Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

261–270 of 360 posts

Re: Japan facing credit card number shortage

#261

Post by avianlyric »

benrbray wrote: post #118
viraptor wrote: post #15

Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…

We still have a long way to go--my friend's bank called him up to say that his six-digit bank PIN was "too long" and that he should change it to four digits "for security".

Yeah officially the Mastercard and Visa networks support 6 digit PINs.

In reality there are so many POS devices out there that don’t support 6 digits, it actually ends up being safer to use a 4 digit PINs because the 6 digit PIN fallbacks are completely insecure and unreliable.

Re: Japan facing credit card number shortage

#262

Post by michaelt »

boomlinde wrote: post #210
AmericanChopper wrote: post #165

Earlier quoted context omitted.

That only works because it’s hidden from the user, and can only work on highly regulated approved devices. Try giving a user a private key for making CNP transactions, and all you will have achieved is replicating the user experience of bitcoin.

> Try giving a user a private key for making CNP transactions, I have that! > and all you will have achieved is replicating the user experience of bitcoin. I've never used bitcoin or any other cryptocurrency. What's the user experience like?

> I've never used bitcoin or any other cryptocurrency. What's the user experience like?

I would describe the first-time-user onboarding procedure as "complex enough that it's unlikely to become mainstream"

Re: Japan facing credit card number shortage

#263

Post by GoblinSlayer »

alkonaut wrote: post #228
quelltext wrote: post #152

Earlier quoted context omitted.

And then see customers complaining about the annoying extra steps. 3D Secure affects conversion rates adversely which means customers are generally happier without it and don't mind the fraud risk (as is consistent with the rest of this discussion on the thread).

> And then see customers complaining about the annoying extra steps. PIN in stores and 2FA online is already the norm in the developed world. It didn't exactly cause a disaster for retail. There are a few countries where it still isn't completely rolled out (US being the most notable one) but those are now outliers. > customers are generally happier without it Again I think this perspectivve is US centric and not glo…

Will americans even notice it? Alexa already makes all payments on their behalf over the sound. Or was it Siri?

Re: Japan facing credit card number shortage

#264

Post by AdrianB1 »

chrisseaton wrote: post #61
AdrianB1 wrote: post #51

Earlier quoted context omitted.

We are lucky they don't use a disposable IPv4 address per page, that would break the Internet /s.

Not really sure what point you're trying to make, sorry?

Disposable CC numbers (one time use) is a waste of a very limited resource.

Re: Japan facing credit card number shortage

#265

Post by avianlyric »

gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

Many banks don’t properly validate the CVV and expiry date, or only apply fuzzy matching to “improve the customer experience”.

Classic example of this is Tesco bank where they only checked that the expiry date was in the future, not if it actually matched the card.

They also made a number of other insane mistakes, and FCA report does a good job of explaining them [1]

[1] https://www.fca.org.uk/publication/final-notices/tesco-perso...

Re: Japan facing credit card number shortage

#266

Post by Narishma »

Trav5 wrote: post #171
jessriedel wrote: post #84

Earlier quoted context omitted.

As an adult who tries to remember the NATO phonetic alphabet but can't because I only use it once per month, I don't make up words "for fun" or "to be cute". I do it because I can't remember the NATO word. Compared to just saying the letters, the words I choose certainly do reduce ambiguity, even if using the NATO alphabet would go even further.

Same, but once every 2 years. Just email me for goodness sake!

Then you'll have to spell your email address using NATO phonetic alphabet.

Re: Japan facing credit card number shortage

#267

Post by avianlyric »

phantom784 wrote: post #182
segmondy wrote: post #73

Earlier quoted context omitted.

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.

That's done with a credit card updating service - not by just ignoring the CVV/expiration. If the same number were reassigned to someone else, the subscription wouldn't transfer.

That isn’t true. Most banks don’t support the updating services that exist.

These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards.

If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too.

The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.

Re: Japan facing credit card number shortage

#268

Post by mrjin »

AmericanChopper wrote: post #165
fanf2 wrote: post #135

Earlier quoted context omitted.

Chip and PIN cards are based on a PKI with the payment networks acting as CAs. Used by millions of people every day. https://www.cryptomathic.com/hubfs/docs/cryptomathic_white_p...

That only works because it’s hidden from the user, and can only work on highly regulated approved devices. Try giving a user a private key for making CNP transactions, and all you will have achieved is replicating the user experience of bitcoin.

Nah, I guess you've over simplified things. We can take card number/account number as address but again, you will need something to identify yourself to the bank as the genuine account holder and that's exactly where all kinds of sh*ts happens: uid/pwd are neither safe nor convenient; sms/text msg are not much better than uid/pwd; hardware token/csp which is much more secure but trust me, no one really want to go there as there are simply too much environment related quirks.

Re: Japan facing credit card number shortage

#269

Post by otabdeveloper4 »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

> the power to take all our money without our consent

Is this really a thing in the USA?

I feel for you guys.

Re: Japan facing credit card number shortage

#270

Post by iso1210 »

mrjin wrote: post #259
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

Card numbers are there for a reason: transactions without presenting the card, which actually are not a big problem as there are strict rules to follow and if frauds do occur, card holders are backed by charge-back policies. I guess all your concerns should really go to magnetic strip cards as there is virtually no way to tell fake card from genuine cards and that's the reason of EMV/PBOC card migration which just as…

There's far better ways to do it if you can use online - I submit my card number to them, they pass the card number, their account number, and the amount to my provider, I authorise they payment with my provider.

If you're doing it over the phone though things like public key won't really work - to be long enough would make the numbers impossible to read out reliably, let alone the calculation I would need to do with my private key to prove I own it.

Post reply on HN