5 ms·

This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving ou

This is a ridiculous story. Japan has a population of 150M. If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. Some answers to the excuses. The 6 digits at front, if a company legit runs out of numbers, ask for another prefix. The reality. Instead of using the numbers properly (random ID to tie to a user account) they are probably putting some kind of structure into the digits that results in very inefficient use. These are the 10 digits available PER PREFIX! 1,234,567,890 Even with a check digit you are at a billion numbers PER PREFIX! You can't get 125 million folks into this address space? Absolutely pitiful.

deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
x87678r 6y ago
The sixteen digits are shared globally. Japan would only get a fraction, the size I'm not sure.
- donor20 6y ago
  16 digits is a thousand trillion. That's 1.2 million numbers PER PERSON in the global world. This is two few for 5 credit cards in your wallet? Come ON! STOP with these clickbait / alarmist headlines.
deleted 6y ago
[deleted]
draw_down 6y ago
This is the most Hacker News post I have ever seen.
chrisseaton 6y ago
> You can't get 125 million folks into this address space? I think some people are now using a new card number per transaction, with these disposable card numbers, aren't they?
- AdrianB1 6y ago
  We are lucky they don't use a disposable IPv4 address per page, that would break the Internet /s.
  - chrisseaton 6y ago
    Not really sure what point you're trying to make, sorry?
    - AdrianB1 6y ago
      Disposable CC numbers (one time use) is a waste of a very limited resource.
      - chrisseaton 6y ago
        ‘/s’ usually means sarcastic when you see it on this site, but you’ve used it in a comment where you meant what you said (you do think it’s good we’re not wasting IP addresses in the same way). That’s why it’s confusing.
- pedroma 6y ago
  You're talking about services like Google/Apple Pay right? Aren't these credit card numbers rotated by Google/Apple, and they just keep some mapping of userIds, transactionIds, and rotated cardIds?
  - chrisseaton 6y ago
    No I think you can genuinely get disposable real credit card numbers. https://www.theukdomain.uk/virtual-credit-card-numbers-everything-you-need-to-know/ https://www.theukdomain.uk/virtual-credit-card-numbers-every...
lmilcin 6y ago
This story is ridiculous for another reasons. I worked for card payment (implemented credit card terminal application, internalized couple thousand pages of requirements). Credit card numbers are assigned by payment organizations in the form of prefixes (BINs -- https://binlist.net/ https://binlist.net/, https://www.bindb.com/bin-list.html https://www.bindb.com/bin-list.html) The worst that will happen is that Visa/Mastercard will issue more BINs to those organizations. There isn't going to be a shortage of credit card numbers.
- donor20 6y ago
  Exactly, but the idea that with a billion numbers to issue they can't get 100 million folks into the structure - that's also silly.
  - lmilcin 6y ago
    Not really that silly. For example, IPv4 address space was initially mostly partitioned in huge blocks to couple institutions and companies without regard for the future. The difference is that Credit Card numbers are much easier to manage. The routing tables for Credit Cards are distributed by Visa/Mastercard to acquirers in the form of BIN files and it is extremely easy to add arbitrary mapping. So if someone gets an unnecessarily large prefix like "1" then the next day you can change it easily to ten prefixes "10", "11", "12" and so on and have a different organization for each.
r00fus 6y ago
Wouldn't the Luhn algorithm checksum [1] limit the available digits? It is specifically there so a one-off error doesn't result in a charge going to a valid other account. [1] https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm
- senkora 6y ago
  I believe that’s what they mean by “check digit”.
- contravariant 6y ago
  Most checksum algorithms that I know of for credit card numbers only decrease the number of available digits by 1. Or equivalently it increases the length by the length of the checksum (usually 1 for credit cards) and doesn't otherwise affect the available numbers.
- bausano_michael 6y ago
  Great video on checksum was done by Ben Eater: https://youtu.be/ppU41c15Xho https://youtu.be/ppU41c15Xho
Aeolun 6y ago
The only real solution to being able to do things the Japan way is to increase the number of digits. Think of all the extra information we could encode in the number! They also cannot ask for an extra prefix, since all their forms and systems assume the same prefix is used everywhere. (Note, I have no idea if this is actually the case, I’m just extrapolating from my experiences here)
segmondy 6y ago
Your comment is ridiculous. The number has structure, you don't get random IP addresses if you're a company. You get a block, likewise card issuers get a block (BIN - Bank Identifier Number) then add in the checksum, that definitely means you can't just assign random number. Imagine you have a random number. Visa get's the number and a charge for $20. Who owns it? They now have to search through all possible issued card number to find the card issuer. However with the BIN, they can do a pattern matching and send the info to the card issuer to determine if the card is valid. Think of the implementation details, those before you are not idiots as much as you may think they didn't think things through.
- HenryBemis 6y ago
  My thoughts of this made the parallelism with IP addresses. Japan's issue can be solved by "buying some numbers" from much smaller countries. The solution to reuse a number is bat shit crazy. Perhaps they can use expired cards (and not cancelled). In the long run the sensible solution (just like IP addresses) is to move from a "IPv4" system to a "IPv6" that will largely multiply the available numbers per country/bank/entity and will solve the problems, for the next many decades.
- rswail 6y ago
  What the OP said was that even with a 6 digit BIN and 1 digit check, you have 9 digits available per BIN. For example, Mastercards start in the range 51 to 55. That leaves 4 digits of the 6 digit BIN to allocate to MC issuers. So that's a total of 50K issuers of MC world wide, then each of those issuers can have 1 billion cards. So each issuer of a MC in Japan can issue a card to each member of the population and only use an eighth of their allocated range. The problem isn't the individual card account ID, from the article, it sounds like Japan has been allocating too many BINs.
  - hrktb 6y ago
    > an eight of their allocated range Assuming your calculations are correct, this means an issuer can only emit 8 cards in average to the total population. Cards have an expiration, people lose them, break them, they change and come back to banks. For the main issuers it’s not ridiculous to have to issue 20 or 30 cards per account to a user in their lifetime. Then people have multiple accounts (e.g. my mortgage was on a separate join account). There’s just enough normal circumstances to run out of numbers, not even considering freak cases.
supernova87a 6y ago
You know that not every possible number is used, right? It's much more sparse than that.
sgjohnson 6y ago
No bank does addressing like that. Amex for example have got only 6 digits per prefix. 15 digit card number, 6 digit BIN, 7 digit account number, 1 digit representing which card it is (1 for the first, and it gets bumped up with any replacements), and 2 digits for the position on account, allowing you to have 99 supplementary cards on account that can then be identified. Obviously this is just Amex and it's an absolute non issue for them seeing that they own the entire 37 and 34 range, but I can assure you that virtually no financial institution actually use all of the 9 digits like that.
bamboozled 6y ago
> If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. I hate saying this but I'll say it anyway, as someone who has spent considerable amounts of time trying to get things done in Japan, I would say that you're right. There is likely some ridiculously inefficient process which obviously requires changing but for cultural reasons it's hard to change things so they're stuck in this strange situation.

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

x87678r 6y ago

The sixteen digits are shared globally. Japan would only get a fraction, the size I'm not sure.

donor20 6y ago
16 digits is a thousand trillion. That's 1.2 million numbers PER PERSON in the global world. This is two few for 5 credit cards in your wallet? Come ON! STOP with these clickbait / alarmist headlines.

deleted 6y ago

[deleted]

draw_down 6y ago

This is the most Hacker News post I have ever seen.

chrisseaton 6y ago

> You can't get 125 million folks into this address space? I think some people are now using a new card number per transaction, with these disposable card numbers, aren't they?

AdrianB1 6y ago
We are lucky they don't use a disposable IPv4 address per page, that would break the Internet /s.
- chrisseaton 6y ago
  Not really sure what point you're trying to make, sorry?
  - AdrianB1 6y ago
    Disposable CC numbers (one time use) is a waste of a very limited resource.
    - chrisseaton 6y ago
      ‘/s’ usually means sarcastic when you see it on this site, but you’ve used it in a comment where you meant what you said (you do think it’s good we’re not wasting IP addresses in the same way). That’s why it’s confusing.
pedroma 6y ago
You're talking about services like Google/Apple Pay right? Aren't these credit card numbers rotated by Google/Apple, and they just keep some mapping of userIds, transactionIds, and rotated cardIds?
- chrisseaton 6y ago
  No I think you can genuinely get disposable real credit card numbers. https://www.theukdomain.uk/virtual-credit-card-numbers-everything-you-need-to-know/ https://www.theukdomain.uk/virtual-credit-card-numbers-every...

lmilcin 6y ago

This story is ridiculous for another reasons. I worked for card payment (implemented credit card terminal application, internalized couple thousand pages of requirements). Credit card numbers are assigned by payment organizations in the form of prefixes (BINs -- https://binlist.net/ https://binlist.net/, https://www.bindb.com/bin-list.html https://www.bindb.com/bin-list.html) The worst that will happen is that Visa/Mastercard will issue more BINs to those organizations. There isn't going to be a shortage of credit card numbers.

donor20 6y ago
Exactly, but the idea that with a billion numbers to issue they can't get 100 million folks into the structure - that's also silly.
- lmilcin 6y ago
  Not really that silly. For example, IPv4 address space was initially mostly partitioned in huge blocks to couple institutions and companies without regard for the future. The difference is that Credit Card numbers are much easier to manage. The routing tables for Credit Cards are distributed by Visa/Mastercard to acquirers in the form of BIN files and it is extremely easy to add arbitrary mapping. So if someone gets an unnecessarily large prefix like "1" then the next day you can change it easily to ten prefixes "10", "11", "12" and so on and have a different organization for each.

r00fus 6y ago

Wouldn't the Luhn algorithm checksum [1] limit the available digits? It is specifically there so a one-off error doesn't result in a charge going to a valid other account. [1] https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm

senkora 6y ago
I believe that’s what they mean by “check digit”.
contravariant 6y ago
Most checksum algorithms that I know of for credit card numbers only decrease the number of available digits by 1. Or equivalently it increases the length by the length of the checksum (usually 1 for credit cards) and doesn't otherwise affect the available numbers.
bausano_michael 6y ago
Great video on checksum was done by Ben Eater: https://youtu.be/ppU41c15Xho https://youtu.be/ppU41c15Xho

Aeolun 6y ago

The only real solution to being able to do things the Japan way is to increase the number of digits. Think of all the extra information we could encode in the number! They also cannot ask for an extra prefix, since all their forms and systems assume the same prefix is used everywhere. (Note, I have no idea if this is actually the case, I’m just extrapolating from my experiences here)

segmondy 6y ago

Your comment is ridiculous. The number has structure, you don't get random IP addresses if you're a company. You get a block, likewise card issuers get a block (BIN - Bank Identifier Number) then add in the checksum, that definitely means you can't just assign random number. Imagine you have a random number. Visa get's the number and a charge for $20. Who owns it? They now have to search through all possible issued card number to find the card issuer. However with the BIN, they can do a pattern matching and send the info to the card issuer to determine if the card is valid. Think of the implementation details, those before you are not idiots as much as you may think they didn't think things through.

HenryBemis 6y ago
My thoughts of this made the parallelism with IP addresses. Japan's issue can be solved by "buying some numbers" from much smaller countries. The solution to reuse a number is bat shit crazy. Perhaps they can use expired cards (and not cancelled). In the long run the sensible solution (just like IP addresses) is to move from a "IPv4" system to a "IPv6" that will largely multiply the available numbers per country/bank/entity and will solve the problems, for the next many decades.
rswail 6y ago
What the OP said was that even with a 6 digit BIN and 1 digit check, you have 9 digits available per BIN. For example, Mastercards start in the range 51 to 55. That leaves 4 digits of the 6 digit BIN to allocate to MC issuers. So that's a total of 50K issuers of MC world wide, then each of those issuers can have 1 billion cards. So each issuer of a MC in Japan can issue a card to each member of the population and only use an eighth of their allocated range. The problem isn't the individual card account ID, from the article, it sounds like Japan has been allocating too many BINs.
- hrktb 6y ago
  > an eight of their allocated range Assuming your calculations are correct, this means an issuer can only emit 8 cards in average to the total population. Cards have an expiration, people lose them, break them, they change and come back to banks. For the main issuers it’s not ridiculous to have to issue 20 or 30 cards per account to a user in their lifetime. Then people have multiple accounts (e.g. my mortgage was on a separate join account). There’s just enough normal circumstances to run out of numbers, not even considering freak cases.

supernova87a 6y ago

You know that not every possible number is used, right? It's much more sparse than that.

sgjohnson 6y ago

No bank does addressing like that. Amex for example have got only 6 digits per prefix. 15 digit card number, 6 digit BIN, 7 digit account number, 1 digit representing which card it is (1 for the first, and it gets bumped up with any replacements), and 2 digits for the position on account, allowing you to have 99 supplementary cards on account that can then be identified. Obviously this is just Amex and it's an absolute non issue for them seeing that they own the entire 37 and 34 range, but I can assure you that virtually no financial institution actually use all of the 9 digits like that.

bamboozled 6y ago

> If you can't give folks a number from SIXTEEN digits - something is wrong with the folks giving out the numbers. I hate saying this but I'll say it anyway, as someone who has spent considerable amounts of time trying to get things done in Japan, I would say that you're right. There is likely some ridiculously inefficient process which obviously requires changing but for cultural reasons it's hard to change things so they're stuck in this strange situation.