Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

281–290 of 360 posts

Re: Japan facing credit card number shortage

#281

Post by tialaramex »

franga2000 wrote: post #244
lukebennett wrote: post #242

Earlier quoted context omitted.

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit). Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...

TOTP can be phished (there is even ready to use proof of concept software for building a TOTP phishing site), so it's a pretty poor choice.

https://breakdev.org/evilginx-2-next-generation-of-phishing-...

Instead banks should use WebAuthn. WebAuthn's credentials are directly bound to the DNS name. So anything that involves fooling the human like a phishing site can't work. The only site your authenticator can give the real-bank.example credentials to is... real-bank.example.

Re: Japan facing credit card number shortage

#282

Post by swebs »

i386 wrote: post #151
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

I believe you can make transactions up to 50 euros with the magnetic strip.

Re: Japan facing credit card number shortage

#283

Post by gooseberry »

GoblinSlayer wrote: post #217
boomlinde wrote: post #210

Earlier quoted context omitted.

> Try giving a user a private key for making CNP transactions, I have that! > and all you will have achieved is replicating the user experience of bitcoin. I've never used bitcoin or any other cryptocurrency. What's the user experience like?

You just have the target wallet address and the "send" button, zero bullshit, like paper money.

> zero bullshit

lol

Re: Japan facing credit card number shortage

#284

Post by mrjin »

snuxoll wrote: post #38
viraptor wrote: post #15

Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…

I’ve run into multiple issues already with poorly designed forms on sites that claim to accept Amex that freak out when I enter my 15-digit card number, I would love to see the mess that adding longer numbers would cause.

LOL, I guess their payment processor might be able to handle AMEX but they have no idea that some cards can be 15 digits or 19 digits so... Anyway, that seems to be reasonable some how. You guess what, I encountered some POS machines allow only 5(i typed it right, it's 5, not 4, not 6 or 8) digits of pin and unfortunately, my bank requires 6...

Re: Japan facing credit card number shortage

#285

Post by corty »

pteraspidomorph wrote: post #169
bleepblorp wrote: post #127

Earlier quoted context omitted.

I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…

That system is already in place in several european countries. https://en.wikipedia.org/wiki/National_identity_cards_in_the...

With lots of BS like EIDAS remote "signatures". I wouldn't necessarily trust this for anything important.

Re: Japan facing credit card number shortage

#286

Post by GoblinSlayer »

avianlyric wrote: post #267
phantom784 wrote: post #182

Earlier quoted context omitted.

That's done with a credit card updating service - not by just ignoring the CVV/expiration. If the same number were reassigned to someone else, the subscription wouldn't transfer.

That isn’t true. Most banks don’t support the updating services that exist. These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards. If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too. The CVV isn’t stored by the merchant or their processor, and is only u…

Well, if bank ignores everything and just throws your money out, ask the regulator to revoke the bank's license.

Re: Japan facing credit card number shortage

#287

Post by JshWright »

Broken_Hippo wrote: post #241
alkonaut wrote: post #226

Earlier quoted context omitted.

I was shocked to hear that my mastercard which I always use with CVC and 2FA or PIN actually works like a normal third world mastercard in some places. So while the security problem is kind of solved where I live, if someone stole my CC details they can still skim my card! Obviously I can block it for all transactions abroad but that doesn't seem like the best idea either. The only working solution is to generate tem…

Isn't that a feature to make sure you can use it when you travel? Not everywhere supports chip and pin, do they? Has it ever been rolled out in the US, for example - or is 2FA something everyone can get? (I know it wasn't generally a thing before I moved).

Chips are widespread in the US (as well as contactless). US banks don't bother with PINs, but most of the PoS systems deployed to deal with chips can support PINs if the card requires it.

Re: Japan facing credit card number shortage

#288

Post by nikanj »

gruez wrote: post #2

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least…

Also ivp4 in the sense that they have 16 digits, but have reserved 6 for card type and similar minutia. If they used all 16 digits, they'd have billions and billions of numbers available.

Re: Japan facing credit card number shortage

#289

Post by xlii »

labster wrote: post #67
dqv wrote: post #60

Earlier quoted context omitted.

They would need to EOL over-the-phone payments to do this. People have horrible diction and it's hard to tell the difference between b, c, d, and e when a particularly lazy lipped person says these letters (in addition to non-hex letters like g, p, t, and v). Then they use their own ambiguous phonetic system (b as in ball, c as in call, d as in doll will confuse anyone trying to distinguish between the three). Oh and…

Why don’t we teach schoolchildren the NATO phonetic alphabet? Seems like it wouldn’t take that long, and it would be a useful skill for their whole life.

In English speaking countries, sure - why not.

But it'd take at least 3 generation to use in non-english speaking country since in different languages same letters might be pronounced vastly different. Then you have immigrants and foreigners who might now know this alphabet so clerks would still be able to recognize ad-hoc and NATO alphabet. In the end, it would extend requirements while not providing universal benefit.

Re: Japan facing credit card number shortage

#290

Post by pxtail »

seppel wrote: post #254
xfer wrote: post #187

Earlier quoted context omitted.

It's called 3D Secure and requires a PIN to verify transaction(typically with SMS), or a security device provided by bank.

And its super annoying. I bail out when I'm asked to do that.

It may be annoying if one is not used to take care about own transactions safety and is willing to shift this responsibility to some other entity - of course this convenience has a cost.
Post reply on HN