Hacker News Reader

Comment by Shank | Hacker News Reader

One thing I really love that Japan got right was the creation of e-money systems that are anonymous (you can get a Suica for 20,000 yen without any registration information), work offline (you don't need network at-payment, nor does the terminal), and are easily accessible (you can get them at any train station, you can charge them at any ATM or convenience store with cash). In contrast, a debit/credit card usually requires a lot more pain to get onboarded with. The closest thing is probably those silly visa prepaid cards you can buy, but they require a little work to use regularly.

View on HN

Meanwhile, there's no apparent way to pay for a train using an American android phone (or at least I couldn't figure it out last year). One of the two apps refused to install on non-japanese phones, the other installed but refused to run. Had to pay with cash and it was a huge pain. Half the time I inexplicably had to do a fare adjustment, a hugely embarrassing moment blocking the turnstile, especially considering the culture there.

That’s thanks to Android phone manufacturers, which don’t want to pay for a global license for the NFC tech involved. Apple on the other hand does pay for a global license and so iPhones and Apple Watches from anywhere work perfectly with Japanese cash card terminals. I use a digital Suica on my US iPhone during my visits.

Supposedly Pixels have the requisite hardware, but Google software locks the functionality to Japan. Some have been able to hack their Pixels to force it on but from what I’ve gathered it’s flaky when you do that.

Why should they pay for a licence? Once a technology reaches such ubiquity, there's a strong case for it being part of the technical infrastructure of that society. To me, that means that governments have a responsibility to ensure that the technology is widely available, and arbitrarily locking it behind commercial licences does not help achieve that. To the extent that patents and licensing provide an incentive to develop such technology, it's beholden on governments to foot the R&D bill in some other way.

I see your point, but at the same time fracturing product lines into a million micro-SKUs also isn’t great and should be discouraged.

Using this sort of logic Windows would be mandatory and paid for by the government on all your 90s, 2000s laptops.

The "standard" in question here is NTT Docomo's Osaifu-Keitai, which is used only in Japan and requires both licensing and a special flavor of Sony's Felica chip:

https://en.wikipedia.org/wiki/Osaifu-Keitai

I can't really fault Android manufacturers for not wanting to pay extra for every phone in the world to get a bit of proprietary tech that's completely useless outside Japan.

No surprises here, it's Sony. The same company that use propertiary memory card on PS Vita.

The same company that has a weird dichotomy between sometimes using other industry-standard data formats, but at times either succeeding (UMatic, Betacam, Professional Disc, Video8/Hi8) and sometimes failing (Betamax, Memory Stick) to have a dominant media storage standard. And sometimes they have products that accept industry standard formats (I have an older prosumer camera from Sony that supports SD, Memory Stick Pro Duo, and a proprietary flash format that is mostly used to record two formats at once, and they made plenty of VHS VCRs).

Why the F should an interoperability fundamental like NFC require any such thing as a license in the first place??? It's utterly absurd to have ever allowed such a condition, despite it being a fact that everyone has been just living with for decades. If there is a problem, it is very definitely not thanks to anyone failing to pay a license.

FeliCa isn't NFC -- it's a close standard but it's technically different enough and has different requirements that it has licensing attached because it wasn't made freely available. It's technically also called "NFC-F". FeliCa predates NFC's wide adoption in consumer electronic devices because it was in use in Japan in the early 2000's.

What do the international android phones support and does it require licensing?

There’s not a reasonable solution using global Android phones, but you could obviously just buy a physical IC card and use that, which is what I was suggesting here in the first place.

In China I could use alipay. It was a bit different since it was qr code driven.

In some stations now there are some entry points that use "standard" visa touchless payments that can be used now I think.

Your android phone likely doesn't have the right NFC tech that iPhones have (google Felica, it's a separate NFC standard used basically only in Japan. Apple builds it into all of their iPhones, most android phones outside of Japan do not). It's mostly just a case of divergent tech, along with Apple being willing to spend money to avoid SKU differentiation/support people traveling in Japan.

The trick is to get a Suica card, which as an foreigner you need to do at the airport train station before you leave to the rest of Japan.

https://www.jreast.co.jp/en/multi/welcomesuica/purchase.html

Hilariously, the physical cards can only be topped up at add fare machines (cash only) or ATMs (cash only).

If you go down the "add a pasmo/suica on your phone" then you get into licensing issues with the other cabal (credit card issuers): you need to use an Amex to charge it via Apple Pay (IIRC Visa is now supported, but when I tried it last week my card was declined, so... YMMV).

Assuming you’re a tourist, are you sure it’s not your bank flagging the transaction? When visiting in April I too thought it was an issue with the card when trying to reload on apple wallet, but after two cards declined, found out the transaction was flagged haha

Same experience with reloading on the physical machines. It’s quite amusing

Same card worked via Apple wallet for other transactions, and the Visa thing is a known issue historically (https://discussions.apple.com/thread/255018680?sortBy=rank). A local friend confirmed the fix, but I can't seem to find any info from Apple or Visa about it.

It's working now (https://atadistance.net/2023/12/15/apple-pay-suica-visa-rech...) and has been working since ~2023. The last hurdle many face is that if you disable location services, sometimes the transaction is still blocked as they can now geofence it to just Japan with foreign bank cards.

My Visa worked just fine last time I was there.

You only need to buy it at the airport if you want a Welcome Suica. You can buy a regular Suica at any station with a multi-function machine.

The only real differences between the Welcome Suica and a regular one are the 500 yen deposit (Welcome Suica doesn't require a deposit) and the limited validity (Welcome Suica automatically expires after about a month).

Funny fact they ran out of suica chips for a long time during COVID and it was impossible to buy one for almost a year

A few years ago, while I was in Japan visiting, they ran out of SUICA cards and visitors arriving couldn't get them. Left a lot of folks in a real bind. Fortunately I had already had cards for my family- and when we left we returned them for the deposit so they could be re-used, but they had a shortage for a few years! They should have used standard NFC, but being an early adopter has its downsides I guess.

Not necessarily about being an early adopter, it's that they remained inflexible despite adopting a flexible technology.

> work offline (you don't need network at-payment, nor does the terminal)

Surely this is massively vulnerable to double spend attacks?

It's been in widespread use for a while at this point so in practice probably not. I imagine the authentication keys to present as a card are very tightly controlled and not just anyone can become a provider.

> Surely this is massively vulnerable to double spend attacks?

FeliCa uses mutual authentication with eventual bookkeeping and sync. I believe that there are some theoretical attacks on older cards but the terminals are regularly synchronized and get a ban list. In-practice, you’ll also be reported to the police, probably.

Not really - what's the attack? You could maybe somehow clone a card with a balance on it and spend that balance twice, if you can figure out that a particular terminal is offline (or have a way to take it offline), but how do you turn that into an attack that you can scale enough to cover the fixed costs? You're not getting your own terminal without a contract and due diligence on your company, so you can't really pull off an attack that needs to control both sides.

My understanding here is that there's less risk of double spends here because of the extreme difficulty of cloning the smartcards involved.

So to execute the double spend you would have to find an authorized card provider, convince them to load and sign your double spend-capable program onto the smartcard (with their signature!), and then be found out within a week when reconciliation is off.

So doing a double spend will be found out, and not only will you be on a bunch of cameras doing the thing, whoever made your card will also have been compromised.

I think that in practice the "eventual" reconciliation is fairly quick nowadays. Just that the offline spend can happen quickly, and then the packet gets sent over the wire maybe a minute later rather than before the spend is approved.

> I think that in practice the "eventual" reconciliation is fairly quick nowadays. Just that the offline spend can happen quickly, and then the packet gets sent over the wire maybe a minute later rather than before the spend is approved.

This is definitely the case, and it's also "relatively instant" in the happy path. There are cases like vending machines, or during system outages where the reconciliation happens much later, but those instances are definitely becoming rarer!

Or you can extract the secrets from a smartcard using a variety of side-channels. But the juice is rarely worth the squeeze.

Maybe you can, but I had the impression that it would be quite difficult given physically unclonable function-y stuff. Handwave-y and I have no clue if Suica-style payments use it but that was my impression.

It's really not that big of an issue when the spends are reasonable sized (e.g. public transport). You don't need to prevent literally all fraud, just enough that it becomes an acceptable cost of doing business. Fielding customer complaints because they couldn't ride due to an offline reader isn't free either.

Not nessisarially because it can take advantage of TEEs in smart cards

In Taiwan, there is a similar system called EasyCard. That works offline.

...And as you expect it is vulnerable to double spend attacks. Hilariously the vulnerability was revealed in 2014 and nothing has been done to mitigate it. Yes, you can double spend in Taiwan today if you don't mind risking jail time.

From my (rudimentary) understanding of CAP, there is no prefect solution to this. I wonder how Japan handles it.

You can also "double spend" cash with fake bills. Zero fraud is never a reasonable design goal.

Much easier than double spending would be to use a student or other reduced fare card.

But Japanese people largely still use cash, don't they?

This isn't as true as it used to be. Mobile pay and IC-type cards have risen in popularity, and if you have a credit card, it's accepted in many places.

This is no longer true. With the advance of "cashless" systems that were heavily pushed and promoted by the government, cash payments have dropped significantly![0] Cashless payments now sit near 50%, up from 16% 10 years ago.

[0]https://www.meti.go.jp/english/press/2025/0331_001.html

But not the anonymous, offline, accessible payment systems this thread is about.

The online, ad infested phone-app-only, less accessible "cashless" systems like paypay.

Even today the only place you can buy food with your pasmo/suica card is at the convenience store. Why is that?

From my experience, apart from small restaurants and yatais (basically food carts), as well as local buses in small towns, you could get by using a credit card / Suica perfectly fine.

I think a lot of the motivations are AML. Suica has a low maximum balance, that probably restricts the nefarious use cases.

I would personally argue that 20,000 yen is not a low maximum balance for day-to-day purchases like food, because you can recharge so easily.

Before Suica (and a bit concurrently), JNR and later JR issued "orange cards" that included both high value formats and lower value formats. The "high value" cards were 5,000 yen and 10,000 yen respectively, so the new maximum is 2x the previous "high value" orange cards that they abolished.

The real win with e-money is not getting change, in my opinion. Carrying 20,000 yen in cash is easy when it's 2x 10,000 notes, but when it's a mix including coins, it's a pain.

>Carrying 20,000 yen in cash is easy when it's 2x 10,000 notes, but when it's a mix including coins, it's a pain.

Carry a coinpurse. I use an old faux-suede Samsung camera pouch.[1] Plus it's fun when someone is running an errand for you, like getting you a snack from the konbini across the street, and you plop your coinpurse on the desk with a thud, then pour out a handful of 500-yen coins and say "this should cover it", like a feudal lord.

[1] kinda like this: https://www.amazon.ie/DFVmobile-Samsung-Galaxy-Camera-Closur...

Why have a whole purse when it is already built into your phone which you already are carrying around anyways.

Because my coin purse isn't going to randomly decide that it doesn't like the transaction.

You would give someone your PHONE to go buy a snack for you across the street? And tell them your screen unlock combo?

Dumping some coins out of my coinpurse is far superior analog, low-tech Access Control to my money.

I do carry a coin purse, and I have no use for 1 yen coins. Sure, 10 yen, 50 yen, and 100 yen coins are easily spent, but 1 yen is not. Same issue with pennies in the US.

Keep in mind that "anonymous" money systems are not untrackable. You need to have killer OpSec to actually have an anonymous digital wallet even if it is technically possible. I'd rather not deal with that extreme discipline. Cash does the job just fine, at least for in-person transactions.

to me suica seemed limited (for a traveler). you could get one and charge it up with a credit card, but I don't think you could recharge it that way. You could also not get multiple ones.

I believe there is a less limited suica card you can get (not a traveler), but I think you need a japanese address.

> I believe there is a less limited suica card you can get (not a traveler), but I think you need a japanese address.

You don’t need a Japanese address. Simply visit any Suica vending machine, change the language to English, and purchase anonymous Suica.

There are various preloaded options you can purchase, but typically you cannot recharge e-money via cash.

the vending machine card was the red one, right?

I though there was a (blue?) one that japanese citizens could get, sent to their address.

The red is a 30 day card for tourists. The green is valid for many years. You can get both anonymously, but there was a chip shortage a while back which meant only the red cards were widely available.

> I though there was a (blue?) one that japanese citizens could get, sent to their address.

No, there are no citizen specific IC cards unless you want extremely esoteric ones, like for senior citizens or children. All of the major nationwide mutual use transportation IC cards are freely available at the stations their operators carry. That's anything in the red box on this chart: https://en.wikipedia.org/wiki/Suica#/media/File:ICCard_Conne....

You can choose to register the card if you want to (add your name an other details). If you do this you can get your car back if lost. And, you can also get a commuter pass assigned (cheaper price between two stations for 1 month).

I was able to get a Pasmo card as an alternative to Suica, and it was rechargable with cash. I also did the same with an Icoca card. I didn't need a Japanese address in either case. I just bought the cards from machines at a couple of the larger metro stations. They could be reloaded with cash at any metro station.

Suica is far from being accepted everywhere. in Japan cash is your best bet.

Those prepaid visa cards don't actually exist, I think they were killed by AML/KYC. Instead, they appear to be "prepaid visa gift cards" accepted at less than a hundred large chains.

This is wrong.

The visa gift cards work pretty much everywhere, unless they are specifically disabled by the establishment. They do show as a gift card but all the POS systems are perfectly capable of splitting the payment now. I've only seen them disabled at small restaurants that have dealt with scam charge backs and sites like Raise that deal in gift cards and gift card scams as part of their business.

Usually they simply aren't worth it because of the activation fee. It's always more than the highest paying credit card cash back. However sometimes stores, run sales where they waive the activation fee, but there's always a limit.

Reply on news.ycombinator.com