4 ms·

The credit card fraud is to me the worst, as any random number might actually match an existing one, and back in the days I wouldn't expect much scrutiny from t

The credit card fraud is to me the worst, as any random number might actually match an existing one, and back in the days I wouldn't expect much scrutiny from the card processor. That's then up to the poor soul who's number was used to go through paperwork purgatory to dispute the charge. Orherwise ISPs are the poster child of monopoly giants that had to be broken down kicking and screaming, but kept screwing the customer over and over because there is litteraly nothing that we can do about it (voting won't help). They can burn in hell I wouldn't care.

jamal-kumar 4y ago
Back then it was a giant pain in the ass. These days isn't it a lot easier to deal with that? You basically just get on the phone with equifax/transunion and upload some documents. Guess that trial and error had to start somewhere. Also I really wonder what the mathematical chances are that the card actually matched with someone back then. Like obviously a collision risk here but how large?
- makeitdouble 4y ago
  There's 12 random numbers, and I assume banks reject some numbers based on obviousness (e.g. all 0, all 1s, 1234, all 3 groups are identical etc.) so I'd assume there's actually less probability space than what we'd expect. Even if it's still a pretty huge space.
  - nickles 4y ago
    Credit card numbers aren’t entirely random [0] https://medium.com/@ma.juber/mathematics-behind-credit-debit-card-numbering-340bf68d27d2 https://medium.com/@ma.juber/mathematics-behind-credit-debit...
    - makeitdouble 4y ago
      Sorry I think I'm missing it, does that page explain somewhere how the 12 digits that are not set by the MII/IIN and check digit rules are not random ?
      - hnbad 4y ago
        It says the first six digits are the IIN (and the first one of those is the MII). So if you have fourteen digits, one of which is a check digit and up to six of which are non-random, that leaves only seven truly random digits per issuer, i.e. a pool of 10'000'000 (10^7) numbers rather than the 1'000'000'000'000 (10^12) possible numbers claimed elsewhere. Of course the actual pool is different as the number of fixed digits seems to vary per issuer and for some it seems to be only one.
cbhl 4y ago
IIRC in the 90s online credit card processing was a minutes-long affair since it would require dialing into the bank's computer system, or possibly calling a human banker to check the authorization. IIRC it wasn't uncommon to just do it offline with physical pieces of paper in the mail. Towards the late 90s they got better at rejecting CCs if you did authorize online (especially after PayPal gave away a lot of $5 prepaid ones). ISPs were also pretty liberal with free trials (AOL CDs galore) since it was mostly customer acquisition cost (it wasn't yet established that you had to have an Internet connection like you did a landline and Cable TV) and the marginal cost was low (ideally, the cost of peering -- the ISP basically had some routers and modem banks between an internet exchange and a phone exchange; and the user paid any applicable long distance charges to call the ISP). Whereas now you'd preauthorize the card at signup time to catch this sort of fraud beforehand.
suyula 4y ago
If every human being alive today (~8 billion) had a valid Visa card (14 digits not counting the beginning 4 and the check digit), there would be a 0.008% chance of a collision.
- makeitdouble 4y ago
  I kinda agree with the low probability, but you also ignored the article (he’s faking mastercard), and I see 12 digits not 14. Also, not every valid number will be used (e.g. all 0s won’t be an option), and every number don’t need to be valid at the same time. If I renew 25 cards, their numbers are burned with no reuse. That’s a long way to say, I’m not a fan in general of throwing in naive probability calculations and calling it a day.
  - makeitdouble 4y ago
    Correction, there’s actually only 7 digits at most of randomness https://news.ycombinator.com/item?id=31605950 https://news.ycombinator.com/item?id=31605950
    - quesera 4y ago
      There are generally 9 "random" digits in a 16-digit Visa/MC card number. The BIN/IIN is traditionally the first 6 digits. Extended BINs can be 8-11 digits, which is like subnetting -- the BIN sponsor can delegate assignment control of an extended BIN range to another entity. So in some cases, there can be as few as 4 "random" digits in the full card number (PAN). E.g.: BIN "random" Check 411111 111111111 1 ExtendedBIN "random" Check 41111111111 1111 1 If you were sweeping a PAN range for live numbers, you'd start with a known-valid BIN, probably 6 or 8 digits. Then randomly choose the next 9 (or 7) digits, and then calculate the check digit. We can't know the likelihood of hitting a valid number without knowing the count of assigned PANs in that BIN, but clearly the capacity would be 1 billion (or 10 million) possibilities.
toast0 4y ago
Dial-up ISPs were the poster child of anarchistic markets. If you could get a data T1 and a PRI T1 and some modems, you could run an ISP. When your PRI fills up, get another. When your data fills up, get another. Etc. A lot of those were pretty small operations (which is why the author had to get friends to call in). There were a pretty good number of nationwide ISPs to choose from too, if you wanted something less fly by night. A whole heck of a lot of consolidation happened since then of course. But even the winners of dial-up pretty much lost to cable and baby bells. It was easy to setup a dial-up ISP, but it's darn hard to setup a broadband ISP, so we're stuck unless you can convince the FCC that the 1996 Telecom Act applies (might need some court work as well) and we can get mandatory line sharing back.

jamal-kumar 4y ago

Back then it was a giant pain in the ass. These days isn't it a lot easier to deal with that? You basically just get on the phone with equifax/transunion and upload some documents. Guess that trial and error had to start somewhere. Also I really wonder what the mathematical chances are that the card actually matched with someone back then. Like obviously a collision risk here but how large?

makeitdouble 4y ago
There's 12 random numbers, and I assume banks reject some numbers based on obviousness (e.g. all 0, all 1s, 1234, all 3 groups are identical etc.) so I'd assume there's actually less probability space than what we'd expect. Even if it's still a pretty huge space.
- nickles 4y ago
  Credit card numbers aren’t entirely random [0] https://medium.com/@ma.juber/mathematics-behind-credit-debit-card-numbering-340bf68d27d2 https://medium.com/@ma.juber/mathematics-behind-credit-debit...
  - makeitdouble 4y ago
    Sorry I think I'm missing it, does that page explain somewhere how the 12 digits that are not set by the MII/IIN and check digit rules are not random ?
    - hnbad 4y ago
      It says the first six digits are the IIN (and the first one of those is the MII). So if you have fourteen digits, one of which is a check digit and up to six of which are non-random, that leaves only seven truly random digits per issuer, i.e. a pool of 10'000'000 (10^7) numbers rather than the 1'000'000'000'000 (10^12) possible numbers claimed elsewhere. Of course the actual pool is different as the number of fixed digits seems to vary per issuer and for some it seems to be only one.

cbhl 4y ago

IIRC in the 90s online credit card processing was a minutes-long affair since it would require dialing into the bank's computer system, or possibly calling a human banker to check the authorization. IIRC it wasn't uncommon to just do it offline with physical pieces of paper in the mail. Towards the late 90s they got better at rejecting CCs if you did authorize online (especially after PayPal gave away a lot of $5 prepaid ones). ISPs were also pretty liberal with free trials (AOL CDs galore) since it was mostly customer acquisition cost (it wasn't yet established that you had to have an Internet connection like you did a landline and Cable TV) and the marginal cost was low (ideally, the cost of peering -- the ISP basically had some routers and modem banks between an internet exchange and a phone exchange; and the user paid any applicable long distance charges to call the ISP). Whereas now you'd preauthorize the card at signup time to catch this sort of fraud beforehand.

suyula 4y ago

If every human being alive today (~8 billion) had a valid Visa card (14 digits not counting the beginning 4 and the check digit), there would be a 0.008% chance of a collision.

makeitdouble 4y ago
I kinda agree with the low probability, but you also ignored the article (he’s faking mastercard), and I see 12 digits not 14. Also, not every valid number will be used (e.g. all 0s won’t be an option), and every number don’t need to be valid at the same time. If I renew 25 cards, their numbers are burned with no reuse. That’s a long way to say, I’m not a fan in general of throwing in naive probability calculations and calling it a day.
- makeitdouble 4y ago
  Correction, there’s actually only 7 digits at most of randomness https://news.ycombinator.com/item?id=31605950 https://news.ycombinator.com/item?id=31605950
  - quesera 4y ago
    There are generally 9 "random" digits in a 16-digit Visa/MC card number. The BIN/IIN is traditionally the first 6 digits. Extended BINs can be 8-11 digits, which is like subnetting -- the BIN sponsor can delegate assignment control of an extended BIN range to another entity. So in some cases, there can be as few as 4 "random" digits in the full card number (PAN). E.g.: BIN "random" Check 411111 111111111 1 ExtendedBIN "random" Check 41111111111 1111 1 If you were sweeping a PAN range for live numbers, you'd start with a known-valid BIN, probably 6 or 8 digits. Then randomly choose the next 9 (or 7) digits, and then calculate the check digit. We can't know the likelihood of hitting a valid number without knowing the count of assigned PANs in that BIN, but clearly the capacity would be 1 billion (or 10 million) possibilities.

toast0 4y ago

Dial-up ISPs were the poster child of anarchistic markets. If you could get a data T1 and a PRI T1 and some modems, you could run an ISP. When your PRI fills up, get another. When your data fills up, get another. Etc. A lot of those were pretty small operations (which is why the author had to get friends to call in). There were a pretty good number of nationwide ISPs to choose from too, if you wanted something less fly by night. A whole heck of a lot of consolidation happened since then of course. But even the winners of dial-up pretty much lost to cable and baby bells. It was easy to setup a dial-up ISP, but it's darn hard to setup a broadband ISP, so we're stuck unless you can convince the FCC that the 1996 Telecom Act applies (might need some court work as well) and we can get mandatory line sharing back.