account, allowing you to have 99 supplementary cards on account that can then be identified.

Obviously this is just Amex and it's an absolute non issue for them seeing that they own the entire 37 and 34 range, but I can assure you that virtually no financial institution actually use all of the 9 digits like that.

Re: Japan facing credit card number shortage

#129

Post by shultays »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

You can scrap off the security code and if your card gets stolen you can always cancel it and get refund
Post reply on HN