Slashdot Mirror
AmEx To Offer "Disposable" Credit Card Numbers
A reader writes "American Express is going to allow card holders to access one-time use card numbers for purchases online. Not only could this cut down online credit card fraud but it might lead to anonymous purchases. " I'm not sure this gets us closer to totally anonymous purchasing, but it does mean that you can take more steps to protect yourself in online purchasing - now only one megacorp (Amex) could have your records!
But not entirely like cash... It can still be traced to _you_ if Amex add the one-shot CC to your ordinary bill...
What I'd like to see is something akin to the phonecards - go into any supermarket/corner shop, hand over the moolah (in cash) and get a card worth the same amount. That's as close to untraceable cash as you'll get...
Strong data typing is for those with weak minds.
Strong data typing is for those with weak minds.
But back then they were called "card generators" and you didn't have that nasty problem of someone actually wanting *money* for your anonymous purchase :)
...That's where. :)
The combination of date, temp-ccnumber, and amount makes for more digits. These are checked against your original ccnumber when the transaction is sent to the card-issuer, which is more digits.
Simple version:
store submits charge.
if (temp-ccnumber-digit16) XOR (original-ccnumber-digit3) XOR (day-of-week) == 6, you pass the test.
Pass a suite of such tests, charge is authorized.
Don't expect AMEX to tell you the actual checks performed. Only a small portion of possible checks need be "in force" during a given week or hour, too.
[
Yuck.
lf.o
Even though ever web designer in the world seems to think that a credit card number is 16 digits, the specs say they are 19. Take that and stuff it in your database :-)
(you know, the one where the governemnt has monitoring tools like Echelon and Carnivore)
Anyhow, in hypothetical bigbrotherland, when you get cash from an ATM, it's trivial to include a reader into the ATM that will grab the unique, prominent serial numbers on the bills it gives you (in nice, clear, easy-to-OCR type donchaknow), and correltaes that money to you, a specific individual.
Now you spend this twenty (yuppiebuck) at the market/gun club/peepmall and, being a twenty, it will most likely not be given as change to another customer, but will go straight into the deposit pouch that the store gives to their bank at the end of the day/week.
The bank scans the money, correlates the serial numbers again, sees the path of the bill, and generates reasonable probabilities of the path it took through the system.
Do this for a while and you get statistical certainties on cashflows, who spends what where, telling more about a person's cash habits than an FBI interview would.
I've no idea if the system exists currently, but it's preposterous to think that cash is really anonymous, because cash literally isn't anonymous as long as it has a serial number. It may be anonymous enough for a given purchase, but in the aggregate it tells a great deal about you.
Kevin Fox
Kevin Fox
Have you been to a Radio Shack or Sears lately?
Those stores, among many others, try to get your personal information even if you want to pay cash. I remember arguing with a sales clerk for twenty minutes about whether or not I *had* to give my name and address to buy something with cash. He claimed that he couldn't complete the sale without the data. We finally had to call over a manager to deal with the issue.
Experiences like that just leave me feeling icky...
Isn't the point that you wouldn't have to give out your CC # unencrypted to anyone?
Yes, if they got your card number you'd be equally screwed, but this would potentially insulate you from merchants, dumpster divers, etc. from getting your number off the receipts.
I seem to think that if the cc companies have the opportunity to add A LOT more value to this one time credit card venture easily then they will, the writer of the article seems to think its about privacy also, you dont, do you have other information that you can share with us?
Sneakemail is to spam filters what an ounce of prevention is to a pound of cure.
The first 6 are the BIN number. These are assinged to the banks or creditcard companies in major lots (so MasterCard gets only 5.* and Visa gets 4.*) but there are other 5's that have been assgned to non MasterCards. The short answer is that two cards with the same first 6 number will be issued by the same bank. Currently a given BIN range is also used to tell if its a "gold" as well.
Different countries tend to use different number schemes. The US tends to use nice blocks of well defined numbers which makes scanning trivial. Other banks have even used fully random assignements.
There is no check digit. The "mod 10" system used simply says the sum of the even digits plus the sum of the odd digits x 2 will be a nice mod 10 number. Go look at some of the perl code that does the check and then write the routine in assembly on a machine with BCD instructions. One is about 5 lines and the other isn't. The system was designed to catch transposed digits. if the card is 1234 then the system will catch 1324 and 2134 but not 3214 or 1432. These is also a 1 in 10 chance that bad card number will correctly checksum. Keep in mind that there are still places where those numbers are routinely hand keyd.
Ctimes2
My cube. My friend. My solace. My prison.
I saw this idea a few months ago, offered to me by my credit card company. I assumed they'd charge the amount to my regular card, and send me a finite-amount card.
Contrary to all the posts here, they were promoting them for use as gift certificates. Interesting idea.
Well, since we're talking about one-use-only numbers anyway, I don't see very much of a difference between transmitting the number to the merchant encrypted or unencrypted, since it's going invalid right after that anyway.
As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
US banks tend to verify it but many banks world wide don't. I do know that lots of system had the date check rejecting turned off for y2k and I suspect its been turned back on my now but maybe not.
As I said, we're talking about one-use-only numbers anyway. I don't see very much of a difference between transmitting the number to the merchant encrypted or unencrypted, since it's going invalid right after that anyway.
As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
What I'd like to see is something akin to the phonecards - go into any supermarket/corner shop, hand over the moolah (in cash) and get a card worth the same amount.
What I'd like to see is something akin to money - go into any supermarket/corner shop, pick up what you want, hand over the moolah (in cash) and get a box of groceries worth the same amount. Plus you wouldn't have to wait for delivery, like you would online.
If that sounded sarcastic sorry, it wasn't meant to be.
Michael
...another comment from Michael Tandy.
"Goodness me, how unlike the FBI to abuse the trust of the American public." -- The Onion
There is no incentive for a private corporation to share customer data with federal, state, or local governments, especially when that data will frequently include their own directors', managers', and employees' information. The accounting department is more likely to be spending time finding ways to state the accounts so as to lower taxes, while the people who are most likely to be using the above SQL code are the ones in marketing departments, you know, for sales and profitability purposes.
The best uses for disposable credit card numbers are to discourage tracking via account number by vendors(harder to join multiple purchases when the common factor isn't a single number field) and to reduce the risk that a cracker will access a vendor db and get active account numbers.
I do not have a signature
Didn't these prepaid cards already come out? I seem to remember reading (somewhere on /.) that these were available at your local 7-11. Link anyone?
You can add four digits because the required "expiration date" becomes arbitrary, can't you? Puts it back up to 10^16, maybe that helps? It can also give a "series number" for recycling. Say, use expiration dates with years around 50 years in the future...
Start disposable credit cards, just like a phone card. Go to a supermarket or mall and pay cash for a "prepayed" credit card.
The float would be a great profit center.
But this would be a debit card on a cash account. Get it recharded when it runs out. Great way to launder cash too.
Fight Spammers!
This would even protect you from the Club Card stores associating your credit card with your club card. Say that you pay cash for everything and also keep several club cards with bogus information on them. If you slip up and accidentally use a credit card, they can link up the club card accounts based on your CC number. With the new technology, they would not be able to do that so easily.
Walt
It seems to me that what would make the most sense would be that every account (with a regular old account number) would be linked to a number of "sub-accounts" that would be generated on demand.
In short, the scheme seems to work like this:
1. The AMEX system would open the account, linking it to a master account.
2. The merchant then processes a transaction against the account.
3. The account is set up to automatically close after one transaction is posted.
4. The balance of that account is then transferred to the master account.
Disclaimer: I don't know that it works that way, it just my inferences based on the article.
The numbers could be linked to a master account by running the account number through some kind of one-way algorithm. Or maybe by picking them out of a pool of available numbers and assigning them in sequence.
In any event, it's a really interesting approach, although I'm afraid that the number of valid mod-10 account numbers will diminish quickly. Sort of like the way IP addresses have.
What I find MOST insteresting about this strategy is that it cuts down on an online merchant's ability to invade my privacy by using credit card numbers to link information in puchasing databases.
Incidentally, not having to pay for it is a different thing from the fraudulent charger being prosecuted. The fact that I can get stolen from, but since what to me is a significant amount is miniscule to these companies, means that ultimately these crimes go mostly unpunished.
---
"The Constitution...is not a suicide pact."
"Life. Don't talk to me about life."
That was four years ago, when I was in Swindon the pilot had been running for 2 years and nobody really used it. I guess that it was abandoned, 'cos I've not seen it elsewhere since... (now livinf in London)
Maybe with this newfangled internet thingy getting popular, it may be worth another go...
Strong data typing is for those with weak minds.
Strong data typing is for those with weak minds.
While a respectable attempt at making online purchases more secure, I think this will ultimately be a failure.
Obviously, American Express will have to get the disposable numbers to people in a non-secure manner. The only thing more nerve racking than having a credit card sitting in a mailbox where people can steal it is having several credit card numbers that don't require activation sitting in a mailbox where people can steal them. Of course, that statement makes some assumptions, but I think they are safe ones.
How will they get the numbers to people? The internet? That's self-defeating. Via a phone call? Too many chances for human error. Especially when you consider that number will need to be even longer than they are now to avoid repeating. Snail mail seems to be the obvious answer.
And what about activation? If the single-use numbers require an activation phone call, they'll be too inconvenient to use.
This isn't the right solution, but it does show that the big players are looking for one. And that's a Good Thing(tm).
We must respect evil, and we must make evil respect us.
Regarding your third point: AmEx is not offering disposable numbers to just anyone (check the article). They are offering them to their customers -- i.e. people with AmEx accounts, who thus, one presumes, have met AmEx's standards of credit rating, etc. Thus this is no different than already having a credit card from AmEx, except that it can't be stolen (online). The numbers being instantly available on-line just means their customers will be more likely to go to the minimal effort of getting the more secure disposables rather than just typing their real AmEx# into ghu-knows what website.
So the billing (wrt your second point) is no different: you get it on your AmEx card bill, is all.
Think of the disposable # as an alias for your real number. In the same way people use hotmail accounts as disposable spam-filter accounts, these AmEx#s are disposable theft-filter accounts.
So to use this, you need to apply for a regular AmEx account, and then you can get the disposable #s.
----------------------------------------------
-*- Any technology indistinguishable from magic is insufficiently advanced -*-
-pf
Make affiliate bucks
I don't know who you talked to but I haven't found anyone that liked them that wasn't pusshing them. They take forever compared to cash. The only places I've ever seen that take Mondex just happen to be very close to MasterCards offices. There is also the issue of what happens when the card gets broken. I can still spend broken cash, a broken Mondex card is worhtless along with all the money stored on it.
Sorry, but this seems funny to me - the term "The income tax people" sounds like a corporate slogan, i.e.
Network Solutions: The dot com people.
The US Government: The income tax people.
But, first a personal aside, I'm a staunch capitalist, fiscal conservative, libertarian (i.e., less government), but when the US halls of power are run by whores prostituting their votes to the biggest special interest (lobbying group) I get angry! But, I believe there is hope, I've seen momentum building for nearly a decade against the influence that nothing decried by Americans seems to stop. Namely, abuses like nearly nil protection for Americans wanting control (less full control) over their personal information. It always comes down to the deep pocketed, with the aid of the power in charge of the capitol, who quickly reverse their moral stance against such a position as soon as they gain power, calling the agenda. Just such a thing occurred when the GOP gained the House and the Senate, lost to them since the 1950's, after the 1994 mid-term national elections. Riding the wave of change which Americans were churning began by the election of new young president, representing a new attitude - by Americans, not the man himself, he was just par for the course - there was an expectation for some real change to occur. Apparently not. Or should I say, it's still coming - that's my read.
I see parallels, a new synergy, more importantly I see different manifestations of the same root gripe, in the violent/vigorous demonstrations in Seattle, Washington last year. Similarly, with protests during the presidential nominating conventions just a few months ago. The French farmer who defaced the local Mc Donald restaurant is part of this too. It's part of a sentiment which seems at first unrelated. No, not that globalization sucks, I'm not a socialist for heaven's sake. Rather, that individuals are, for their myriad reasons, angry and fed up with the naked purchasing of the process. The British have their euro-skeptic stance toward EU membership and the lack of sovereignty that Belgium running bureaucrats might exert over their national identity. Similarly, I see American's saying to hell with ridiculous patents made grant-able by a PTO obliged to follow guidelines paid for by deep pocketed interests investing (you call it tomato, I call it graft; others lobbying, political donations, and others soft money contributions) in the extension of their monopolies. It sure looks like corporate socialism. Further, UCITA, DMCA, lack of control over personal medical information, financial information, driver's license information and/or photographs. On and on it goes.
I sure get sick and tire of being sick and tire about this. Listen, I'm not saying that it's the end of the world, but I sure as hell don't like to tell Amazon to take a flying a leap if they do a 180 on their privacy policy as easily as I prefer to just get results, if a disposable credit card number is one more weapon in my arsenal, great. But, as has been mentioned AMEX will just have the field all to itself. No ifs, maybes and of buts. Unless they apply something viral like a GPL kind of concept (policy won't change unless 100% of users give explicit permission, say) they'll ride you too, in their own way. Fuck that!
Anyway, that leaves just one route for total privacy, either go the JD Salinger way: no credit cards, no phone number, no driver's license a reclusive sort of existence. Or lots of buffers between you and the world, a little Godfather thing here. ;-) Become Amish. Or, do the Howard
Hughes thing, in later life mind you, incorporate yourself, use corporate
shells, credit cards, etc. Nothing nefarious, you're just a guy, gal who
likes to keep control of your destiny. After all the facts of your life
are your personal history. And I shall write mine own. Nobody will read
this anyway.
Me pican las bolas, man!
Thanks
--
Me pican las bolas, man!
Thanks
Jaco
Someone else encrypts your card number...
Well, how does that "someone" gets your card number in the first place? The idea of the system is that you never transmit this new card number in clear.
There's another weakness, though and here's the fix: the merchant's (public) key needs to be signed by Am Ex, so that a merchant can't send you a dummy public key for which it has the private key and decrypt your number. I can't find other weaknesses for now...
Opus: the Swiss army knife of audio codec
AMEX was supposed to release details on this at 0900 PDT today. Is there a link yet?
Viola! Vendors never see my card info, but get assurance of receiving payment.
You could, potentially, take it another step. Once I had gone to the credit card companies' verification site once, the card company could, maybe, store a cookie in my browser (which cookie would not contain any of my credit card info, but just an index to my database record from my last visit). In the future, when I was redirected to the card companies site for verification, they could check that cookie, ask for some sort of pass-phrase (obviously cookies aren't the most secure thing in the world), and ask me if I want to use the card info I've already submitted last time, or use another card.
The income tax people will FREAK on this.
This is why offshore accounts are illegal!
(1st?)
do you have other information that you can share with us?
Did you mean that in a snide way? I could ask you the same question. I don't think there is any other information. I think it's pretty clear that this is not a privacy enhancing program. I'm not an expert on this, but IIRC the contractual relationships between the credit card companies and the merchants and the credit rating agencies require that all of them get access to your identity.
They exist.
I got ads for 'em with my credit card statement around Xmas last year. They were intended as gifts.
A disposable credit card is an interesting idea, but unless it's possible to refill the card (thereby defeating part of the reason for having one), it means we'll have the same problem we have with disposable phone cards: they get thrown away with money still on them. After normal use, there's always a small balance that can't be spent through normal use, and the credit company will stand to rake it in as pure profit.
As far as monopolies go, they are a result of capitalism. But the companies you mention have hardly been guilty of terrible things. Sure, bad music and bad movies may come out of the closed town of hollywood, but its been our choice to watch that crap. Microsoft has consistently provided people and companies with what they wanted, relatively cheap and easy to use computers. Apple isn't cheap, and Unix isn't easy. They crapped the middle ground which is filled with mediocre people. Now people want to have the benefits of a standardized desktop only possible with a monopoly, and they want to set the prices on it also. It is completely wrong to use force against a company when alternatives exist, and to justify it with some crap about a free market.
The free market forces that free software is putting on Microsoft will eventually chip away at Microsoft, relegating them to life as an application company. The writing is on the wall for MS already.
An interesting thing to not is how much /. readers hate monopolies, but they get into religious wars about which OS (editor, shell, gui, etc) to use. For example, I think many people would like to see everyone work on just Linux, and not BSD. This also would stifle creativity, and alternatives and force the user down certain paths. Then again, I think most /. readers contribute absolutely nothing other than flames to free software as a whole.
I've digressed, and I don't mean to have a tone that I'm attacking you. I'm just espousing my views that somewhat relate to what you were saying.
t
Why not just jump to smart-cards, like civilized world?
<^>_<(ô ô)>_<^>
I think many of you will be interested.
the only way that it provides anything like anonymity would be for a merchant who keeps the customer file keyed by credit card number and would thus fail to match up your different orders. But, (1) merchants don't do this, and (2) if they did, they would change. It's not anonymous.
Given the fact the customer liability is limited to $50 (in the US) in case of credit card fraud, this is primarily to protect the credit card companies from dealing with all the complaints, both from users and merchants. If it's a one time number, then you cannot argue anymore that someone stole your number. Bottom line: good for AMEX, no change for you and me.
I feel pretty safe buying online, but the main reason most people don't is because the don't "feel" safe doing it. If they can come up with more ideas like this I think E-Commerce will do even better with the average user.
An AMEX Card has 15 numbers, and is always in the following format:
The first two digits are alwys 37 for AMEX, and the last digit is a LUHN10 checksum (I wrote some groovy code in VB to calculate this). That makes 10^12 possible valid card numbers.
Another dirty secret is that several online Credit Card processors don't actually check expiration dates, so that elminates the possibility of using it to allow for duplicate assingments.
...and I'm talking about cryptological permanant credit card numbers that cannot get compromised
Opus: the Swiss army knife of audio codec
Only one megacorp would have all your information, but they would have a very, very strong incentive to protect it, and make amends should it be breeched. This is a good sign of capitalism working like it should....without government intervention.
t
Lots of stores (like buy.com) allow $10-$30 discounts for first time customers. Most stores (buy.com for sure) verify this through the use of the credit card number. If the credit card number has never been used before, they'll let you have the discount. Otherwise, you'll have to pay the normal price. I ... er, someone I might know ... has purchased several items from buy.com under different credit card numbers for just this reason. Now, with disposable numbers, I^Hhe will be able to get a discount every time!
Did a credit card company come up with this? This is actually a great idea-- I'm really impressed. While it isn't digital cash, it still seems like a good idea. If nothing else, it will make people more confident with giving the number out, rather than feeling like a year from now some guy will trash them and then start carding TV's from Best Buy.
Pretty cool. I wonder what kind of tracking database they'll use to match people with their purchases. If there were a privacy guarantee, it would be even better, but I guess that that is wishful thinking.
In other words, trusted third party (as in Kerberos). See Bruce Schneier, Secrets and Lies: Digital Security in a Networked World, for some of the interesting pitfalls. Trust me, some perp will figure out a way to use it in a way that the vendor never expected nor wanted.
According to this month's Wired, Amex does not accept online-porn retailers because there's too much fuss involved (customers denying purchases, fraud...)
I wonder if this card will change their policy regarding online smut.
\_O_/
/
/ \
W===D
Penis-surfing man.
how long before a cryptologist breaks the algorith to determine whether the number is a valid entry? at that point, we'll have tons of fake cards and stuff getting billed to the wrong person.
it will end up being just like those $5 calling card scams that you see in NYC all the time.
Does the ATM, bank, or liquor store know where you are going and how you are spending the money?
Assuming that using a disposible cc number is anonymous, (why wouldnt it be, it would be like a phone card), by using this and sneakemail.com an "e-consumer" would have much more control over his/her purchasing identity and power over junk in their mailboxes (both snail and e) and more importantly, would significantly impact the very valuable side effect of current purchases - customer data. By drying up that source of data we might effect businesses hunger for it, turning their desire elsewhere (maybe towards quality), and be closer to turning an ebusinesses view of the internet as a black box that their goods go in and money comes out. Of course the danger is that cc companies see the value and start selling customer data back to the ebusinesses.
Sneakemail is to spam filters what an ounce of prevention is to a pound of cure.
Let me see if I got this right, then...
Only one company would have access to this particular resource, and would zealously protect it from other companies, because having exclusive control of this resource gives it an extreme advantage...
Isn't this what is usually refered to as a monopoly?
And while I suppose that monopolies are a natural result in captialism, arn't they usually an undesired one? With unplesant effects on the market as a whole? *cough* microsoft/time warner/RIAA/MPAA *cough*
1) All we need now is some 1337 $cr1pt k1dd13 to h4x0r American Express's web site and they will have ALL of AE's card numbers, not just a few thousands.
2) How long will it take someone to reverse engineer AE's algorithm for creation of CC numbers? All one has to do is h4X0r some shop that has a few thousand of these, and with some patience, I'm sure they can figure out how the number is created. Then they can start pumping out CC's all day long.
This is progress?
Burn Hollywood Burn
Time-related as well. They can recycle them over a period of time. Numbers would be valid for say, 24 hours or some such thing, and then recycled (but not active until reassigned.)
You go to the amex secure site, identify yourself, and they give you a one-time-use number for the transaction. YOu use it.. done deal.
A week later, they can use the same number again.
It's a sad day when a helpful tip meant in good spirits gets moderated as "Flamebait"... offtopic, yes, flamebait, no.
--
"It's tough to be bilingual when you get hit in the head."
First, there is no justice. You should have been modded up (+1, Funny).
The thing is, if Amex uses the same "bank number" (first four digits) as for their other cards, there won't be an easy way to filter these, like there is with WebCertificate that always uses the same bank number. (BTW, I've never run across or heard of a site filtering based on bank number--I would be interested in knowing of any.)
If more companies get in on the act, they aren't going to be able to tell if the card is good for recurrent billing unless that's made part of the authorization scheme. And other companies are getting in on it. I received an ad from AAA of all places offering "stored value" (a.k.a. disposable) Visa cards.
From what I can tell from reading the article, this is not an attempt by AMEX to provide either anonymity or privacy, but rather a security measure.
If you get a tempCC and give to an e-tailer, and
Joe "31337 h4x0r" cracks the e-tailer's database, all he gets is an expired tempCC number. AMEX is not doing this out of the goodness of their hearts, but in an attempt to cut their fraud losses.
Never attribute to altruism that which is explainable by self-interest.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
I'll have a special expiration date so that it will differenciate [sic] between me and some other person who got this block before
Or, given the nature of these cards, maybe they'll only be good for one month. That way, they can re-issue every available number every month or two.
Just junk food for thought...
You forget the expiration date on the card. No transaction is complete with out that. It adds an extra 4 digits and would allow reuse of numbers.
--locust
Second, how will AMEX ensure that you will pay your bill?
If I understand this correctly, the disposable number will be linked to your normal, non-disposable AMEX card. AMEX will still have all your details, and any bills you run up will acrue to your regular account, but the number will cease to be valid after one use, so that an unscrupulous merchant can't run up extra charges on it after you've paid for what you meant to pay for. They will probably have to have some sort of mechanism where merchants with legitimate complaints can add an extra charge after the fact (like if you use it to pay for a hotel bill, but then they found you stole all the towels).
Think of it as just a symlink to your regular card, one that you (or AMEX) destroy as soon as it's fullfilled its purpose.
I conceed your first point, though, that the process of getting the disposable number from AMEX is just as prone to interception and theft as any credit card purchase, but I think the real problem with credit card fraud so-far has been unscrupulous merchants adding extra charges (like double billing) and/or idiot merchants leaving your credit card number on their system where it is stolen by crackers and script kiddies. This concept addresses both of those problems.
--
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
If we were using the truly anonymous cash card (phonecard machine type), then couldn't the government just tax the purchase of the card itself, and stop worrying about it?
But then, how not to re-tax the sale itself, differentiating between a cash card and a credit/debit card...
And then, that would require the identification of the location where you purchased the cashcard, which would be worse in terms of anonymity than current credit cards. And odds are the government would be perfectly happy to tax twice, and..
Oh, nevermind.
---
"The Constitution...is not a suicide pact."
"Life. Don't talk to me about life."
So they can add some things that 1) makes more numbers available, and 2) makes them harder to make up... How about using number AND letters? Maybe symbols too.
You could have card number: 1F$S U3@1 H94o (%K8
<shrug> a thought.
-- Dr. Eldarion --
This may sound like a good idea, but it has its drawbacks.
The first drawback is granularity.
The second drawback is non-rechargability. If recharging devices were available, people would start stealing those and recharging their cards at will. To make this impossible, one has to provide each card with a sort of "shadow bank account" and have the recharger communicate with some central authority. Then, you could desable known stolen rechargers.
The third and worst drawbacks is that if it's an electronic device, you can fake it. I spent some time in 1996 assembling a microcontroller-based board that could pretend it was a German phonecard. No one would introduce a payment card that could be faked this way. In order to stop this, one has to introduce either advanced secret card signing algorithms, which are sure to either leak out or be faked sooner or later, or use shadow accounting like with the German GeldKarte ("money card"). Again, anonymity and non-traceability can no longer be guaranteed, and the advantage will be gone.
A very good introduction how the German GeldKarte payment card system works can be found here. I'm sorry that it's all in German, but the system is specific to Germany, so most people wouldn't bother to translate it. You can try the fish, though. An English introduction can be found at Manni's page
.As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
Currently I use a similar variation where I have an account at one bank with a debit card and I only keep a small amount of money in there for online buying. This could be made easier if I could just transfer money to a temporary number while I am shopping, use that number and never have to worry about who has sniffed that number. It would also make tracking my online purchases easier as I would get one statement listing all my debits from my account to temp numbers and a list of the amount of money stored on the temp numbers.
This is not the way to build a lasting empire.
I think virtual cheques would make much more sense. Slap some RSA keys on it and you've got something that could work. Who needs to go in debt when they have money?
---
[ approaching AI ]
This already exists--SecureID--and has been used for years.
One possible guess is: x = credit card number y = passcode t = time (random number generator) z = f(x,y,t) z is then passed to the store t is passed to AMEX (?would this be recorded by the store) AMEX can calculate x from y, z, and t and then send the verification check to the store. What does the store record in their database? Is it z and t? or only z? The next question would be: what is f(x,y,t)?
The scary thing is I've done this hundreds of times and never had any of the sales droids make the connection.
And if anyone just wants a phone number I give them the Police main switchboard number.
Much easier than carrying cash, and I don't have to worry thieves getting access to my Debit Card (long since gave up the credit thing...) and depleting my account and waiting the 8 months for my lousy bank to redebit the 2 grand the fuckers stole and charged up 4 days after reporting it stolen.
I had something like this happen to me, but I did my homework. The bank must provisionally credit your account within 10 business days (unless they asked for written notification and you didn't provide it). They must finish their investigation within 45 business days. If they fail to comply with these time limits, they could be liable for actual damages, plus punitive damages of $100 to $1000 dollars, plus attorney's fees if you actually have to sue them (and you win). Also, the damages could be tripled if it was intentional. I never got that far, as my bank capitulated within hours (literally) of being faxed a threatening letter pointing this all out. These facts are mostly useful for saber-rattling, but if your bank actually took 8 months, I seriously suggest checking with a lawyer to see if you have a case to sue them, because that's completely ridiculous.
If we were using the truly anonymous cash card (phonecard machine type), then couldn't the government just tax the purchase of the card itself, and stop worrying about it? But then, how not to re-tax the sale itself, differentiating between a cash card and a credit/debit card...
Because sales tax varies depending on where you spend the cash, not where you obtain the cash.
So, what happened? Did the manager agree that forcing you to supply a name and address for a cash purchase is absurd, or did he attempt to enforce their policy? (BTW, this is one of the reasons why I have avoided Radio Shacks for years. There's just no good reason for them to collect this information, other than their own marketing purposes, which I don't really give two shits about. The other reason is a general policy about shopping at any store with the word "shack" in its name.)
It's called SET (for Secure Electronic Transactions, and it's been around for around 20 years and was developed by the credit card industry. I guess the industry decided that fraud is cheaper than security.
This is not going to be an easy accounting task: issuing number, tracking their usage, deactivating, then reactivating them. I can tell you that I'm pretty good with logistics (being a police dispatcher tends to develop those skills ) and it'd be a nightmare for me to track.
That's why they would track them using computers, rather than armies of retrained police dispatchers :)
The only way the AmEx method is different is that the numbers are only good one time, rather than being good until the amount of the gift is used up.
There are any number of companies that will issue a physical card with the same characteristics (set balance to debit from) with the difference being that you can use it in non-online transactions as well.
If anyone has the URL of the site where they offer the online-only version, I'd love to have it, as I lost my bookmark file a while back.
"This message is composed of 100% recycled electrons."
Expiration date is not part of credit card verification. Trust me. The next time you order something with your credit card, give a different expiration date. As long as it's in the future, it will work.
The expiration date serves no real purpose.
I suppose, since they already have an account from AmEx, that their name and address would be tied in there as well? Then people couldn't just guess a number and have it work.
-- Dr. Eldarion --
VISA and AmEx have been kicking around ideas to do something equivalent to one time password cryptocards. This is a simple version of the same idea, without all the fancy hardware. If it works, expect the idea to take off with all the major card issuers.
What will probably happen later on is, you will be given an electronic card, with a special token embedded in the circuitry. When you want to use your credit card number online, instead you push a button and a small display tells you the cryptographically hashed version of the card, valuable for a single use over the next hour or so.
The hash function combines a real time clock value, the token, and a counter for each use.
The servers will have a copy of your token, know the time, and keep a local counter. Then the server can compare the crypto hash of your card. If they match, the transaction is authorised. Then later the billing department matches up your hashed number with the real number, and you see the charge show up on your bill.
There are a ton of other little details which the crypto card industry has worked out, but the system mostly works. Too bad this neat methodology will be patented to death, so only the big boys can play with it.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Personally, the "ideal" would be a smart-card on which you could lodge a mixture of cash & credit, do online transfers from any suitable station, and use as a practical alternative to credit cards, debit cards, cheques and cash.
Such systems are being tried out, in the US and UK, but only over small scales. Despite everyone I've talked to liking the cards, the card companies won't put them out for general use. Stupid idiots!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
How does someone go about getting these one time only cards? Do you input your AmEx number online to be issued the new number? Do you call on the phone and customer service type gives it to you? How about mailing it to you (email or snailmail)? The process to procure the numbers would determine whether or not to use the service.
The one hands down benefit is the inability for the business you bought something from to store your *valid* credit card number and expiration in their clear-text SQL Server database.
This may sound like a good idea, but it has its drawbacks.
The first drawback is granularity.
The second drawback is non-rechargability. If recharging devices were available, people would start stealing those and recharging their cards at will. To make this impossible, one has to provide each card with a sort of "shadow bank account" and have the recharger communicate with some central authority. Then, you could desable known stolen rechargers.
The third and worst drawbacks is that if it's an electronic device, you can fake it. I spent some time in 1996 assembling a microcontroller-based board that could pretend it was a German phonecard. No one would introduce a payment card that could be faked this way. In order to stop this, one has to introduce either advanced secret card signing algorithms, which are sure to either leak out or be faked sooner or later, or use shadow accounting like with the German GeldKarte ("money card"). Again, anonymity and non-traceability can no longer be guaranteed, and the advantage will be gone.
A very good introduction how the German GeldKarte payment card system works can be found here. I'm sorry that it's all in German, but the system is specific to Germany, so most people wouldn't bother to translate it. You can try the fish, though. An English introduction can be found at Manni's page.
(Sorry for posting this multiple times :-))
As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
If it was me doing it (It isn't... obviously), I'd have it basically set up as a normal credit card, then (If the person checked a box saying they wanted disposable numbers) every time I sent someone a replacement card (Or they used all thier disposable numbers) I would send a sheet of paper with, say, 10 fresh disposable numbers for them to use as they please. It could work like a big relational database; Every customer has a standard number mapped to thier account, and 10 disposable numbers. Each time a disposable number is used, it is unmapped and put in a big number pool for reuse (It would have to be reused with a different expiry date though). It would be like having a normal credit card, just as easy and convenient, just secure.
I think.
Michael
...another comment from Michael Tandy.
"Goodness me, how unlike the FBI to abuse the trust of the American public." -- The Onion
Although this appears to ba a great idea on this surface, I think this will actually have a negative effect on ecommerce.
The battle to convince the average user that electonic commerce is a safe way to conduct transactions has been a tough fight. We're finally getting to the point where Joe Sixpac does not feel hesitant to shop at Amazon.
A major credit card company saying, "we don't think the present system is secure enough, so we're offering an alternative" will just add to the fears of the average person that shopping online is not safe.
This would have been a good thing a couple of years ago... now it's just a technical harbriner of FUD...
Ok, I'll go file for the patent now. Bye!
--
--
Stay tuned for some shock and awe coming right up after this messages!
(1) Turn off computer
(2) Go to retail outlets
(3) Pay cash
(4) Get scanned by hidden metal detector so the Government can count how much cash you're carrying going in and out of the store, thanks to the little metal strips on the bills. Unless you're carrying rolls of quarters.
Hey, I saw that on the X Files, so that means it must be true, right? Right?
Tongue-tied and twisted, just an earth-bound misfit, I
Learning to fly, Pink Floyd.
Anonymity would be nice, but I don't think that's what they're trying to build here.
see here or here for extra details, including the fact that this will be for American Express consumer and small business cardholders in the United States.
so it's a step, but not a huge one. of course, bill murray said it best in What About Bob - Baby Steps!
/* Half alive and half dead too, work is for suckers and the sucker is you. - "Half-life" by Local H*/
If you take 19 numbers and stuff them in your database you are in all probability going to be violating your agreement with the credit card company. You aren't allowed to store the final three digits (the CVC) at all.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
This service has been available in Ireland since August. It's offered as part of AIB's online banking service. The technology is provided by orbiscom. I haven't actually used it, but there is a demo available.
One of the big advantages of the one time use Credit Card Number is to foil recurring billing. Right now it can be a real bitch to stop that health club/ISP/Record Club from billing the CC you gave them when you first signed up. I've seen people resort to reporting their card lost. With these one time use numbers the recurring charges won't work.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
Although a one time card will prevent repeated attempts to charge you, I wonder if you could place limits on the amount the first time it is used.
More than one merchant has said $58.00, but turned around and charged your card $158.00 by accident (or so they say). Would be nice to place a cap of say $70.
Besides it won't take long for them to recognise the one-time numbers and realize they won't get a second chance to screw you the first time.
Yes, but conceptually, you have just spent the cash, on a piece of plastic. If you don't ever exchange the piece of plastic for your spiffy new shirt, will you ever get your cash back? Then, in essence, a sale has already occurred, regardless of the further expected value of what you have purchased. Semantics, I suppose.
---
"The Constitution...is not a suicide pact."
"Life. Don't talk to me about life."
...if implemented properly. I can't see an easy automagical way of doing it, but this could work:
You decide you want to make a credit purchase
You go to a nice secure link with Amex (128 bit SSL or higher), enter your credit details and receive a one-shot temporary number
At the webstore, you enter your details but use the temporary number instead of your CC number
The webstore talks to Amex and gives them the details you provided them, which is enough for Amex to identify you.
Amex transfers the money to the webstore and charges your card
If you think about it, it's not just the number that can be used to identify you - I wouldn't have a problem, from the point of view of not having my credit card number stolen, with giving my name with the one-shot number - but also the name, expiry date, etc.
Also, if Amex can do this, anyone can. Provided they have a decently secure system, obviously. Imagine this - I set up Anonymous Credit Transactions, Inc. You register with me, give me your real cc details. When you want to buy something, you do step (2) above, and receive a one-shot number, perhaps with false name etc. - after all, as long as ACT can identify you, and the webstore can bill ACT, it doesn't matter what info you give them.
When you buy something, the webstore contacts ACT, who charge your credit card and give the money to the webstore. As long as someone has sufficient security knowledge and money to set up an ACT Inc, there's no reason why you'd have to use Amex, or any provider who also gives you your credit card.
Alex
Your key ID number is fine. You just encrypt the amount. The vendor would need to encrypt the amount he expected in the package sent to the credit card company. The encryption could be handled by the circuit in the card (definately not a POS terminal!)
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Yes, these pre-paid phonecard-like credit cards have been offered at 7-11 here in TX for months. I know a few paranoid types who use 'em here at the library in an attempt to stay anonymous. They are like cash and if you lose it or get stolen, tough luck.
cryptological credit card number!
Here's the process...
1) Am Ex holds special private keys for all merchants (the merchant only has the public key).
2) I encrypt my card number, as well as the amount of money using the merchant's public key and send that to the merchant.
3) The merchant sends the message (he cannot decrypt it) to Am Ex.
4) Am Ex, decrypts is with the merchant's public key (if somebody else had intercepted, it wouldn't be encrypted with the right key).
5) Am Ex pays the merchant the right amount from the right credit card.
Looks safe (to me), though IANACS (I am not a cryptography specialist)
Opus: the Swiss army knife of audio codec
AmEx is 15 digits. Your calculation is invalid.
--
Leonid S. Knyshov
Leonid S. Knyshov
Find me on Quora
I burned my debit card when they tried to send me one and told them never to send me another one for the very reason that you state. Why should banks do anything when it's your money at risk? They're much more responsive when its their money at risk.
Use a credit card! Why risk exposure of your cash? Just pay it off in full every month and you're home free. Get one with frequent flier miles or some other bonus and you can get paid for spending money.
The numbers could be reused, so unless 10^12 (or whatever) people request a temporary card number, it'd be okay. It could become a daunting task to coordinate all this though.
As a recent victim of forgery, I feel your pain. The bank even had the balls of closing my account because of a negative balance after the forger cratered my balance to the tune of $1,200
There is also identity theft where someone poses as you to apply for credit (usually using some stolen information like your SSN,) and runs up charges before running away. My wife was victim of that crime to the tune of almost six grand.
Total cost to me, some aggravation and irritation. Total cost to the bank and the credit issuers, several grand. And its not going to get any better until a few things are improved.
Single use card are like one-time crypto pads so they are more secure against serial use but the source and cause of the problem remains the same.
The problem is that none of the authentication systems work properly. Verification is currently based on what you know, easily forgable, instead of what you are (biometrics are much harder to forge.)
Its the same principle, or simple lack of planning and forethought, behind car alarms that wail at you in the middle of the night so that you would pay someone to steal the effin' car.
Or sirens that demand that I GET OUT OF THE WAY!!! when I'm sitting in my apartment trying ot read.
If you want other vehicles to get out of the way, the horns should be IN THE OTHER VEHICLES. Honking at me up there is wasteful, inelegant, irritating and stupid because in my town, its likely to get you a brick thrown through your windshield.
Read "Sytemantics The Underground Text of Systems Lore. How Systems Really Work and How They Fail" for a most cogent analysis of why things don't work too well.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
I think this is a darn good idea, as long as the number space for the one-time numbers is large enough to avoid collisions for many years between usages. (And the resultant numbers will have to contain some kind of cryptographic signature information so that fraudsters won't be able to just make up random numbers to try and get a hit on an open one-shot account number).
:). I can only hope that other card vendors and/or banks might follow their lead.
About how many digits will they have to use to make these assumptions feasible (including the cryptographic check?). Maybe if they go to letters AND numbers?
This kind of scheme would handle a lot of my objections to giving credit card numbers to untrustworthy merchants (given that I trust AMEX not to release my personal information to anyone else
I'm assuming that the one-time numbers are not TRULY anonymous (otherwise AMEX wouldn't know where to send the bill, and/or it would be too convenient for money laundering).
The United States Post Office (yeah, I know, five hundred Ugandans sit up and scream with outrage because I assume this article is about the US, "Bloody Americans," blah blah) requires you to show ID. If you go to Mailboxes, Etc., they also require ID. Basically, legal places require legal identification.
Unless you have access to fake ID, your transaction still isn't that anonymous. We need places to get these things shipped that we buy online (unless they are services [like porn] or goods [like file downloads]). Any ideas?
The one hands down benefit is the inability for the business you bought something from to store your *valid* credit card number and expiration in their clear-text SQL Server database.
Or even worse, in a clear-text comma-delimited file sitting on a UNIX filesystem somewhere, then FTP'd daily to a fulfillment house, as my previous employer used to do. Working there really opened my eyes about the protection of personal/sensitive information.
--Pete
Personally, my Blue card has 15 digits. Presuming that they have to keep with the same general self-authorizing numbering schemes (numbers so that quick checking schemes can tell right away if the card is bogus) how long could they continue to issue unique "one time use" numbers before overlapping occurs? Couldn't someone just try entering a number at random and more than likely stumble across someone elses current temporary account number?
Don't get me wrong, these are just questions, I think the system is a great step forward. While I don't EVER use my credit card online unless that "little lock" appears in my web browser and don't let companies store my CC info for quick "one click shopping" (shudder) this will ceratinly help bring a little more confidence to newbie online consumers.
Ad in classifieds: Pandora's Box (no box) $5
(1) Turn off computer
(2) Go to retail outlets
(3) Pay cash
Thanks for the tip, Tower. Damn shame about how it got moderated.
--
The next Cmdr Taco duplicate will be ready soon, but subscribers can beat the rush and see it early!
How exactly does this work. Do you have to have a prexisting "smart card"? So do you just logon to their website, tell them that you wish to make a purchase at a particular website and THEN they give you number OR do they just give you the number for just 1 transaction anywhere? I did not find the CNEt article particularly clear on that subject.
Sig it.
I'm sorry sir, your one time Amex has been... DECLINED! (On a $1 auth) :(
sarchasm: The gulf between the author of sarcastic wit and the person who doesn't get it.
Part two of the scheme is that you put a strict time limit on each transaction, say a week. After the transaction occurs (or if the time limit comes up), the number goes dead again. There were be very few (percentage-wise) live numbers at any one time. After a suitable dead period, you throw it back in the pot of possible numbers.
/// Not a super-genius . . . yet. ///
I like the idea of one-use credit card numbers -- eliminating fraud should have been the #1 priority of credit-card companies since the e-commerce boom, and I'm glad to see that AMEX has been thinking about this problem. However, I am curious about a few things.
First, how will the numbers be issued? My first thought would be instantly, over the 'net. But then I realized that would just be stupid -- the fraud would just be transferred over to getting the #s in the first place.
Second, how will AMEX ensure that you will pay your bill? Will they require that you have an alternate AMEX card, and bill THAT one monthly? (Not that bad an idea, actually..) I don't have a credit card myself (I'm only 18, and I don't think I could handle the responsibility.) but I know of a few items that are a royal pain in the ass to find in stores. (My Razer BoomSlang 2000 is one such item..)
Third, will PEOPLE be able to handle such convenience? I know that impulse buying is a big part of business (why else do stores have all that candy sitting next to the register?) and, if the numbers are instantly available online, you might buy a $900 computer system on a whim, and not have the cash to cover it.
Thoughts?
--
CitizenC
As if the IP number shortage wasn't enough, now we're going to run out of AMEX numbers too. AMEXv6 anyone?
I just hope they didn't issue all the AMEX card numbers starting with 18 to MIT!
The same way they tax cash purchases?
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
My company has a patent pending for an internet debit card which is not linked to any credit card or bank account. This will allow complete security to the user without the need to give out any personal information . It will also allow those without credit cards or bank accounts to purchase goods and services over the internet. Eventually, since the card is "rechargeable" the applications beyond the internet are numerous. Any responses are welcome.
They were testing this stuff earlier this year at several tech expos. I received a card worth (I think) worth $50 for sitting there and answering a few questions. They could have just as easily emailed me the numbers and said here ya go, use it online instead of giving me a piece of plastic that was worthless after just one usage.
:-)
Hmm...looking through my wallet I still got it...I probably still have a dollar or two on this card if anyone wants it
3790 112994 91001
good 02/00 thru 11/01
Blah...to be honest, I really wish I had more of these things. Much easier than carrying cash, and I don't have to worry thieves getting access to my Debit Card (long since gave up the credit thing...) and depleting my account and waiting the 8 months for my lousy bank to redebit the 2 grand the fuckers stole and charged up 4 days after reporting it stolen.
grumble grumble...
clif
Thanks for being more understanding than the moderator... I thought it was a decent point, after all - Rochester, MN is a fairly techie town (big ol' IBM site with a several thousand people, bunch of doctors at some Mayo Clinic thing...)
--
"It's tough to be bilingual when you get hit in the head."
What Do the Numbers on My Credit Card Mean?
Although phone, gas and department stores have their own numbering systems, ANSI Standard X4.13-1983 is the system used by most national credit card systems. Here are what some of the numbers mean:
________________
They're - They are
Their - Belonging to them
I don't want free as in beer. I just want free beer.
..go to their web site, type in your credit-card number, and then get a one-time-cardnumber to use somewhere else. You still had to use your real number to get the one-time number.
"American Express cardholders will be able to log onto a secure Web site and receive a one-time-use credit card number for purchases over the Internet"
Anonymity? I doubt it. Amex still knows who they assigned each one-time number to. I am sure they will keep records of each OTN linked to your account. Anyone who can track you down by card purchases today will still be able to under the new plan. Big Brother is still in the house.
-=-=-=-=- osjedi uses Debian GNU/Linux. -=-=-=-=-
I used to be a SysAdmin for AMEX, believe me, they already do have your information, even if you've never had an Amex card before.
ASCII a stupid question, get a stupid ANSI!
www.webcertificate.com
Put in the cash you want when you want. It works like a mastercard, at any store that takes mastercard. Simple. Easy. Effective.
---
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
Someone else encrypts your card number as well as the amount of money using the merchant' card number. You're basically right where you are now without encryption.
As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
The article is amazingly scarce on technical details.
Anonymity is not the intended purpose of these cards. The purpose of these cards is to generate credit card numbers which are one-time use only so that anyone stealing them has no use for them.
Mmmm.. Donuts
Eventually, someone will develop "e-checks". Essentially, it'll be like writing a check to
cash right now. The bank gives you a check number
(say 16 alpha-numeric = 80 bits worth), you
tell them the dollar amount, which is debited
from your checking account. You forward the
bank identification (their routing number),
the check number, and the amount to the merchant.
He gives that info to HIS bank, which collects
from your bank.
All this can happen in real time. You shop online, find something you like. Open another window to your bank, and get a check number.
Copy/paste the number into the merchants form,
with the amount and bank rounting info. The
banks do some back office magic, and your payment
is in the merchant's account immediately.
Stealing the number does no good, since it is
only valid for one transaction. Similarly, you
eat at a restaurant. You get bill. You pull out
PDA and get a check number from your bank. Give
to server. Server takes number over to their terminal. A few seconds later it comes back as
good/paid, and everyone goes away happy.
There's no reason you couldn't do this with a
credit account. Instead of giving the card
to a store clerk, you swipe it through the
card reader in your handheld PDA. Your credit
card issuer then gives you a single use number to
give to the clerk. Clerk feeds it into the
terminal, and it clears.
Daniel
it might lead to anonymous purchases.
You don't recieve things that you have sent to a false address. Surely anonymity (sp?) is only availiable when purchasing goods that can be delivered online, i.e. downloaded/viewed. One would think this wouldn't be much help: Credit card companies would keep track of numbers and users for billing and fraud detection, so you're basically exchanging one anonymous-looking multi-digit number for another. Better security? Yes. Better anonymity? Not that I can see.
Michael
...another comment from Michael Tandy.
"Goodness me, how unlike the FBI to abuse the trust of the American public." -- The Onion
For truely anonymous purchases we need prepaid cards that you can purchase anywhere just like phonecards. If those prepaid cards would act like a credit card online then it would be perfect. You could buy these cards at the local grocery store with cash. Suddenly you have a card that acts like a credit card without anyone knowing who you are. Granted if your buying something that needs to be sent to you they get your address but for micropayments and such where you're only getting digital data back, it would be perfect.
Yes, but conceptually, you have just spent the cash, on a piece of plastic. If you don't ever exchange the piece of plastic for your spiffy new shirt, will you ever get your cash back? Then, in essence, a sale has already occurred, regardless of the further expected value of what you have purchased. Semantics, I suppose.
It doesn't matter how you think of things conceptually, states will always charge sales tax when you make purchases using things like pieces of plastic or gift certificates, because otherwise people would just buy such things in states with lower or no sales tax, and spend them in their home state. Since there will always be a tax when you make the purchase, you don't want a tax when you buy the card, as well.
Hehehe, he said "come" hehehe.
You KNOW that is the only thing holding back most testoterone-juiced net users from hitting thier local porn purveyor - the idea that you credit card number will be held for ransom by some blackmailing cyberpimp.
10 bucks says this is what was on AmEx's mind here
'Scuse me, I have to sign up at www.nudegranny.com right away!
Pay no attention to the man behind the curtain with all your metadata.
We should be asking ourselves what we want the on-line transaction of the future to look like. This is certainly one way of doing it, and you can bet that Visa and Mastercard will shortly follow suit, but is it the best way?
It certainly has advantages over typing your card number into 50 different on-line databases, but your credit card itself is still the weak link in the chain. Sooner or later the question of authentication will rear its ugly head. How do you know that it was really Joe Shopper requesting that disposable number, and not Joe Cracker?
On another note, notice how anonymity is hyped in the article, and sometimes used in place of privacy? Do we have an unlikely ally in our quest for true web anonymity (i.e. "You don't know who I am."), as opposed to privacy (i.e. "We know who you are. Trust us; we'll try really hard not to tell anyone.")?
Lastly, as another poster already said, the government is sure to get twitchy about this. How will they tax anonymous purchases? Requisition monthly transacion records from AmEx?
10100111101010010
Anyway thats my US$0.02.
Good Fast Cheap. Pick any two.
Say what you want, but when you accept life and all of the possibilities and consequences that come with it, you don't need to hide yourself from others. And when they accept them too, they won't need to hide from you.
Aaah, in a perfect world... ;)
lf.o
Yikes. Where was this? We should compile a list of sites and their procedure for storing data as reported anonymously by the programmers and admins who work there. Now that would be a list worth reading.
This is a really good idea, a bit like the unique transaction number system used in electronic banking - once the number is used, you can't use it anymore, nor can anyone else.
The problem I am seeing with it, however, is that it gives a whole new field of application to the credit card number generator programs that the usual cracking groups have been cranking out for the last year or so (like DisCard online, available from places like New Order). The algorithm by which AmEx would be generating their credit card numbers is going to be a company secret, of course, but so are the algorithms by which they are generated now. If anyone was able to provide a similar algorithm that generates disposable credit card numbers from someone's semi-public fixed account numbers or whatever static personal data AmEx would be using, it would probably lead to a new generation of credit card frauds ("What do you mean, you haven't used this number yet? So what about the transaction on XX-XX-XXXX?").
As a state gets corrupt, its laws multiply; the most corrupt states have the most numerous laws. (Tacitus, Annales 3:27)
How will this effect online banking and accounting? You would have to tie this "anonymous" account number to YOUR account...
Here's how it would likely work:
The numbers need not be "one time only" usage by AMEX. Basically, AMEX only needs to keep the number active long enough for the transaction to be processed, which would last perhaps one month, then the number goes back into circulation. What they would track then is an activity log for each number (for each number, who used it, when, and where) and an activity log for each user (what number they used, when, and where). Any billing questions can be referred to the log for archive purposes and the numbers stay active only for as long as they're needed, then AMEX drop them back into general circulation.
This is not going to be an easy accounting task: issuing number, tracking their usage, deactivating, then reactivating them. I can tell you that I'm pretty good with logistics (being a police dispatcher tends to develop those skills ) and it'd be a nightmare for me to track. I'm not sure of any better way to do it, though.
If there's going to be a security loophole, it'll come in the time a number is active, after the transaction is processed, but before the number is deactivated and put back into circulation.
-Jimmie
That was my though exactly, but what if the system issued the credit card AFTER you made the payment, with the limit set to the payment amount and the expiration date set randomly?
Then you couldn't easily brute force it, and you wouldn't get more than a couple dollars if you did. Also, in case of an abuse by a small company, you could specifically tag the payment to only one payee. Then it works out well.
-Ben
What a neat idea! At least it seems as though it would be an electronic equivalent to a travelers' check.
Numbers could be handled easily. These "credit cards" could be "sold" either individually or in lots. Once a number is issued, it could be reserved, certainly until used, or until some fixed amount of time has passed. Subsequently the number could be reissued, though it might be a few years before that happens.
Graham
Graham
Linux - Fast Pane Relief
for those who are interested in this, Visa has some details on the cards here