Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

231–240 of 360 posts

Re: Japan facing credit card number shortage

#231

Post by franga2000 »

Gwypaas wrote: post #219
franga2000 wrote: post #204

Earlier quoted context omitted.

Except that 3D Secure is opt-in by the merchant. All you need to do is find a web store that is more than 2 years old and you can use stolen/skimmed cards all day long.

My primary card declines all non 3D Secure internet purchases unless I click the scary sounding "Open card to all internet purchases for 60 minutes" button in the bank app.

That's brilliant! May I ask where you're from? Our national processor was one of the first to implement 3D Secure but none of the banks I know about offer that kind of protection (even on my company card).

Re: Japan facing credit card number shortage

#232

Post by bartvk »

mcv wrote: post #229
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

The prevalence of credit cards has baffled me for decades now. I admit I have one, but the only thing I need it for is to buy things from webshops that don't cater to the Dutch market. Every webshop that's vaguely aware of the Dutch market supports iDeal, which is specifically designed to handle internet payment and doesn't involve sharing any sensitive information with merchants or other unknown parties; my bank han…

The Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.

Re: Japan facing credit card number shortage

#233

Post by franga2000 »

rtpg wrote: post #221
franga2000 wrote: post #211

Earlier quoted context omitted.

That's how it works for all credit card fraud. But do they treat 3D Secure transactions any differently?

Yes, 3D secure leads to a different liability layout. Stores that don't implement it face liability on chargeback, whereas stores that do use it are protected, and the banks themselves take liability. At least that's my understanding of it, might not be that clearcut.

Oh wow, now I'm even more amazed that more stores don't support it. I guess chargebacks aren't common enough to be worth paying a dev to upgrade their systems...

Re: Japan facing credit card number shortage

#234

Post by galoisgirl »

warkdarrior wrote: post #200
TwoBit wrote: post #139

Earlier quoted context omitted.

19 instead of 16? That's better but seems too little for the long run.

2^59 numbers not enough for you? That's 2^25 card numbers per person in the world (assuming 2^34 persons).

So how do you explain the shortage with 2^15 numbers per person?

Re: Japan facing credit card number shortage

#235

Post by Aerroon »

CameronNemo wrote: post #205
michannne wrote: post #107

Earlier quoted context omitted.

At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards

> And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? Why not allow plugging the card into the computer just like a yubikey for online payments? It would be quite difficult to pull off, but credit card companies can save a lot on fraudulent transactions if it is implemented.

In Estonia the government issued ID works like that. This allows you to log in to your bank too. Although you do need your PIN codes on top of the card.

Re: Japan facing credit card number shortage

#236

Post by lmm »

sydd wrote: post #92
gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

Credit card numbers can be easily generated, there are tons of generators online. The right solution is not to have a number that you give out to random people who then gain access to your money. Also the righ way is not to trust the few giant credit card corporations to move all the money in the world The right way (EU is introducing it) is that you get a payment request that you can paste into your bank app and the…

It's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.

Re: Japan facing credit card number shortage

#237

Post by lmilcin »

donor20 wrote: post #179
lmilcin wrote: post #54

Earlier quoted context omitted.

This story is ridiculous for another reasons. I worked for card payment (implemented credit card terminal application, internalized couple thousand pages of requirements). Credit card numbers are assigned by payment organizations in the form of prefixes (BINs -- https://binlist.net/ , https://www.bindb.com/bin-list.html ) The worst that will happen is that Visa/Mastercard will issue more BINs to those organizations.…

Exactly, but the idea that with a billion numbers to issue they can't get 100 million folks into the structure - that's also silly.

Not really that silly. For example, IPv4 address space was initially mostly partitioned in huge blocks to couple institutions and companies without regard for the future.

The difference is that Credit Card numbers are much easier to manage. The routing tables for Credit Cards are distributed by Visa/Mastercard to acquirers in the form of BIN files and it is extremely easy to add arbitrary mapping. So if someone gets an unnecessarily large prefix like "1" then the next day you can change it easily to ten prefixes "10", "11", "12" and so on and have a different organization for each.

Re: Japan facing credit card number shortage

#238

Post by bartvanH »

bartvk wrote: post #232
mcv wrote: post #229

Earlier quoted context omitted.

The prevalence of credit cards has baffled me for decades now. I admit I have one, but the only thing I need it for is to buy things from webshops that don't cater to the Dutch market. Every webshop that's vaguely aware of the Dutch market supports iDeal, which is specifically designed to handle internet payment and doesn't involve sharing any sensitive information with merchants or other unknown parties; my bank han…

The Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.

Yes, because the banks are not the ones who should be protecting the consumer. There are consumer protection laws in place to do the same thing the credit card companies seem to take care of from my POV :)

Re: Japan facing credit card number shortage

#239

Post by hnarn »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

This is not strictly true in all parts of the world. While this is the “default” way a credit card works, in my country chips and additional two part authentication has been mandatory for many years. Any transaction over a certain amount has to be verified via OTP (often over SMS) or other authentication software.

Re: Japan facing credit card number shortage

#240

Post by GoblinSlayer »

remote_phone wrote: post #113
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Why on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fra…

>Any fraud is their liability.

If you don't keep your card safe, it's your liability, just like with passwords. Read the manual.

Post reply on HN