Hacker News Reader

Comment by gruez | Hacker News Reader

>the company decided to take makeshift measures such as reusing credit card numbers of discontinued cards after a certain period had passed since cardholders canceled their memberships. However, there are considerable risks of fraudulent usage

What are the risks here, and why aren't they already present by someone generating credit card numbers with a RNG? AFAIK credit card transactions are authenticated by at least expiration date and cvv, so there isn't a risk of reusing credit card numbers.

>and a source close to the credit card industry said, "Increasing the number of digits is the only real way to deal with the problem. There will likely be a shift toward increasing the number of digits in the first half of this decade."

ipv6 deployment all over again

View on HN

What if they switched CC numbers TO IPV6 addresses? Insane or genius?

To what end? You want your card to be internet addressable?

Also, I'm not enthusiastic about trying to communicate an IPv6 address over the phone to the wage slave working at the pizza joint. You'd have to implement one of those address-to-word setups, which would make for some amusing card "numbers". How would you like getting a card with "chinky challis uta ablow wiry rehaul a carotin" on the front?

Something like: http://jubei.ceyah.org/cgi-bin/ipv6toenglish

Hopefully they keep the :: shortener in there....

Only slightly more insane than keeping the handy 4x4 format, but extending it from base 10 numbers to base 16, which I would really love to see :D

This is genius. Make this happen fintech.

They would need to EOL over-the-phone payments to do this. People have horrible diction and it's hard to tell the difference between b, c, d, and e when a particularly lazy lipped person says these letters (in addition to non-hex letters like g, p, t, and v). Then they use their own ambiguous phonetic system (b as in ball, c as in call, d as in doll will confuse anyone trying to distinguish between the three). Oh and this compounds on ambiguous sounding digits like 13 and 30; 14 and 40; 15, 16, 50 and 60; 17 and 70; 18 and 80; 19 and 90). It can't be done with DTMF digits anymore either.

All in all not a bad direction to go in. I wouldn't really miss phone payments.

Why don’t we teach schoolchildren the NATO phonetic alphabet? Seems like it wouldn’t take that long, and it would be a useful skill for their whole life.

We should. There are so many adults who think it's cute to make up their own phonetics not realizing the whole purpose is to reduce ambiguity, not make it fun to spell things aloud.

As an adult who tries to remember the NATO phonetic alphabet but can't because I only use it once per month, I don't make up words "for fun" or "to be cute". I do it because I can't remember the NATO word. Compared to just saying the letters, the words I choose certainly do reduce ambiguity, even if using the NATO alphabet would go even further.

This is mostly fine if only done for ambiguous letters and if the understanding is that it is done to reduce ambiguity. There is a contingent of people who painstakingly spell out every letter with a phonetic from their own system and it requires the listener to do a lot more decoding to the point of actually increasing ambiguity. "My name is Michelle that's M/N as in Nail/Mail! I as in Icecream! ..." Nichelle is confused about why we use words to spell out certain letters.

Same, but once every 2 years. Just email me for goodness sake!

Then you'll have to spell your email address using NATO phonetic alphabet.

Some good advice I got from a HAM was to read license plates in your head using the NATO alphabet. Their letters are mostly random so you tend to see each letter at roughly the same frequency and it can be done daily without taking away time from your schedule. Being random also prevents you from just remembering the order of the words and actually associating them with their respective letters.

After doing that for a week or two (I was bike commuting at the time), I had it pretty much memorized.

Dennis Praeger likes to spell his name as: P as pneumatic...

In English speaking countries, sure - why not.

But it'd take at least 3 generation to use in non-english speaking country since in different languages same letters might be pronounced vastly different. Then you have immigrants and foreigners who might now know this alphabet so clerks would still be able to recognize ad-hoc and NATO alphabet. In the end, it would extend requirements while not providing universal benefit.

Brazilian here. There is an equivalent alphabet in Portuguese, with different words for each letter, better adapted to the Portuguese language. It's ubiquitous in the Brazilian armed services.

Phone service is always in a specific language, I don't see why the use of such alphabets would be harder in non-English-speaking countries than in English-speaking ones.

Not every country even uses Latin alphabet. That’s for one. And you wrote “such alphabets” whereas OP specifically named NATO one. If each country would have their own implementation it would be even more effort consuming and wouldn’t solve anything beyond what we already have.

"each country would have their own implementation" would not mean anyone has to serve all countries. Services only available in English today would only need to learn the NATO alphabet to remain fully available in English.

DTMF is actually 16 digits: 1 2 3 A 4 5 6 B 7 8 9 C * 0 # D. While most keypads don't have A B C D buttons, * and # are pretty much everywhere, and easy to distinguish, so adopting base-12 would be relatively easy.

Shhhhhh no more credit cards by phone :)

I would be in favour of EOL that insecure mess known as phone payments.

Many systems here have over-the-phone robots that understand button presses, but yeah, I think they support only decimal digits.

Why stop there? ipv6 license plates, citizen numbers, home addresses, part numbers, atoms, ...

Do we have enough atoms?

Don't worry, if we live in a cyclical model universe we'll eventually get some new ones.

You joke, but that’s exactly what uuid/guid is — 128 bit identifiers. The only difference is that ipv6 is allocated hierarchically.

> What if they switched CC numbers TO IPV6 addresses? Insane or genius?

Depends upon how it is implemented as could go full on 1984 very fast without that ever being intended.

The whole aspect of a static fixed CC number you share with people is what really needs to change. A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank itself.

> A One Time CC per transaction would be more useful and negates many potential issues in a way that protects the customer and in turn the bank itself.

That's what Google pay does. It generates a new credit card number for each transaction that charges the CC you have on your account. It's kind of like a password manager for credit cards.

AFAIK it generates a dynamic CVV. Your credit card number stays the same.

Or just a UUID.

To addresses? Mostly pointless. To a larger number space that had non-numeric representation, genius and probably inevitable.

If we allow for the representation to be 0-9 and then another ten letters selected for uniqueness and clarity, overlapped with appropriate non-roman pictographs, etc, the same 16 characters jumps to 600 quintillion range, or about 60 bits by napkin math.

That's more than realistically enough for hundred billion people to each have millions of real payment IDs with millions more one-time use ones that contained some sort of transaction hash for authorization.

Which conveniently fits in a 64 bit word with some left over. I suspect someone involved in the payment space already figured that out a long time ago, but no cataclysmic event has yet happened to de-rail the existing money train.

If you wanted to do that in IPv6 you'd still have the upper 64 bits left over :)

If you want only identification, you can use a phone number, for some reason there's no problem with those.

Or implement NAT: make cards share the number, but identify them by their public keys.

Credit card numbers can be easily generated, there are tons of generators online.

The right solution is not to have a number that you give out to random people who then gain access to your money. Also the righ way is not to trust the few giant credit card corporations to move all the money in the world

The right way (EU is introducing it) is that you get a payment request that you can paste into your bank app and there authorize it. See SEPA or PSD2

That doesn't sound like a great design from a UX/speed perspective. Is it better than it sounds?

That isn't specific EU regulations. SEPA is both the way payments are cleared and EU rules so works cross boarder. It is the foundation (interbank infra) upon which PSD2 layers a requirement for what amounts to having APIs, and a requirement to make the API open-access, in the sense they can't privilege their own systems over these APIs. They solved (or at least it seems like they might) one of the bigger blockers of building fintech solutions: a level playing ground.

I can't stand it. Amex have implemented Express List to deal with this, and you can automatically add any new sites that you use your card in to the list. It doesn't even automatically trigger 2FA.

It's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.

That's what direct debits (Avtalegiro in Norwegian) are for. Works fine here. I only use my credit cards for buying things in shops or one off things online. And my credit card gets paid by direct debit.

Indeed, and in the Netherlands there is something similar to Avtalegiro as well, since more than 20 years ago. And depending on your bank, they even make it easy to reverse a charge up to three months after it has been made if you don't agree with it.

Direct debits have all of the dangers of credit cards and then some - you have to give out a numeric identifier, and unlike a credit card that number allows pulling directly from your bank account.

How so? Avtalegiro is offered by the creditor via my bank. I click a box to allow it and I can also specify a maximum that they are allowed to take. Every time the creditor requests a payment I am notified before it is paid. I can cancel it or in some cases, such as a credit card monthly payment, alter it.

"Direct debit" can mean multiple different systems. In this case the Norwegian system the parent talked about sounds similar to the Finnish Finvoice system that can be used to (auto-)pay practically all bills in Finland - the system is known to users as "e-invoicing" (e-lasku) or, if used offline, as "direct payment" (suoramaksu).

The customer manually creates the billing agreement with a specific invoicer at the customer's online bank, and can set payment limits, notifications, and either automatic or manual approvals.

These are distinct from the "SEPA direct debit", which is not used in Finland domestically. Due to their rarity I think "SEPA direct debit" payments are usually/often disabled or each payment requires a specific customer authorization via their online bank (so IBAN of such an account cannot be used to get money out of the account).

Many banks don’t properly validate the CVV and expiry date, or only apply fuzzy matching to “improve the customer experience”.

Classic example of this is Tesco bank where they only checked that the expiry date was in the future, not if it actually matched the card.

They also made a number of other insane mistakes, and FCA report does a good job of explaining them [1]

[1] https://www.fca.org.uk/publication/final-notices/tesco-perso...

There's a risk. Have you ever had your credit card number expire? If a merchant has repeat billing, you don't even need to update with the new date and cvv. Code changes must now be made to make sure I don't end up responsible for someone's else bill because my card expired and someone issued the same card number with a different expiration date and cvv.

This is a simple issue to solve if you have all the issuers in line/on the same page.

Issuers simply need tabs on this. This means, a) they only allow this for merchants that have had previous transactions. b) They reset this when a card is reused (owner of the number changes).

Ultimately you just need a system that turns on stricter checks when reuse-induced issues are likely.

Once a card is reused the issuer simply needs to turn off the recurring billing laxness until the card gets close to expiration again, i.e. a few years, which should suffice to detect any sort of problematic patterns.

This wouldn't affect the customer at all as any legitimate transaction would have been made with up to date expiry and CVV.

It's never a simple issue to get all banks to update their systems. It will take decades!

That's done with a credit card updating service - not by just ignoring the CVV/expiration.

If the same number were reassigned to someone else, the subscription wouldn't transfer.

That isn’t true. Most banks don’t support the updating services that exist.

These subscriptions are supported by look at if the payment appeared as a “card-on-file” payment, and many banks will just keep accepting charges to expired cards.

If you’re lucky they’ll be using the PAN + expiry date to uniquely identify the card the payment belongs too.

The CVV isn’t stored by the merchant or their processor, and is only used for the initial checkout flow.

Well, if bank ignores everything and just throws your money out, ask the regulator to revoke the bank's license.

In most countries as a customer you’re not liable for fraud that occurs as a result of your banks failures.

In the EU this sort of behaviour is now heavily frowned upon, and with the slow roll out of Strong Customer Authentication will become unacceptable. With banks needing to prove that they’re compliant.

As for the rest of the world, regulators don’t always act with the interest of customer in mind. The US has a few notable examples of regulators protecting companies rather than consumers.

Also ivp4 in the sense that they have 16 digits, but have reserved 6 for card type and similar minutia. If they used all 16 digits, they'd have billions and billions of numbers available.

Reply on news.ycombinator.com