Hacker News Reader

Comment by donor20 | Hacker News Reader

This is a ridiculous story.

Japan has a population of 150M.

If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers.

Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix.

The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of structure into the digits that results in very inefficient use.

These are the 10 digits available PER PREFIX!

1,234,567,890

Even with a check digit you are at a billion numbers PER PREFIX! You can't get 125 million folks into this address space?

Absolutely pitiful.

View on HN

Your comment is ridiculous. The number has structure, you don't get random IP addresses if you're a company. You get a block, likewise card issuers get a block (BIN - Bank Identifier Number) then add in the checksum, that definitely means you can't just assign random number. Imagine you have a random number. Visa get's the number and a charge for $20. Who owns it? They now have to search through all possible issued card number to find the card issuer. However with the BIN, they can do a pattern matching and send the info to the card issuer to determine if the card is valid. Think of the implementation details, those before you are not idiots as much as you may think they didn't think things through.

My thoughts of this made the parallelism with IP addresses. Japan's issue can be solved by "buying some numbers" from much smaller countries.

The solution to reuse a number is bat shit crazy. Perhaps they can use expired cards (and not cancelled).

In the long run the sensible solution (just like IP addresses) is to move from a "IPv4" system to a "IPv6" that will largely multiply the available numbers per country/bank/entity and will solve the problems, for the next many decades.

What the OP said was that even with a 6 digit BIN and 1 digit check, you have 9 digits available per BIN.

For example, Mastercards start in the range 51 to 55. That leaves 4 digits of the 6 digit BIN to allocate to MC issuers. So that's a total of 50K issuers of MC world wide, then each of those issuers can have 1 billion cards.

So each issuer of a MC in Japan can issue a card to each member of the population and only use an eighth of their allocated range.

The problem isn't the individual card account ID, from the article, it sounds like Japan has been allocating too many BINs.

> an eight of their allocated range

Assuming your calculations are correct, this means an issuer can only emit 8 cards in average to the total population.

Cards have an expiration, people lose them, break them, they change and come back to banks. For the main issuers it’s not ridiculous to have to issue 20 or 30 cards per account to a user in their lifetime.

Then people have multiple accounts (e.g. my mortgage was on a separate join account).

There’s just enough normal circumstances to run out of numbers, not even considering freak cases.

I hope you are trolling.

You understand that every possible prefix / range has a billion numbers minimum? That japans population is only 125 million?

And actually - you can near randomly assign numbers if you wanted, looking up card issuer is not difficult. Can basically issue card numbers in blocks of 100 if you wanted to reduce lookup tables a bit. This is already happening and available actually. Visa and other (apple) offer tokenization services to randomize your card number. Every phone number uses this type of system to enable number portability as well (you can take your phone number from t-mobile to sprint).

With 16 digits (1,234,567,890,123,456) you have 999 trillion numbers you can assign. As my original comment pointed out, the idea that we are running out of credit card numbers is absolutely ridiculous.

This story is ridiculous for another reasons. I worked for card payment (implemented credit card terminal application, internalized couple thousand pages of requirements).

Credit card numbers are assigned by payment organizations in the form of prefixes (BINs -- https://binlist.net/, https://www.bindb.com/bin-list.html)

The worst that will happen is that Visa/Mastercard will issue more BINs to those organizations. There isn't going to be a shortage of credit card numbers.

Exactly, but the idea that with a billion numbers to issue they can't get 100 million folks into the structure - that's also silly.

Not really that silly. For example, IPv4 address space was initially mostly partitioned in huge blocks to couple institutions and companies without regard for the future.

The difference is that Credit Card numbers are much easier to manage. The routing tables for Credit Cards are distributed by Visa/Mastercard to acquirers in the form of BIN files and it is extremely easy to add arbitrary mapping. So if someone gets an unnecessarily large prefix like "1" then the next day you can change it easily to ten prefixes "10", "11", "12" and so on and have a different organization for each.

Wouldn't the Luhn algorithm checksum [1] limit the available digits? It is specifically there so a one-off error doesn't result in a charge going to a valid other account.

[1] https://en.wikipedia.org/wiki/Luhn_algorithm

I believe that’s what they mean by “check digit”.

Most checksum algorithms that I know of for credit card numbers only decrease the number of available digits by 1.

Or equivalently it increases the length by the length of the checksum (usually 1 for credit cards) and doesn't otherwise affect the available numbers.

Great video on checksum was done by Ben Eater:

https://youtu.be/ppU41c15Xho

The sixteen digits are shared globally. Japan would only get a fraction, the size I'm not sure.

16 digits is a thousand trillion. That's 1.2 million numbers PER PERSON in the global world. This is two few for 5 credit cards in your wallet?

Come ON! STOP with these clickbait / alarmist headlines.

> You can't get 125 million folks into this address space?

I think some people are now using a new card number per transaction, with these disposable card numbers, aren't they?

We are lucky they don't use a disposable IPv4 address per page, that would break the Internet /s.

Not really sure what point you're trying to make, sorry?

Disposable CC numbers (one time use) is a waste of a very limited resource.

‘/s’ usually means sarcastic when you see it on this site, but you’ve used it in a comment where you meant what you said (you do think it’s good we’re not wasting IP addresses in the same way). That’s why it’s confusing.

You're talking about services like Google/Apple Pay right? Aren't these credit card numbers rotated by Google/Apple, and they just keep some mapping of userIds, transactionIds, and rotated cardIds?

No I think you can genuinely get disposable real credit card numbers.

https://www.theukdomain.uk/virtual-credit-card-numbers-every...

privacy.com

Yes, but in this case you can actually rotate those numbers easily without running into any issues, and on top of that they usually consume just one BIN per service.

My Citi card comes with a desktop app that can generate new numbers for online payments all the time. Beyond one-time use, I can generate a number that will work only with ‘x’ company for ‘x’ number of months. When I saw that, I assumed Citi+MasterCard must have at least 10,000s of times more numbers than customers

No bank does addressing like that.

Amex for example have got only 6 digits per prefix. 15 digit card number, 6 digit BIN, 7 digit account number, 1 digit representing which card it is (1 for the first, and it gets bumped up with any replacements), and 2 digits for the position on account, allowing you to have 99 supplementary cards on account that can then be identified.

Obviously this is just Amex and it's an absolute non issue for them seeing that they own the entire 37 and 34 range, but I can assure you that virtually no financial institution actually use all of the 9 digits like that.

> If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers.

I hate saying this but I'll say it anyway, as someone who has spent considerable amounts of time trying to get things done in Japan, I would say that you're right.

There is likely some ridiculously inefficient process which obviously requires changing but for cultural reasons it's hard to change things so they're stuck in this strange situation.

You know that not every possible number is used, right? It's much more sparse than that.

The only real solution to being able to do things the Japan way is to increase the number of digits.

Think of all the extra information we could encode in the number!

They also cannot ask for an extra prefix, since all their forms and systems assume the same prefix is used everywhere.

(Note, I have no idea if this is actually the case, I’m just extrapolating from my experiences here)

Reply on news.ycombinator.com