141–150 of 360 posts
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of stru…
> You can't get 125 million folks into this address space? I think some people are now using a new card number per transaction , with these disposable card numbers, aren't they?
Earlier quoted context omitted.
It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.
Virtually every country other than the United States uses a cryptographic NFC and/or chip and pin system for in-person credit/debit transactions. In most countries, the card number is only used for online and phone transactions. There's probably no way to do better than this without abandoning cards entirely in favor of some kind of device (or app) that has enough of a user interface to do a human-readable challenge…
we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can use 3dsecure, which has a pin.
processing a transaction doesn't mean your money's gone. you can dispute any fraud charge for 2 months. so the pin doesn't do anything. and for bank accounts, where it's debit, and your cash is immediately taken out, we've had a pin since before europe had an atm card.
Earlier quoted context omitted.
Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…
One thing we’ve been able to leverage with cryptocurrency is that the “wallets“ have standardized some public-private key cryptography. So some aspects of our products dont “need a blockchain for this” but the proliferation of standardized signing tools and size of the niche has made it extremely viable to cater to that market. PGP had 30 years to get anywhere , and all we have are some pretty bad, cumbersome busines…
Earlier quoted context omitted.
Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…
> Right now all of the burden is on the credit card companies. Any fraud is their liability. Tell that to retailers who lose a gazillion dollars to fraud reversals every year.
so a system that prevents them losing a gazillion dollars is available, and they opt to instead lose the gazillion dollars. it's their fault, and they should lose that money. we don't need to tell them anything -we just need to point and laugh.
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…
Earlier quoted context omitted.
The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…
I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…
Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…
We still have a long way to go--my friend's bank called him up to say that his six-digit bank PIN was "too long" and that he should change it to four digits "for security".
>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…
What if they switched CC numbers TO IPV6 addresses? Insane or genius?