Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

321–330 of 360 posts

Re: Japan facing credit card number shortage

#321

Post by avianlyric »

GoblinSlayer wrote: post #286
avianlyric wrote: post #267

Earlier quoted context omitted.

That isn’t true. Most banks don’t support the updating services that exist. These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards. If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too. The CVV isn’t stored by the merchant or their processor, and is only u…

Well, if bank ignores everything and just throws your money out, ask the regulator to revoke the bank's license.

In most countries as a customer you’re not liable for fraud that occurs as a result of your banks failures.

In the EU this sort of behaviour is now heavily frowned upon, and with the slow roll out of Strong Customer Authentication will become unacceptable. With banks needing to prove that they’re compliant.

As for the rest of the world, regulators don’t always act with the interest of customer in mind. The US has a few notable examples of regulators protecting companies rather than consumers.

Re: Japan facing credit card number shortage

#322

Post by GoblinSlayer »

saas_sam wrote: post #3
gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

What if they switched CC numbers TO IPV6 addresses? Insane or genius?

Or implement NAT: make cards share the number, but identify them by their public keys.

Re: Japan facing credit card number shortage

#323

Post by GoblinSlayer »

spiznnx wrote: post #156
BelleOfTheBall wrote: post #11

Earlier quoted context omitted.

I assume that it could work as a temporary solution but the article hints that this problem will likely become global soon. So, instead of moving numbers, it's easier to add some and increase the possible combinations.

I think it's better (for Japan) to force it into a global problem than a domestic problem. Then more people will care about fixing it and the issuers will retain international interoperability.

No, let's first see how Japan fixes it.

Re: Japan facing credit card number shortage

#324

Post by rimliu »

franga2000 wrote: post #244
lukebennett wrote: post #242

Earlier quoted context omitted.

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit). Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...

My bank never used SMS as 2FA. They supported mobile signature for… I do not even remember how long, at least 11 years now. TOTP was supported even before that and is phased out in favour of https://www.smart-id.com/

Re: Japan facing credit card number shortage

#325

Post by GoblinSlayer »

henearkr wrote: post #20
pcurve wrote: post #14

SUrely, there's some inefficiency in how numbers are used... 10 quadrillion for 7.5 billion people isn't enough?

The first digits are a header identifying the type of the card, (visa, mastercard...) and probably other characteristics. The main problem is that in Japan everybody has like 5 credit cards, because every big company has its own financial branch and issues cards (maybe to profit from a "reservoir" effect of the accounts?). So you have a credit card linked to your clothes shop, one from your supermarket, one from Raku…

FWIW there are multipurpose cards that can store keys for several systems and even implement domain restriction.

Re: Japan facing credit card number shortage

#326

Post by segmondy »

quelltext wrote: post #157
segmondy wrote: post #73

Earlier quoted context omitted.

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.

This is a simple issue to solve if you have all the issuers in line/on the same page. Issuers simply need tabs on this. This means, a) they only allow this for merchants that have had previous transactions. b) They reset this when a card is reused (owner of the number changes). Ultimately you just need a system that turns on stricter checks when reuse-induced issues are likely. Once a card is reused the issuer simply…

It's never a simple issue to get all banks to update their systems. It will take decades!

Re: Japan facing credit card number shortage

#327

Post by GoblinSlayer »

franga2000 wrote: post #244
lukebennett wrote: post #242

Earlier quoted context omitted.

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit). Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...

My bank once gave me a one time pad :)

Re: Japan facing credit card number shortage

#328

Post by Tijdreiziger »

mcv wrote: post #311
nottorp wrote: post #251

Earlier quoted context omitted.

That's nice... as long as you only buy stuff from your country.

Steam supports it, as do the big local webshops, like Bol and Cool Blue. (No idea if Amazon does; I haven't checked there in ages. I don't think Amazon.com ever did.) Smaller specialty game webshops sadly don't.

Amazon.nl and .de support it.

Re: Japan facing credit card number shortage

#329

Post by tialaramex »

franga2000 wrote: post #299
tialaramex wrote: post #281

Earlier quoted context omitted.

TOTP can be phished (there is even ready to use proof of concept software for building a TOTP phishing site), so it's a pretty poor choice. https://breakdev.org/evilginx-2-next-generation-of-phishing-... Instead banks should use WebAuthn. WebAuthn's credentials are directly bound to the DNS name. So anything that involves fooling the human like a phishing site can't work. The only site your authenticator can give the…

SMS 2FA can also be phished, so TOTP would still be better and WebAuthn is such a complete paradigm shift that it would take many years for banks to implement it. TOTP is so stupidly simple they could roll it out in a month, audits and all. Not to mention that in order to have a decent WebAuthn experience, you need a Yubikey with NFC, which go for 30-60$ if I remember correctly. Cost of authenticators is why everyone…

WebAuthn for relying parties (what the bank is in this scenario) just isn't very hard. And you don't end up with any long term secrets at all, so that makes the security story easier. But I sadly do not expect banks to adopt it anyway.

I don't see what a Yubikey with NFC is getting you here. For a laptop/desktop user any of the Security Key products in an appropriate USB form factor (USB C for some newer laptops otherwise USB A) would be suitable.

The high end phones are or in the case of the iPhone very shortly will be WebAuthn platform authenticators, there's nothing extra to buy. Apple released a video of the pleasant UX journey they want to promote, obviously being Apple it doesn't actually say this would work on non-Apple devices but I use it already so I know it does.

Re: Japan facing credit card number shortage

#330

Post by tW4r »

corty wrote: post #285
pteraspidomorph wrote: post #169

Earlier quoted context omitted.

That system is already in place in several european countries. https://en.wikipedia.org/wiki/National_identity_cards_in_the...

With lots of BS like EIDAS remote "signatures". I wouldn't necessarily trust this for anything important.

What are the downsides of EIDAS? They’re widely accepted and used in my home country and I personally have a great experience, although I wish there was a way I could generate my own private key and or at least acquire it so I could script my own solutions rather than depending on third party providers
Post reply on HN