Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

181–190 of 360 posts

Re: Japan facing credit card number shortage

#181

Post by donor20 »

x87678r wrote: post #40
donor20 wrote: post #30

This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of stru…

The sixteen digits are shared globally. Japan would only get a fraction, the size I'm not sure.

16 digits is a thousand trillion. That's 1.2 million numbers PER PERSON in the global world. This is two few for 5 credit cards in your wallet?

Come ON! STOP with these clickbait / alarmist headlines.

Re: Japan facing credit card number shortage

#182

Post by phantom784 »

segmondy wrote: post #73
gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.

That's done with a credit card updating service - not by just ignoring the CVV/expiration.

If the same number were reassigned to someone else, the subscription wouldn't transfer.

Re: Japan facing credit card number shortage

#183

Post by tialaramex »

AmericanChopper wrote: post #108
devy wrote: post #101

Earlier quoted context omitted.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

The problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in prac…

I'm guessing "the CA system" refers to the Web PKI†. Any Public Key Infrastructure has a Certificate Authority role, so attempting to distinguish the Web PKI by the existence of this role makes no sense.

This also makes your next sentence nonsense, anyone advocating for PKI is advocating for a technology that has trusted authorities, that's how it works, it's as though you claimed computer evangelists don't like mathematics because it uses symbol manipulation.

And then it makes your next sentence nonsense, something like Signal isn't a PKI, it has no CA role, who "Janet" is on Signal is only a matter for you and Janet. Signal also isn't purely TOFU, you can insist on manually verifying every identity just as you can on SSH.

But even though I believe the Web PKI is the only successful public PKI there are plenty of other PKIs in use that are successful in a narrower sphere, and we're already in a discussion thread about such a sphere, the global banking system.

† The Web PKI isn't strictly just a PKI for the World Wide Web, it's actually a PKI for TLS services on the Public Internet. But it exists only because Netscape built SSL, and in practice its oversight is from the major browser vendors (most notably Mozilla but of course also Microsoft, Apple and Google). There was once a good chance the only TLS client implementation you had with any useful PKI enforcement was your web browser, today it's likely other tools on your system also do this... but always relying on the Web PKI.

Re: Japan facing credit card number shortage

#184

Post by kalleboo »

viraptor wrote: post #29
henearkr wrote: post #20

Earlier quoted context omitted.

The first digits are a header identifying the type of the card, (visa, mastercard...) and probably other characteristics. The main problem is that in Japan everybody has like 5 credit cards, because every big company has its own financial branch and issues cards (maybe to profit from a "reservoir" effect of the accounts?). So you have a credit card linked to your clothes shop, one from your supermarket, one from Raku…

"everyone" may be a bit extreme. There seems to be a national goal of going more cashless, but right now they're one of the most cash-based countries: https://www.statista.com/chart/19868/share-of-cash-payments-... Japan had 82% cash transactions compared to 14% in South Korea. From personal experience it's relatively normal to find a food place in Tokyo which has no card reader at all.

Everyone has a bunch of cards, they just don't use them.

We have a credit card for a mall, only for the free parking at said mall. We never actually pay anything with it, only scan it in the parking garage.

That said, cashless transactions have gone way up in the past year though, though the introduction of PayPay QR code payments (which means that waaay more small mom&pop stores accept a cashless payment system since adopting it is basically free), the government 2-%5% cashback cashless incentive that ended earlier this year, and the coronavirus.

It will be interesting to see the new cashless usage numbers next year.

Re: Japan facing credit card number shortage

#185

Post by hrktb »

rswail wrote: post #176
segmondy wrote: post #68

Earlier quoted context omitted.

Your comment is ridiculous. The number has structure, you don't get random IP addresses if you're a company. You get a block, likewise card issuers get a block (BIN - Bank Identifier Number) then add in the checksum, that definitely means you can't just assign random number. Imagine you have a random number. Visa get's the number and a charge for $20. Who owns it? They now have to search through all possible issued c…

What the OP said was that even with a 6 digit BIN and 1 digit check, you have 9 digits available per BIN. For example, Mastercards start in the range 51 to 55. That leaves 4 digits of the 6 digit BIN to allocate to MC issuers. So that's a total of 50K issuers of MC world wide, then each of those issuers can have 1 billion cards. So each issuer of a MC in Japan can issue a card to each member of the population and onl…

> an eight of their allocated range

Assuming your calculations are correct, this means an issuer can only emit 8 cards in average to the total population.

Cards have an expiration, people lose them, break them, they change and come back to banks. For the main issuers it’s not ridiculous to have to issue 20 or 30 cards per account to a user in their lifetime.

Then people have multiple accounts (e.g. my mortgage was on a separate join account).

There’s just enough normal circumstances to run out of numbers, not even considering freak cases.

Re: Japan facing credit card number shortage

#186

Post by Hamuko »

hrktb wrote: post #180
ViViDboarder wrote: post #170

Earlier quoted context omitted.

How does that chip work online? As far as I know, CCs around the world still depend on numbers. For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.

You need a 2FA style confirmation code for online transactions.

Yeah, I actually need to login to my online bank to confirm most of my online Visa transactions (at least for the first time with a particular merchant).

Re: Japan facing credit card number shortage

#187

Post by xfer »

ViViDboarder wrote: post #170
i386 wrote: post #151

Earlier quoted context omitted.

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

How does that chip work online? As far as I know, CCs around the world still depend on numbers. For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.

It's called 3D Secure and requires a PIN to verify transaction(typically with SMS), or a security device provided by bank.

Re: Japan facing credit card number shortage

#188

Post by johncolanduoni »

AlphaSite wrote: post #161
i386 wrote: post #151

Earlier quoted context omitted.

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

I think most us cards have chips, but no pins. It’s bizarre.

I used to think the same thing, but it turns out it actually makes sense (at least in the US): the vast majority of credit card fraud is counterfeit cards, not stolen cards. Requiring a chip which can’t be counterfeited from a list of lifted CC numbers (and sometimes track codes) solves most of the problem as far as card present purchases are concerned. That and shifting more liability to merchants if they don’t support chip readers.

Re: Japan facing credit card number shortage

#189

Post by dkersten »

dqv wrote: post #60
Slartie wrote: post #25

Earlier quoted context omitted.

Only slightly more insane than keeping the handy 4x4 format, but extending it from base 10 numbers to base 16, which I would really love to see :D

They would need to EOL over-the-phone payments to do this. People have horrible diction and it's hard to tell the difference between b, c, d, and e when a particularly lazy lipped person says these letters (in addition to non-hex letters like g, p, t, and v). Then they use their own ambiguous phonetic system (b as in ball, c as in call, d as in doll will confuse anyone trying to distinguish between the three). Oh and…

I would be in favour of EOL that insecure mess known as phone payments.

Re: Japan facing credit card number shortage

#190

Post by ahnick »

devy wrote: post #101
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Talk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not frie…

IMHO, Keybase is the best example of a friendly tool for public key cryptography. It's really a shame that Zoom acquired them. I still think their stitching together a secure identity based on the aggregation of people's social media accounts is a great approach. Maybe that idea will be incorporated into other tools eventually.
Post reply on HN