Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

131–140 of 360 posts

Re: Japan facing credit card number shortage

#131

Post by sgjohnson »

sitharus wrote: post #23
rootusrootus wrote: post #17

I wonder how this became a problem. Your CC number is not just 16 digits long. It's 16, plus expiration, plus the 3-4 extra security digits, plus your name, plus your zip code. That's quite a lot of entropy.

That's not true. The number is just the number, though it can be more than 16 digits. The initial six digits identify the card issuer. Expiration and CVC/CCV are security checks, but only work in combination with the number. Name is generally not verified, though is often used in fraud assessment. Address verification is uncommon, and almost unused outside the US.

> Address verification is uncommon, and almost unused outside the US.

Billing address verification is extensively used in the UK.

Re: Japan facing credit card number shortage

#132

Post by TheSpiceIsLife »

devy wrote: post #101
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

It does not have to be perfect, just better than existing payment card numbers, for that specific use case anyway.

And also just as simple to use.

Re: Japan facing credit card number shortage

#133

Post by sgjohnson »

thewebcount wrote: post #124
sgjohnson wrote: post #115

Earlier quoted context omitted.

I've got a Diners Club card and it's 14 digits. I've never seen a Diners Club card that's got more than 14.

Doesn't AmEx own Diner's Club? If so, their CCV is usually 4 digits instead of 3. So the number becomes the 14 on the front of the card plus the 4 of the CCV for 18 total.

No. And CVV has got nothing to do with anything. But yes, Diners Club, like Amex, also has 4 digit CVV codes.

Re: Japan facing credit card number shortage

#134

Post by mauvehaus »

nip180 wrote: post #123
remote_phone wrote: post #113

Earlier quoted context omitted.

Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…

Fraud results in higher prices for consumers through higher prices and credit card interest/fees.

Sure, but this is fundamentally the same deal as insurance: we distribute the cost across the whole population at a constant, low cost rather than ask individuals to take a big hit with low probability.

Unless you can eliminate fraud, those are basically your two choices.

Re: Japan facing credit card number shortage

#135

Post by fanf2 »

AmericanChopper wrote: post #108
devy wrote: post #101

Earlier quoted context omitted.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…

Chip and PIN cards are based on a PKI with the payment networks acting as CAs. Used by millions of people every day. https://www.cryptomathic.com/hubfs/docs/cryptomathic_white_p...

Re: Japan facing credit card number shortage

#136

Post by sgjohnson »

chrisseaton wrote: post #43
donor20 wrote: post #30

This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of stru…

> You can't get 125 million folks into this address space? I think some people are now using a new card number per transaction , with these disposable card numbers, aren't they?

Yes, but in this case you can actually rotate those numbers easily without running into any issues, and on top of that they usually consume just one BIN per service.

Re: Japan facing credit card number shortage

#137

Post by TwoBit »

shultays wrote: post #129
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

You can scrap off the security code and if your card gets stolen you can always cancel it and get refund

Yeah but that's not the primary means of card number theft.

Re: Japan facing credit card number shortage

#138

Post by owenversteeg »

lmm wrote: post #97
jandrese wrote: post #6

Assuming the last digit is a checksum and the first six are taken by the routing information, that leaves them 9 digits or a billion possible numbers per credit card issuer. Japan has a population of about 125 million. Are Japanese people cycling their numbers so frequently? Or are they big on ephemeral card numbers? Is it not possible for an issuer to get a second prefix if they run out of digits? I also wonder if c…

> Assuming the last digit is a checksum and the first six are taken by the routing information, that leaves them 9 digits or a billion possible numbers per credit card issuer. Japan has a population of about 125 million. Are Japanese people cycling their numbers so frequently? Or are they big on ephemeral card numbers? Credit cards - and payment methods generally - are in their Cambrian explosion phase right now in J…

Ah, here's the real explanation! Interesting.

I wonder how big the incentive is, and if anything changed to enable this. As for the incentive, I'd guess they get transaction fees cut from some ~2.75% to 0.5%ish with their own card, and then some kind of additional cash (maybe $50-$300?) from the issuing bank for gaining a customer?

Re: Japan facing credit card number shortage

#139

Post by TwoBit »

viraptor wrote: post #15

Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…

19 instead of 16? That's better but seems too little for the long run.

Re: Japan facing credit card number shortage

#140

Post by vmception »

devy wrote: post #101
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

One thing we’ve been able to leverage with cryptocurrency is that the “wallets“ have standardized some public-private key cryptography.

So some aspects of our products dont “need a blockchain for this” but the proliferation of standardized signing tools and size of the niche has made it extremely viable to cater to that market.

PGP had 30 years to get anywhere, and all we have are some pretty bad, cumbersome businesses releasing poorly integrated signing software on modern OS’ that even privacy advocates can barely tolerate for their email and other messages. People want to try to say the same thing about cryptocurrency over half of a decade or a whole decade but they’ll just have to wait for the Ivy league business school case studies to start coming out about the rest of us that have already figured this out for business.

Turns out changing consumer behavior isn’t hard when there are economic incentives to do so that benefit the consumer.

Post reply on HN