4 ms·

I think we can all agree the correct model is a card that generates a globally unique card number for each and every transaction (e.g. coin failed, final). It s

I think we can all agree the correct model is a card that generates a globally unique card number for each and every transaction (e.g. coin failed, final). It should also have a 2nd factor authorization like CVV which is not embedded in the magnetic strip (can't be read by swipers).

jdmichal 10y ago
Which is (roughly) exactly how EMV chips work. Crypographic challenges that result in unique tokens for every transaction.
- Nullabillity 10y ago
  Of course, EMV is still a broken piece of crap, because the signer can't actually verify the transaction being signed.
  - lewiseason 10y ago
    Plus, you still have to support plaintext between the EMV chip and the reader. This opens an entirely new class of places to steal card details (like PINs)
PeterisP 10y ago
Recurring billing is a major feature of credit cards that some merchants find very important.
nickpsecurity 10y ago
The first part is basically what Final claims to be doing: https://getfinal.com/ https://getfinal.com/
- discreditable 10y ago
  I have a Final card. You have three options: 1. Use your real card number. I never do this. 2. Use a merchant-locked card number. I use this commonly for online pizza and other online shops I don't trust much. Once a merchant uses it, only that merchant can use it. 3. Use a one-time card. The number is used once and disabled. Good for one-off orders or skeezy purchases. Overall I've been pretty pleased. I think the idea that card numbers should be disposable is awesome.
  - wheelerwj 10y ago
    this is pretty solid actually, ill have to check it out. edit, i checked it out. so 1) its no open to sign ups, and 2) you have to have pretty stellar credit to even be considered. so that leaves out most people.
    - discreditable 10y ago
      Dang, I didn't know about the signup thing. I hopped on when they had an open beta period. (Kinda weird to say that about financial services!)
      - arfrank 10y ago
        There are a tons of reasons to keep our signups closed for now. One non-obvious reason to most people is that it costs us money to lend out money to customers. Theres a ton of others we're working on solving in parallel too
    - arfrank 10y ago
      Email me at aaron@getfinal.com and we can get you a code to apply :) We're working on broadening our underwriting criteria, but this is a complicated business overseen by an incredible amount of regulation, while also taking risk when we issue new lines of credit. Large banks throw around a lot of $ to make it work (a lot in this statement), but to start a new provider takes a lot of tactical decisions and iteration to grow in a safe and sustainable way.
  - arfrank 10y ago
    Email me @ aaron@getfinal.com I'd love to hear more, if you don't mind. We encourage people to use the physical card and just treat it as disposable if it ever gets skimmed/breached/stolen/lost. We made sure it impacts none of your other relationships :)
closeparen 10y ago
I think the correct model has the customer authorize (sign) the specific transaction through a channel not controlled by the merchant. An object which signs every transaction it's asked to sign is an improvement (can only be in one place at a time) but still broken (evil terminals).
abalone 10y ago
I don't agree about the unique account number every time. That's nice to opt into when you want maximum privacy but it screws up things like loyalty programs or recurring billing where you actually do want a merchant to remember you. What we can agree on is that there should be strong authentication. Apple Pay is the best system I've seen. It creates a unique but static account number that can only be used with Apple Pay, which has strong authentication which is also convenient (Touch ID), so it can be mandatory. Thus it doesn't matter if the number gets stolen as it's useless without Apple Pay.
- wheelerwj 10y ago
  subscription billing, its definitely one of those big, ugly, nasty hard to solve problems that no one really wants to talk about or address. Definitely falls into the category of "if its not broke don't fix it." But payments in general are just totally effed and can't seem to move forward without some sort of fix. as a consumer its both amazing and incredibly frustrating. as a merchant it's essential. Imagine how much money netflix would lose if you had to auth payments every 30 days.

jdmichal 10y ago

Which is (roughly) exactly how EMV chips work. Crypographic challenges that result in unique tokens for every transaction.

Nullabillity 10y ago
Of course, EMV is still a broken piece of crap, because the signer can't actually verify the transaction being signed.
- lewiseason 10y ago
  Plus, you still have to support plaintext between the EMV chip and the reader. This opens an entirely new class of places to steal card details (like PINs)

PeterisP 10y ago

Recurring billing is a major feature of credit cards that some merchants find very important.

nickpsecurity 10y ago

The first part is basically what Final claims to be doing: https://getfinal.com/ https://getfinal.com/

discreditable 10y ago
I have a Final card. You have three options: 1. Use your real card number. I never do this. 2. Use a merchant-locked card number. I use this commonly for online pizza and other online shops I don't trust much. Once a merchant uses it, only that merchant can use it. 3. Use a one-time card. The number is used once and disabled. Good for one-off orders or skeezy purchases. Overall I've been pretty pleased. I think the idea that card numbers should be disposable is awesome.
- wheelerwj 10y ago
  this is pretty solid actually, ill have to check it out. edit, i checked it out. so 1) its no open to sign ups, and 2) you have to have pretty stellar credit to even be considered. so that leaves out most people.
  - discreditable 10y ago
    Dang, I didn't know about the signup thing. I hopped on when they had an open beta period. (Kinda weird to say that about financial services!)
    - arfrank 10y ago
      There are a tons of reasons to keep our signups closed for now. One non-obvious reason to most people is that it costs us money to lend out money to customers. Theres a ton of others we're working on solving in parallel too
  - arfrank 10y ago
    Email me at aaron@getfinal.com and we can get you a code to apply :) We're working on broadening our underwriting criteria, but this is a complicated business overseen by an incredible amount of regulation, while also taking risk when we issue new lines of credit. Large banks throw around a lot of $ to make it work (a lot in this statement), but to start a new provider takes a lot of tactical decisions and iteration to grow in a safe and sustainable way.
- arfrank 10y ago
  Email me @ aaron@getfinal.com I'd love to hear more, if you don't mind. We encourage people to use the physical card and just treat it as disposable if it ever gets skimmed/breached/stolen/lost. We made sure it impacts none of your other relationships :)

closeparen 10y ago

I think the correct model has the customer authorize (sign) the specific transaction through a channel not controlled by the merchant. An object which signs every transaction it's asked to sign is an improvement (can only be in one place at a time) but still broken (evil terminals).

abalone 10y ago

I don't agree about the unique account number every time. That's nice to opt into when you want maximum privacy but it screws up things like loyalty programs or recurring billing where you actually do want a merchant to remember you. What we can agree on is that there should be strong authentication. Apple Pay is the best system I've seen. It creates a unique but static account number that can only be used with Apple Pay, which has strong authentication which is also convenient (Touch ID), so it can be mandatory. Thus it doesn't matter if the number gets stolen as it's useless without Apple Pay.

wheelerwj 10y ago
subscription billing, its definitely one of those big, ugly, nasty hard to solve problems that no one really wants to talk about or address. Definitely falls into the category of "if its not broke don't fix it." But payments in general are just totally effed and can't seem to move forward without some sort of fix. as a consumer its both amazing and incredibly frustrating. as a merchant it's essential. Imagine how much money netflix would lose if you had to auth payments every 30 days.