

        <cite>Conor</cite>
      <time>0:00</time>
      <p>
          This   episode   is   awful,   man.   Do   you   think   our   we&#39;re   not   even   discussing   the   algorithm?
      </p>

        <cite>Bryce</cite>
      <time>0:04</time>
      <p>
          Connor,   you   know   what?   I   was   just   thinking.   I   was   thinking   just   a   minute   before   you   said   that.   I   was   thinking,   I   was   gonna   tell   you,   I   think   that   this   is   a   sign   that   this   is   gonna   be   our   greatest   year   of   content   ever.   I   think   that   this   is   all   absolute   gold.   I   think   people   are   gonna   love   this.
      </p>

        <cite>Conor</cite>
      <time>0:20</time>
      <p>
          You   you   think   this   is   gold.
      </p>

        <cite>Bryce</cite>
      <time>0:22</time>
      <p>
          I   do.
      </p>

        <cite>Conor</cite>
      <time>0:36</time>
      <p>
          Welcome   to   ADSP   the   podcast,   episode   164,   recorded   on   January   4th,   2024.   My   name   is   Connor,   and   today   with   my   co-host   Bryce,   we   chat   about   the   algorithm   behind   credit   card   number   generation.   It   might   be   our   worst   episode   ever.   I&#39;ll   let   you   decide.   Two   quick   announcements   off   the   top   of   the   episode.   Some   good   news   and   some   bad   news.   We&#39;ll   start   with   the   good   news.   The   good   news   is   I   recently   discovered   a   fantastic   podcast   called   Acquired,   which   has   four   different   episodes   on   NVIDIA,   which   is   relevant   to   this   podcast   because   both   Bryce   and   I   work   for   NVIDIA.   It&#39;s   absolutely   fantastic.   Link   will   be   in   the   show   notes   to   NVIDIA   part   one,   two,   three,   and   an   interview   with   Jensen   Huang,   the   CEO   of   NVIDIA.   Absolutely   fantastic   if   you   ever   wanted   to   know   more   about   the   company   and   why   it&#39;s   so   awesome.   That&#39;s   the   good   news.   The   bad   news   is   that   the   audio   of   this   podcast   has   been   heavily   compromised   thanks   to   Microsoft.   Microsoft   screwed   us   twice.   First,   my   Windows   system   restarted.   We   lost   all   of   my   recording,   all   two   hours.   And   second,   we   have   a   backup   though.   We   record   in   Teams   the   recording   of   both   our   audios   at   once   in   case   this   happens.   However,   Microsoft   Teams   also   crashed.   So   for   the   first   four   minutes,   you&#39;re   just   gonna   be   hearing   from   Bryce.   Then   we&#39;re   gonna   jump   to   the   17-minute   mark   where   we   have   my   audio   from   both   tracks.   Anyways,   if   you&#39;re   wondering   what   happened   with   this   episode,   that&#39;s   what   happened.   With   that   good   news   and   bad   news   out   of   the   way,   let&#39;s   get   to   the   episode.
      </p>

        <cite>Bryce</cite>
      <time>2:06</time>
      <p>
          Okay,   so   I   got   a   I   got   a   problem   for   you. No,   no,   no.   We&#39;re   just   gonna   jump   right   into   this. Yeah,   we   are. Yeah,   we   are.   Okay,   pretend   let&#39;s   pretend   that   you   are   Visa.   Pretend   that   you&#39;re   Visa.   Okay,   well,   pretend   that   you   are   Visa,   and   I   I   get   an   I   get   a   new   credit   card   from   you,   okay?   And   and   you   need   to   provide   me   with   a   credit   card   number,   right?   It&#39;s   a   16-digit   number.   The   number   of   digits   don&#39;t   matter.   You&#39;ve   got   some   space   of   credit   card   numbers,   um,   some   of   which   are   allocated   and   in   use,   and   you   need   to   give   me   one   of   those   numbers.   How   do   you   go   about   deciding   what   number   to   give   me?   You   you   don&#39;t   just   allocate   linearly   from   the   space,   one   presumes.   You   don&#39;t   want   there   to   be   a   pattern,   right?   Because   if   there&#39;s   a   pattern,   then   people   could   you   know   figure   out,   oh,   hey,   well,   well,   I   have   this   credit   card   number,   and   then   you   know,   if   I   can   figure   out   the   pattern,   then   I   can   guess   you   know,   somebody   else&#39;s   credit   card   number   that   was   issued   around   the   same   time   as   mine,   and   then   I   can   figure   out   the   expiration   date.   So   you   need   some   way   to   randomize   the   number   that   you&#39;re   being   given.   It   can&#39;t   be   predictable.   But   you   also   need   to   ensure   that   the   randomized   number   that   that   uh   that   your   algorithm   has   picked   is   not   one   that&#39;s   already   in   the   database.   So   how   do   you   what   what   what   do?   What   do   you   do?   And   one   of   the   reasons   I   was   thinking   about   this   was   I   was   checking   out   for   a   transaction   online.   And   there&#39;s   this   thing   now   called   virtual   credit   card   numbers,   where   for   some   credit   card   issuers,   you   can,   if   you&#39;re   going   to   like   just   for   even   for   a   single   transaction,   you   can   you   can   say,   hey,   I   want   you   to   generate   me   a   virtual   credit   card   number   that&#39;s   going   to   be   used   for   this   transaction   and   then   be   discarded   afterwards.   And   that   got   me   thinking,   like,   like,   okay,   like   how   do   they   go   about   doing   that?   Like   just   generating   that   on   the   fly.   And   like   then   I   was   thinking   about   like,   well,   what&#39;s   the   actual   size   of   their   address   space?   Do   they   have   enough   address   space   for   them   to   just   be   able   to   generate   thousands   of   credit   card   numbers   per   person?   And   then   that   got   me   thinking   about,   you   know,   those   little   like   six-digit   like   codes   that   you   could   send.   Okay,   those   ones   get   reused,   and   that&#39;s   probably   just   like   some   like   rotating   hash   or   something.   But   like   for   the   virtual   credit   card   numbers,   do   they   have   some   like   fancy   system   in   place   where   they   have   a   pool   of   the   virtual   credit   card   numbers   and   eventually   they&#39;re   able   to   reclaim   some   of   them?   Or   like   if   I   get,   if   I   use   a   virtual   credit   card   number   to   buy   dog   food   from   Petco,   um,   is   that   credit   card   number   just   like   dead   for   the   rest   of   eternity?   And   so   then   that   got   me   thinking   about   like,   okay,   like   how   do   you   how   do   you   approach   this   space?   And   I   don&#39;t   uh   my   guess   is   that   this   is   not   in   any   way   a   simple   uh   uh   problem.   It   seems   simple   on   the   surface,   but   I   think   it&#39;s   not   so   simple   under   the   hood.
      </p>

        <cite>Conor</cite>
      <time>5:44</time>
      <p>
          So   my   my   question   is,   is   it   with   a   virtual   credit   card,   are   you   even   able   to   be   refunded   when   you   order   something   online?
      </p>

        <cite>Bryce</cite>
      <time>5:51</time>
      <p>
          No   clue.   Um   I   think   you   can   be   refunded   though.   Yeah,   I&#39;m   pretty   sure   that   that   they   that   it   that   you   can   get   a   refund.
      </p>

        <cite>Conor</cite>
      <time>6:00</time>
      <p>
          And   that&#39;s   like   that&#39;s   my   main   thing   with   credit   cards   is   like   one,   you&#39;re   protected   from   fraud   because   it&#39;s   not   your   money,   and   two,   you   can   get   refunded.
      </p>

        <cite>Bryce</cite>
      <time>6:07</time>
      <p>
          So   this   virtual   thing   uh   but   but   here&#39;s   the   thing   with   the   virtual   credit   card   number   the   the   mechanism   by   which   the   virtual   credit   card   stops   working   is   that   like   after   the   transaction,   like   there   are   some   providers   where   you   can   manually   generate   a   virtual   credit   card   and   you   can   you   can   set   like   you   can   say   I   want   a   virtual   credit   card   number   um   and   give   it   to   me   with   like   this   expiration   date   and   with   this   spending   limit,   um,   so   that   you   you   can&#39;t   spend   more   than   X   amount   on   that,   um,   or   that   it   expires   after   X   period.   There   are   also   virtual   credit   card   numbers   that   are   generated   on   the   fly.   And   I&#39;m   pretty   sure   how   those   ones   work   is   that   they&#39;re   generated,   they&#39;re   used   for   that   transaction,   and   then   they   expire   like   immediately.   And   the   way   that   the   whole   mechanism   works   is   it   just   uses   the   existing   credit   card   infrastructure.   And   so   if   somebody   tried   to   charge   something   again   to   that   virtual   credit   card   number,   the   X   it   would   it   would   show   as   expired,   or   the   expiration   date   would   be   bad,   or   the   CVV   code   would   be   bad,   um,   or   it   would   be   over   the   the   virtual   spending   limit   that&#39;s   been   set.   However,   all   of   the   security   that&#39;s   in   place,   all   of   the   two-factor   authentications   that   are   in   place   for   charging   a   credit   card,   I   don&#39;t   think   any   of   that   exists   for   refunding   to   a   credit   card.   I   if   you   refund   to   a   credit   card   and   you   don&#39;t   have   like   the   correct   expiration   date   or   a   CVV,   I   don&#39;t   think   that   like   you   need   that   to   do   the   refund.   So   I&#39;m   pretty   sure   that   in   the   reverse   direction   it&#39;s   fine.   Okay,   but   so   let&#39;s   go   back   to   your   algorithm   question.   So   so   you   said   something   about   like   generating   a   random   number,   right?   Yeah.   Okay,   but   but   here&#39;s   the   problem   with   that.   Then   like   if   I   just   generate   a   random   number   at   large,   then   um   like   how   do   I   know   that   it&#39;s   not   an   existing   credit   card   number?   So   surely   the   algorithm   cannot   be   generate   a   random   number,   query   the   database,   see   if   it&#39;s   an   existing   number,   and   if   it   is   an   existing   number,   then   generate   another   random   number.   Why   not?   Well,   okay,   there&#39;s   a   number   of   of   problems   with   that.   One,   it   could   potentially   give   you   a   non-deterministic   answer.   Um,   like,   you   know,   you   could   end   up   just   taking   like   a   much   longer   time   to   generate   a   credit   card   uh   number   than   than   you   might   want.   Um,   and   you   might   you   might   gain   information   even   from   that.   Two,   that   just   sounds   horribly   inefficient   to   like   generate   a   number   and   then   check   in   the   database   whether   that   number   exists   or   not,   and   then   try   another   one.   That   just   that   seems   like   that&#39;s   not   that   doesn&#39;t   seem   wise.   I   can&#39;t   imagine   that&#39;s   how   it   works.   There&#39;s   kind   of   a   lot   of   people.
      </p>

        <cite>Conor</cite>
      <time>8:50</time>
      <p>
          I   mean,   you&#39;re   there,   you&#39;re   telling   me   there   can&#39;t   be   like   a   secure   way   for   like   you   to   click   on   a   number,   like   give   me   my   next   number.   It&#39;s   not   like   you&#39;re   gonna   locally   generate   the   number   at   the   bank   and   then   go,   ooh,   is   this   one   good?   And   then   it&#39;s   gonna   say,   no,   it&#39;s   taken   by   Jack   Smith   in   Oklahoma,   USA.   Uh   no,   you&#39;re   gonna   click   a   button,   it&#39;s   gonna   do   that   all   behind   the   scenes   and   uh   and   then   give   you   a   number.   Uh,   second   things,   link   will   be   in   the   description.   We&#39;ve   got   a   question   from   Cora.com.   Will   we   run   out   of   16-digit   credit   card   and   debit   card   numbers,   considering   that   in   a   lifetime   an   individual   has   a   handful   at   a   time?   I&#39;m   not   gonna   read   it   out,   but   literally   it   mentions   that   you   know   10   to   the   16   is   10   quadrillion.   Uh,   and   then   it   says   this   whole   range   is   not   actually   in   use.   Then   it   goes   through   a   bunch   of   stuff,   checksums,   etc.   And   then   it   says   it   would   take   about   800   years   before   we   begin   to   run   out   of   them.
      </p>

        <cite>Bryce</cite>
      <time>9:41</time>
      <p>
          Okay,   well,   isn&#39;t   that   a   problem?   Isn&#39;t   that   a   problem?
      </p>

        <cite>Conor</cite>
      <time>9:44</time>
      <p>
          No,   because   it   says   halfway   through   that   they   start   to   recycle   credit   card   numbers   after   a   certain   period   of   time.
      </p>

        <cite>Bryce</cite>
      <time>9:49</time>
      <p>
          Oh,   okay,   they   start   to   recycle   the   credit   card   numbers.
      </p>

        <cite>Conor</cite>
      <time>9:51</time>
      <p>
          Which   I   actually   already   pointed   out   when   you   I   said   like   my   guess   is   that   these   virtual   credit   card   um   companies   they   issue   it   once   and   then   they   just   I   don&#39;t   know   what   the   time   is,   but   they&#39;ve   got   this   range   and   they   just   cycle   through   them   and   then   they   probably   don&#39;t   even   like   like   IP   addresses.   Yes,   exactly.   Um,   and   like   cell   phone   numbers   as   well,   like   get   recycled   all   the   time   or   recycled   all   the   time,   and   like   you   get   those   random   calls   is   like,   hey,   is   this   Jim?   And   you&#39;re   like,   nope,   sorry,   I   just   got   this   number,   and   it&#39;s   not   a   wrong   number.   It&#39;s   literally   like,   oh,   I   didn&#39;t   realize   they   switched   their   phone   number.
      </p>

        <cite>Bryce</cite>
      <time>10:21</time>
      <p>
          Yeah.   But   I   still   want   to   know   the   algorithm   for   how   you   pick   what&#39;s   the   next   one   that   you&#39;re   gonna   hand   at.
      </p>

        <cite>Conor</cite>
      <time>10:27</time>
      <p>
          I   mean,   okay,   we&#39;ll   we&#39;ll   ask   Quora   again.
      </p>

        <cite>Bryce</cite>
      <time>10:30</time>
      <p>
          How   do   banks   maybe   maybe   you   have   maybe   what   you   do   is   you   have   a   like   a   database   or   a   list   of   all   of   the   available   numbers,   all   the   unallocated   ones,   and   then   you   randomly   select   from   that,   right?   That   that   seems   like   that   would   work.
      </p>

        <cite>Conor</cite>
      <time>10:52</time>
      <p>
          Man,   Cora   is   such   a   I&#39;m   gonna   whine   for   a   sec.   Cora   is   such   a   garbage   website.   They   have   the   question   at   the   top,   and   then   in   the   same   bubble,   in   small   gray   font,   an   add.   And   then   that   link   is   not   the   top   question.
      </p>

        <cite>Bryce</cite>
      <time>11:07</time>
      <p>
          Um   here&#39;s   my   algorithm.   Here&#39;s   my   algorithm.   So   so   here&#39;s   here&#39;s   the   the   the   structure   of   uh   uh   again,   we&#39;re   back   to   being   Visa.   Here&#39;s   the   structure.   Uh   we&#39;re   gonna   have   to   do   that.
      </p>

        <cite>Conor</cite>
      <time>11:17</time>
      <p>
          We&#39;re   even   doing   this.   We   got   the   answer   written   for   us   right   here.
      </p>

        <cite>Bryce</cite>
      <time>11:20</time>
      <p>
          No,   I   I&#39;m   I   I&#39;m   spitballing   here.   Shut   up   and   listen.   Listen   to   my   wisdom.   Um,   so   you   got   you   got   two   databases,   right?   One,   we   have   a   database   which   is   it   stores   the   actual   account   information   of   you   know,   Joe   Smith   has   this   credit   card   number,   et   cetera,   et   cetera,   et   cetera.   The   second   database   is   just   like   a   list   of   all   of   the   um   uh   available   numbers.   Um   and   uh   when   you   allocate   a   new   number,   you   remove   it   from   that   second   list.   And   then   uh   when   you   uh   when   you   want   to   generate   a   new   number,   what   you   do   is   you   generate   a   random   number   that&#39;s   within   the   index   space   of   that   second   list   of   unallocated   credit   cards,   and   then   you   just   pick   one   of   those.   You   just   take   one   of   those   out.   Um   and   then   you   know,   that&#39;s   always   gonna   be   you   know   uh   deterministic   that   you   don&#39;t   have   to   do   this   thing   of   like   generate   a   random   number   in   the   entire   index   space   of   uh   credit   card   numbers   and   then   check   if   it&#39;s   one   that&#39;s   used   or   not.   Does   that   make   sense?
      </p>

        <cite>Conor</cite>
      <time>12:33</time>
      <p>
          It   does.
      </p>

        <cite>Bryce</cite>
      <time>12:34</time>
      <p>
          Okay,   but   so   you   said   you&#39;ve   claimed   to   have   found   the   answer   about   how   this   works.   I   will   note   now   that   this   this   high-quality   podcast   is   now   relying   upon   Quora   to   get   our   answers.   Hang   on,   I   gotta   fix   some   of   these   Christmas   lights   aren&#39;t   uh   turning   on.   You   you   you   read   to   me   while   I   uh   And   I   I   I   know   that   Christmas   is   over   and   that   I&#39;m   Jewish,   but   you   know,   everybody   needs   Christmas   lights.
      </p>

        <cite>Conor</cite>
      <time>12:57</time>
      <p>
          It   says   that   basically   there&#39;s   an   algorithm   called   the   LUN   algorithm,   L-U-H-N,   which   is   used   to   generate   these   numbers.
      </p>

        <cite>Bryce</cite>
      <time>13:06</time>
      <p>
          Cool,   let&#39;s   look   that   up.
      </p>

        <cite>Conor</cite>
      <time>13:08</time>
      <p>
          So   far.   And   basically   it   says   a   lot   of   this   stuff   isn&#39;t   actually   generated   randomly.   You   know,   the   first   one   to   five   digits   are   used   to   identify,   you   know,   banks   and   institutions,   and   blah,   blah,   blah.   Um   none   of   these   answers   though   address   generating   one   that&#39;s   already   not   taken.
      </p>

        <cite>Bryce</cite>
      <time>13:28</time>
      <p>
          So   the   LUN   algorithm,   hang   on,   I&#39;m   gonna   look   up   that   LUN   algorithm.   The   uh   the   team   subscription   uh   interpreted   lun   algorithm   as   the   Luna   algorithm.   L-U-H-N.
      </p>

        <cite>Conor</cite>
      <time>13:42</time>
      <p>
          Yeah.
      </p>

        <cite>Bryce</cite>
      <time>13:43</time>
      <p>
          The   LUN   algorithm.
      </p>

        <cite>Conor</cite>
      <time>13:44</time>
      <p>
          How   does   the   LUN   credit   card   algorithm   avoid   duplicates?
      </p>

        <cite>Bryce</cite>
      <time>13:50</time>
      <p>
          Wait   a   second.   The   LUN   algorithm,   also   known   as   modulus   10   or   mod   10   algorithm,   is   a   simple   check   digit   formula   used   to   validate   a   variety   of   identification   numbers.
      </p>

        <cite>Conor</cite>
      <time>14:00</time>
      <p>
          Here   we   go.   Credit   card   companies,   so   I   I   we&#39;re   on   another   Cora   answer.   How   do   credit   card   companies   avoid   assigning   conflicting   numbers   to   different   customers?   The   answer   from   ChatGPT,   because   apparently   Cora   ignores   all   the   people   that   answered   and   they   just   they   go   to   the   AI   now.   Credit   card   companies   use   a   unique   numbering   system   to   avoid   assigning   conflicting   numbers   to   different   customers.   They   follow   the   guidelines   set   by   the   International   Organization   for   Standardization   and   the   American   National   Standards   Institute,   that&#39;s   ISO   and   ANSI   for   credit   card   numbering.   The   first   six   digits   of   a   credit   card   are   known   as   the   bank   identification   number,   the   BIN,   which   identifies   the   issuing   institution.   The   remaining   digits   are   unique   to   each   card   and   are   generated,   so   that   means   it&#39;s   only   actually   10,   are   generated   using   a   specific   algorithm.   It   doesn&#39;t   say   LUN   here,   but   I   assume   that   means   LUN.   This   ensures   that   each   card   has   a   distinct   number,   minimizing   the   chances   of   conflict.   Additionally,   credit   card   companies   maintain   strictly   This   is   ChatGPT,   remind   you   though.   So   uh   additionally,   credit   card   companies   maintain   strict   databases   to   track   and   manage   the   issuance   of   credit   cards,   further   reducing   the   possibility   of   assigning   conflicting   numbers   to   different   customers.   So   ChatGPT   seems   to   think   it&#39;s   actually   possible   that   you   share   a   credit   card   number   with   someone   else.
      </p>

        <cite>Bryce</cite>
      <time>15:12</time>
      <p>
          Well,   hang   on   a   second,   because   I   uh   I&#39;m   gonna   share   my   screen   now.   I&#39;m   not   I   know   I&#39;m   not   supposed   to   do   that.
      </p>

        <cite>Conor</cite>
      <time>15:17</time>
      <p>
          Yeah,   I   know,   but   we   don&#39;t   even   know   if   we&#39;re   we&#39;re   airing   this   podcast.
      </p>

        <cite>Bryce</cite>
      <time>15:21</time>
      <p>
          We&#39;re   definitely   we&#39;re   airing   this.
      </p>

        <cite>Conor</cite>
      <time>15:23</time>
      <p>
          We&#39;re   definitely   recording   again   in   the   next   week.   The   next   podcast   we   release   is   gonna   be   the   2023.
      </p>

        <cite>Bryce</cite>
      <time>15:29</time>
      <p>
          Connor,   what   am   I   doing   right   now?
      </p>

        <cite>Conor</cite>
      <time>15:32</time>
      <p>
          Bryce   is   logging   into   Insights,   aka   the   ISO   website,   to   find   the   standard.
      </p>

        <cite>Bryce</cite>
      <time>15:37</time>
      <p>
          Well,   you   know,   you   reminded   me.   Um   let&#39;s   see.   It&#39;s   gotta   be   one   of   these,   right?   Probably.   ID   cards.   ID   card   uh   I   know   I&#39;ve   seen   it   in   here   somewhere.   Payment   systems.   Maybe   it&#39;s   a   different   committee.   Can   you   find   that   ISO   standard?   What&#39;s   the   ISO   standard?
      </p>

        <cite>Conor</cite>
      <time>15:58</time>
      <p>
          Uh   it   does   not   say,   but   I&#39;m   actually   I&#39;m   reading   now   the   uh   the   next   answer   to   this   question,   which   was   written   by   a   person,   and   the   last   paragraph   says   institutions   face   exhaustion   of   their   IIN   ranges   due   to   large   number   of   cards   issued   per   customer   and   an   expansion   of   user   base.   Many   users   maintain   multiple   regular   credit   cards,   debit   cards,   on   multiple   accounts,   and   can   use   one   time,   aka   what   you   were   saying,   virtual,   or   restricted   use   credit   card   numbers   as   well.   So   according   to   this   user,   maybe   it   is   a   problem.   Um   that   other   one   said   we&#39;re   good   for   800   years,   but   uh   is   the   standard   7810?
      </p>

        <cite>Bryce</cite>
      <time>16:36</time>
      <p>
          Ah,   yes.   Okay,   so   that&#39;s   7810.   So   yes,   this   is   the   committee.   I&#39;m   pretty   sure   this   is   the   committee.   What   am   I   doing   right   now,   Connor?
      </p>

        <cite>Conor</cite>
      <time>16:47</time>
      <p>
          Oh,   interesting.   I&#39;m   on   Stack   Overflow   now.   Why   don&#39;t   you   do   that?   He&#39;s   hovering,   he&#39;s   hovering   his   mouse   over   the   join   group   for   this   ISO.
      </p>

        <cite>Bryce</cite>
      <time>16:59</time>
      <p>
          I   mean,   I   wanna   I   wanna   know   how   things   work.   I   don&#39;t   know,   they   charge   us,   they   charge   us   $3,000.   I   don&#39;t   think   I   can   convince   NVIDIA   that   that&#39;s   a   good   use   of   our   money.   But   I   want   to   know.
      </p>

        <cite>Conor</cite>
      <time>17:11</time>
      <p>
          Another   thing   is   that   uh   on   Stack   Overflow,   it   mentions   that   you   don&#39;t   actually   need   to   check   the   whole   number   to   verify   uniqueness.   You   can   just   start   by   checking   the   last   four   digits,   and   if   that&#39;s   already   unique,   then   you   can   say   good   to   go.   I   mean,   that&#39;s   that&#39;s   it&#39;s   not   a   full   solution   to   the   problem,   but   uh   um   it&#39;s   a   it&#39;s   a   valid   point.   Querying   for   uniqueness   doesn&#39;t   necessarily   mean   pinging   to   see   if   this   whole   credit   card   actual   credit   card   number   actually   exists.
      </p>

        <cite>Bryce</cite>
      <time>17:39</time>
      <p>
          Anyways,   wait,   wait,   wait,   explain   that   to   me.   I   didn&#39;t   understand   that.
      </p>

        <cite>Conor</cite>
      <time>17:41</time>
      <p>
          I   was   just   so   like   if   you   if   you   just   check   does   any   um   credit   card   have   these   last   four   digits   and   you   get   back   the   answer   no,   you   know   that   you   have   a   valid   credit   card   that&#39;s   not   been   taken.   You   don&#39;t   need   to   necessarily   query   a   database   on   the   whole   Yeah,   but   that   but   that&#39;s   um   but   a   lot   of   credit   cards   have   the   same   last   four   digits.
      </p>

        <cite>Bryce</cite>
      <time>18:04</time>
      <p>
          Ramona   Ramona   and   I   have   uh   two   separate   credit   cards,   one&#39;s   hers   and   one&#39;s   mine,   that   have   the   same   last   four   digits.
      </p>

        <cite>Conor</cite>
      <time>18:12</time>
      <p>
          Yeah,   I&#39;m   not   saying   it&#39;s   uh   it   fixes   everything.   This   this   episode   is   awful,   man.   Do   you   think   our   we&#39;re   not   even   discussing   the   algorithm?
      </p>

        <cite>Bryce</cite>
      <time>18:19</time>
      <p>
          Connor,   uh   you   know   what?   I   was   just   thinking,   I   was   thinking   just   a   minute   before   you   said   that.   I   was   thinking,   I   was   gonna   tell   you,   I   think   that   this   is   a   sign   this   is   gonna   be   our   greatest   year   of   content   ever.   I   think   that   this   is   all   absolute   gold.   I   think   people   are   gonna   love   this.
      </p>

        <cite>Conor</cite>
      <time>18:34</time>
      <p>
          You   you   think   this   is   gold.
      </p>

        <cite>Bryce</cite>
      <time>18:37</time>
      <p>
          I   do.
      </p>

        <cite>Conor</cite>
      <time>18:38</time>
      <p>
          Did   you   start   drinking   over   the   holidays,   Bryce?
      </p>

        <cite>Bryce</cite>
      <time>18:42</time>
      <p>
          Okay.
      </p>

        <cite>Conor</cite>
      <time>18:43</time>
      <p>
          We   just   finished   three   episodes   with   Sean   sandwiched   around   a   one   hour   and   45   minute   episode   with   Zach,   and   you   think   this   content&#39;s   gold?   I   think   this   is   gold.   This   is   a   massive   step   down.
      </p>

        <cite>Bryce</cite>
      <time>18:55</time>
      <p>
          Is   this   LUN   algorithm?   Okay,   it&#39;s   in   ISO   IC   7812-1.   It&#39;s   public   domain.   Interesting.   So   the   it&#39;s   it&#39;s   the   final   digit,   is   a   check   digit,   which   is   calculated   using   the   LUN   algorithm.   I   don&#39;t   understand   how   this   works.
      </p>

        <cite>Conor</cite>
      <time>19:15</time>
      <p>
          I   think   I&#39;ve   actually   seen   this   in   a   talk   before.   I   think   it&#39;s   basically   like   you   take   the   first   15   digits   and   then   you   perform   the   LUN   algorithm   on   that   to   calculate   what   the   ninth   digit   is.   So   like,   or   not   the   ninth   digit,   what   the   final   digit   is.   So   it&#39;s   a   way   of   verifying   right   off   the   bat,   like,   whether   this   is   a   valid   credit   card   number.   So   like   I&#39;m   pretty   sure   there&#39;s   a   leak   code   problem   out   there   that   says   implement   the   LUN   algorithm,   which   is   the   following   six   steps,   and   like   tell   me   how   many   credit   card   numbers   in   this   list   of   16   digit   numbers   are   valid.
      </p>

        <cite>Bryce</cite>
      <time>19:49</time>
      <p>
          Wait,   how   how   does   it   how   does   it   tell   you   that   it&#39;s   about   uh   I   understand.
      </p>

        <cite>Conor</cite>
      <time>19:53</time>
      <p>
          Perform   the   LUN   algorithm   on   the   first   15   and   then   check   is   the   result   of   that   algorithm   equal   to   the   16th   digit.   If   it&#39;s   not,   then   you   have   a   you   have   a   fraud   fraudulent   card.
      </p>

        <cite>Bryce</cite>
      <time>20:03</time>
      <p>
          But   doesn&#39;t   that   mean   that   they   have   limited   the   address   space?
      </p>

        <cite>Conor</cite>
      <time>20:09</time>
      <p>
          Yes,   by   one   character,   one   digit.
      </p>

        <cite>Bryce</cite>
      <time>20:12</time>
      <p>
          Okay,   all   right,   all   right,   all   right.   But   also   we   said   that   there   are   five   digits   on   the   front   end   that   that   they   use   for   identification   purposes.
      </p>

        <cite>Conor</cite>
      <time>20:18</time>
      <p>
          Yes.   We&#39;re   down   to   like   nine   digits.   Who   knows,   man?   We&#39;ve   only   we&#39;re   only   dealing   with   a   billion   credit   card   numbers.
      </p>

        <cite>Bryce</cite>
      <time>20:24</time>
      <p>
          But   how   did   but   that   LUN   algorithm   that   doesn&#39;t   do   anything   to   help   us   prevent   uh   to   generate   a   unique   credit   card   number   that&#39;s   unique   from   somebody   else   generating   a   credit   card   number   in   a   valid   way.   Just   it   just   prevents   you   from   generating   an   invalid   credit   card   number,   which   like   the   uh   the   answer   that   you   read   earlier   that   said   that,   oh,   you   use   LUNS   algorithm   for   that.   LUNS   algorithm   doesn&#39;t   help   you   generate   a   new   unique   credit   card   number   at   all.   That&#39;s   not   that&#39;s   not   what   that&#39;s   for.   Quora   harder,   my   friend.   Quora   harder.   Come   on,   I   got   I   got   great   lines   in   this   episode   like   Quora   Harder,   and   and   you&#39;re   not   gonna   tell   me   that   this   is   the   start   of   our   greatest   year   of   content   ever.
      </p>

        <cite>Conor</cite>
      <time>21:01</time>
      <p>
          The   very   last,   so   actually,   I   I   skimmed   over   some   stuff,   but   in   the   longer   explanation,   which   will   be   linked   if   this   episode   ever   airs,   uh,   is   that   the   very   last   digit   is   known   as   the   LUN   checksum.   Actually,   if   we   rewind   to   the   previous   paragraph,   after   all   the   restrictions,   the   next   five   digits   of   a   card   combine   with   the   first   to   form   the   issue   identification.   That   means   for   every   major   industry,   there   can   be   a   hundred   thousand   different   issuers.   The   registration   authority   for   IINs   is   the   American   Bankers   Association.   So,   what   do   the   last   ten   digits   in   the   card   number   represent?   The   very   last   digit   is   known   as   the   LUN   checksum   and   is   used   to   quickly   but   not   too   accurately   determine   whether   a   credit   card   number   is   valid.   So   it&#39;s   just   something   that,   like,   probably   merchants   like   in   each   one   of   the   things   I   don&#39;t   even   know   if   it   makes   sense.   Like   you   got   to   ping   against   a   database,   but   maybe   it   it   is   something   that   you   can   do   locally   on   the   Machine   that   prevents   like   a   network   request   or   something   like   that.
      </p>

        <cite>Bryce</cite>
      <time>22:02</time>
      <p>
          It&#39;s   client-side   because   it   it   gives   you   a   client-side.   Think   about   it   this   way.   It   gives   you   a   client-side   way   to   like   check   things   that   are   errors   or   I   guess   stupid   fraud.   Smart,   smart   fraud   would   you   know,   try   to   brute   force   only   numbers   that   match   uh   you   know   that   that   that   that   have   a   crypt   generated   lun   digit.
      </p>

        <cite>Conor</cite>
      <time>22:24</time>
      <p>
          To   rewind,   the   summary,   and   so   it   says   that   you   know,   that&#39;s   the   last   one.   So   that   means   the   last   nine   digits,   seven   to   fifteen,   represent   the   cardholders&#39;   account   number.   That   means   each   issuer   can   issue   up   to   a   billion   account   numbers.   So   that&#39;s   saying   for   each   industry   you   get   a   hundred   thousand   different   issuers,   aka   banks   or   whatever   that   can   issue   credit   cards.   And   then   for   each   one   of   those   issuers,   you   get   a   billion   account   numbers.   Yeah,   those   are   some   pretty   big   numbers,   is   the   next   thing.   And   this   is   the   one   that   results   in   saying   that   like   uh   we&#39;re   good   for   800   years.   No,   people   have   a   lot   of   babies,   man.   People   have   a   lot   of   babies.   All   right,   here   we&#39;re   gonna   keep   just   we&#39;re   gonna   keep   reading   because   I   figure   there   are   there&#39;s   gotta   be   a   couple   jumps   here   to   get   to   800   years.   So   we&#39;re   listening   folks,   this   podcast,   apparently   uh   one   of   our   best   episodes   ever   is   now   just   Connor   Hookstra   reading   the   rest   of   this   Quora   response,   not   from   who&#39;s   the   the   the   writer,   Micah   Henning.
      </p>

        <cite>Bryce</cite>
      <time>23:17</time>
      <p>
          By   the   end   of   this   podcast,   we   are   gonna   be   reading   the   standard.
      </p>

        <cite>Conor</cite>
      <time>23:21</time>
      <p>
          This   is   from   Micah   Henning,   former   security   engineer   at   PhiServe,   which   I&#39;m   pretty   sure   is   one   of   those   companies.   So   those   are   some   pretty   big   numbers.   To   further   facilitate   card   number   availability,   expired   credit   card   numbers   are   eventually   recycled.   And   since   that   would   take   800   years.   Honestly,   I   didn&#39;t   I   did   not   fill   follow   that,   but   there   you   go.
      </p>

        <cite>Bryce</cite>
      <time>23:57</time>
      <p>
          So   Connor,   do   you   have   63   Swiss   francs?
      </p>

        <cite>Conor</cite>
      <time>24:05</time>
      <p>
          No,   but   I   owe   the   Swiss   government   more   than   that   for   the   speeding   fines   that   I   collected   on   our   on   our   or   it   wasn&#39;t   our   travels,   it   was   my   travels.
      </p>

        <cite>Bryce</cite>
      <time>24:12</time>
      <p>
          I   you   know,   it&#39;s   it&#39;s   funny   because   we   we   got   um   we   got   a   speeding   ticket   in   uh   in   Austria.   But   anyways,   why   do   I   need   63   Swiss   francs?   Yeah,   why   don&#39;t   you   tell   our   listeners   who   are   dying   to   know   63   Swiss   francs   because   I   would   like   to   purchase   ISO   IC7812-1   2017   identification   cards,   part   one,   numbering   systems.   Actually,   wait,   I   forgot   about   this.   The   the   standards,   when   you   buy   the   local   copies   of   the   standards,   they&#39;re   often   cheaper.   So   let   me   see   if   I   can   find   the   insights   version   of   this   and   then   we   can   buy   that   or   the   ANSI   version.   The   ANSI   no   no   no,   I   want   to   be   able   to   buy   this   thing.   Okay,   there   we   go.   Okay,   web   store.   Uh   $61.   Oh,   that&#39;s   the   discounted   price.
      </p>

        <cite>Conor</cite>
      <time>25:14</time>
      <p>
          It&#39;s   $77   for   uh   yeah,   but   63   francs   in   US   is   like   probably   $100   or   something   like   that.   Is   it   or   maybe   maybe   I&#39;m   thinking   of   Canadian,   so   I   don&#39;t   know.   Maybe   you&#39;re   on   par   with   Swiss.   But   I   I   know   Switzerland   is   expensive.   Uh   I   mean,   seeing   as   we&#39;ve   just   been   Googling   the   whole   time,   63   CHF   in   USD.   I   got   a   it&#39;s   it&#39;s   98   Canadian   dollars.   Why?   What   is   wrong   with   you,   Google?   I   said   63   CHF   in   USD   and   then   it   gave   me   Canadian.
      </p>

        <cite>Bryce</cite>
      <time>25:43</time>
      <p>
          Connor,   if   I   buy   the   standard,   will   you   promise   to   not   cut   it   out   of   the   episode?
      </p>

        <cite>Conor</cite>
      <time>25:49</time>
      <p>
          No,   I   did   not   promise   that.   Actually,   it&#39;s   74   US   dollars.
      </p>

        <cite>Bryce</cite>
      <time>25:54</time>
      <p>
          So   Connor,   will   you   promise   to   not   cut   it   out   of   the   episode?
      </p>

        <cite>Conor</cite>
      <time>25:57</time>
      <p>
          I&#39;m   not   even   sure   if   any   any   of   this   is   airing.
      </p>

        <cite>Bryce</cite>
      <time>25:59</time>
      <p>
          If   if   I   think   it&#39;ll   be   really   good   content.   Oh,   what&#39;s   the   package?   And   the   package   is   probably   more   expensive   than   includes,   but   yeah,   I   don&#39;t   want   the   package.
      </p>

        <cite>Conor</cite>
      <time>26:07</time>
      <p>
          I   think   that   there&#39;s   a   good   chance   that   Bryce   took   up   drinking   over   the   holidays,   folks,   and   that   he&#39;s   a   couple,   probably   even   like   half   a   seltzer   deep.
      </p>

        <cite>Bryce</cite>
      <time>26:16</time>
      <p>
          Alright,   we&#39;re   um   I&#39;m   buying   the   standard.   Honey,   I&#39;m   spending   $70   on   a   standard   that   explains   how   credit   card   numbers   are   issued.
      </p>

        <cite>Conor</cite>
      <time>26:28</time>
      <p>
          Oh   my   god.   If   this   ends   up   airing,   which   I   This   is   really   good   content.   I&#39;d   like   I&#39;d   like   everyone   to   know   that   the   way   that   this   episode   started   was   the   way   that   this   episode   started.   I   didn&#39;t   cut   out,   oh,   how   was   the   holidays?   How   was   the   new   year&#39;s?
      </p>

        <cite>Bryce</cite>
      <time>26:48</time>
      <p>
          You   know   what   I   have   to   use   to   purchase?   I   have   to   use   a   credit   card.   So   let&#39;s   go   to   this   credit   card   and   let&#39;s   see   whether   it   gives   me   the   option   to   use   a   virtual   card   number.
      </p>

        <cite>Conor</cite>
      <time>27:00</time>
      <p>
          Listen,   folks,   I&#39;ve   got   now   his   credit   card   number,   his   CVV.
      </p>

        <cite>Bryce</cite>
      <time>27:04</time>
      <p>
          You   too!
      </p>

        <cite>Conor</cite>
      <time>27:05</time>
      <p>
          You   do   because   listen,   folks,   I&#39;m   gonna   leave   this   part   in.   I   will   you   just   probably   heard   me   10xing   the   last   like   20   minutes.   I&#39;m   gonna   it&#39;s   been   an   hour.   Um   this   episode   is   gonna   come   out   in   in   30   minutes   or   less.
      </p>

        <cite>Bryce</cite>
      <time>27:24</time>
      <p>
          That&#39;s   how   much   Okay,   okay,   watch   this.
      </p>

        <cite>Conor</cite>
      <time>27:26</time>
      <p>
          This   is   gonna   be   this   is   gonna   be   Zach&#39;s   favorite   favorite   episode   of   all.
      </p>

        <cite>Bryce</cite>
      <time>27:31</time>
      <p>
          We&#39;re   gonna   try   this.   We&#39;re   gonna   do   a   virtual   card.   Boom!   It   just   generated   us   a   card   number.   We   just   did   it,   folks.   We   executed   the   algorithm.   We   don&#39;t   know   what   the   algorithm   is,   but   it   gave   me   a   card   number   with   an   expiration   date   of   2029,   folks.   2029   and   a   CVV.   Okay,   now   let&#39;s   see   whether   we   can   use   this   virtual   credit   card   number   to   purchase   the   standard   that   might   explain   to   us   how   that   virtual   credit   card   number   was   generated.   If   you   if   you   cut   that   out,   but   Connor,   I   got   something   I   gotta   tell   you.   You   want   to   hear   it?
      </p>

        <cite>Conor</cite>
      <time>28:10</time>
      <p>
          It&#39;s   only   14   pages.   Oh   my   god.   What   is   that   per   page?   That&#39;s   like   five   dollars   per   page,   and   one   of   them   was   the   title   with   nothing   on   it.
      </p>

        <cite>Bryce</cite>
      <time>28:25</time>
      <p>
          It   says   nothing   about   nothing,   nothing   useful   about   how   the   credit   card   numbers   are   issued.
      </p>

        <cite>Conor</cite>
      <time>28:32</time>
      <p>
          Well,   that   was   anticlimactic.
      </p>

        <cite>Bryce</cite>
      <time>28:37</time>
      <p>
          Oh,   we   paid   $70   for   that.
      </p>

        <cite>Conor</cite>
      <time>28:39</time>
      <p>
          Whoa,   whoa,   whoa.   We   did   not   pay   $70.   If   we   had   a   Patreon   account   and   we   were   collecting   funds,   that   would   have   come   directly   out   of   your   own   pocket.   How   do   you   want   to   wrap   up   this   what   might   be   the   worst   episode   we&#39;ve   recorded   ever?
      </p>

        <cite>Bryce</cite>
      <time>28:54</time>
      <p>
          I   think   it&#39;s   I   really   honestly   think   that   this   is   great   content.   I   think   people   are   gonna   love   this. Um   and   uh   if   anybody   could   point   us   in   the   right   direction,   we   can   do   a   uh   a   follow-on   episode.   And   also,   if   anybody   knows   how   to   get   a   refund   from   ANSI,   even   though   I   did   notice   that   there   was   some   big   red   text   that   said   that   ANSI   does   not   issue   refunds,   um,   I   think   it   was   still   worth   it   for   the   podcast.
      </p>

        <cite>Conor</cite>
      <time>29:54</time>
      <p>
          Well,   as   promised,   I   will   air   some   version   of   this   reluctantly.   And   please,   please   let   us   know,   folks.   You   can   reach   us   on   Twitter   or   on   GitHub.   Tell   us,   am   I   right?   Was   this   the   worst   episode   ever?   Or   was   Bryce   right?   Is   this   podcast   gold?   Should   we   be   buying   ANSI   standards   once   a   month   or   ISO   standards   once   a   month?   Be   sure   to   check   these   show   notes   either   in   your   podcast   app   or   at   adspthepodcast.com   for   links   to   any   of   the   things   we   mentioned   in   today&#39;s   episode,   as   well   as   a   link   to   a   GitHub   discussion   where   you   can   leave   thoughts,   comments,   and   questions.   Thanks   for   listening.   We   hope   you   enjoyed   and   have   a   great   day.
      </p>

        <cite>Bryce</cite>
      <time>30:35</time>
      <p>
          Low   quality,   high   quality,   that   is   the   tagline   of   our   podcast.
      </p>

        <cite>Conor</cite>
      <time>30:41</time>
      <p>
          That&#39;s   not   the   tagline.   Our   tagline   is   chaos   with   sprinkles   of   information.
      </p>