41–50 of 58 posts
I'm waiting for Pizza Hut to show up next. I refuse to let them save my CC number because their password policy basically ensures that you can't choose a reasonable password. And if the obvious, public part of the site is like that, I can only wonder what hackers would find probing deeper.
I'm waiting for Pizza Hut to show up next. I refuse to let them save my CC number because their password policy basically ensures that you can't choose a reasonable password. And if the obvious, public part of the site is like that, I can only wonder what hackers would find probing deeper.
Google had to learn this the hard way -- now all links between their data centers are encrypted, previously they thought they were fine. The NSA and the Chinese famously took advantage of this.
One of the things I love about stripe is it allows you to give them the raw credit card details directly (never hits my servers/logs), and they give me back a token. So I can still keep things server side, but I don't have raw credit card information in my server logs/database.
Did the author get a bug bounty? If not, is it that companies who understand tech the least also don't understand the value of such things?
From the tone of it, it seems he is graceful that he didn't get into any legal trouble. So I'd bet no, he didn't get any bounty.
Why doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but that only slows down the amateurs.
I'm waiting for Pizza Hut to show up next. I refuse to let them save my CC number because their password policy basically ensures that you can't choose a reasonable password. And if the obvious, public part of the site is like that, I can only wonder what hackers would find probing deeper.
Which pizzahut country are you referring to out of interest? Is this US?
You can see the message here: http://imgur.com/T8R6Fnr
I thought they used to also have limits on the maximum length, but thankfully that doesn't seem to be there when I tested it just now.
Why doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but that only slows down the amateurs.
Earlier quoted context omitted.
Just like pizza tastes better when you made it yourself, it is sweeter when you were able to code your own working coupon generator.
If pizza tastes better when you make it yourself you don't live in a place that has good pizza.
Don't rely on client side data. Pin certificates in mobile apps.
Don't do any payment processing client side. Your app should be a pretty interface to the actual service running on your servers.