Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

5900 online stores found skimming

gwillem.github.io

Post reply on HN
Print view View original

31–40 of 104 posts

Re: 5900 online stores found skimming

#31

Post by microcolonel »

gingerlime wrote: post #26
mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it. Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?

It depends on how you integrate it, but yes, you're largely right. If they have your JavaScript they may have your cards.

Re: 5900 online stores found skimming

#32

Post by makomk »

phereford wrote: post #19
Silhouette wrote: post #15

Earlier quoted context omitted.

Most people don't want to bounce customers to a third party site for payment, it really hurts conversions. That is certainly true in my experience. Also, some of the payment services have a habit of changing the appearance and/or behaviour of their hosted systems, sometimes not for the better, and typically without warning. That is a risk you might not be willing to take for something as important as your payment flo…

I've worked with similar organizations that want the transaction on their site due to all the reasons mentioned in the comments. There are providers that use JavaScript to allow you to take payment information on your platform but never let the sensitive details hit your server. I believe this removes your platform as an attack vector for leaking credentials. The only locations that have traces of that information ar…

Which presumably is why the attackers here are injecting their own client-side JavaScript that sends a copy of the payment information to the attacker. Even if the business never sees a copy of the sensitive information, their server can still be made to serve up malicious code that does.

Re: 5900 online stores found skimming

#33

Post by 4ad »

cillian64 wrote: post #29
notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

I don't understand this at all. I really, really don't want to give my credit card details to some random webshop who are exceedingly unlikely to have solid security. If I can use PayPal or another well known payment provider, great, I don't even have to type in my details. But even a less well known PSP is more likely to get it right than a small business webshop. A slightly jarring user interface seems a small pric…

I am not liable for credit card fraud. The last thing in the world I want is inconvenience for me, when it's other people's money at risk (bank, merchant, CC company, whoever), not mine.

On the other hand, Paypal itself is a liability. Blocking your account (and your money!) for months without recourse, randomly reducing expense limits to nothing (50 EUR) are not just some Internet stories, but things that have happened to me personally multiple times.

When my card was stolen (debit card even!), I didn't lose a dime, nor time. Bank just sent me a new card the same day. I didn't even have to report the fraud, they detected it themselves, as they are really good at that. They just called me to tell me about it, and that they sent me a new card.

Re: 5900 online stores found skimming

#34

Post by enraged_camel »

4ad wrote: post #6
notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

I certainly hate it when merchants bounce me to a different site. It's most likely I will never complete the transaction and just buy from Amazon instead. If your site sacrifices user experience, I will hate your site. Simple as that. Amazon understands the convenience factor really well. I hope Apple Pay (on the web) takes off. While I don't like yet another middle man, and I don't care about its security benefits i…

>>If your site sacrifices user experience, I will hate your site. Simple as that.

Even if said sacrifice keeps your credit card safe?

I mean, if you are staying on the same site, you have no guarantees that the site isn't storing your credit card info in an unsecure manner.

Re: 5900 online stores found skimming

#35

Post by 4ad »

enraged_camel wrote: post #34
4ad wrote: post #6

Earlier quoted context omitted.

I certainly hate it when merchants bounce me to a different site. It's most likely I will never complete the transaction and just buy from Amazon instead. If your site sacrifices user experience, I will hate your site. Simple as that. Amazon understands the convenience factor really well. I hope Apple Pay (on the web) takes off. While I don't like yet another middle man, and I don't care about its security benefits i…

>>If your site sacrifices user experience, I will hate your site. Simple as that. Even if said sacrifice keeps your credit card safe? I mean, if you are staying on the same site, you have no guarantees that the site isn't storing your credit card info in an unsecure manner.

I don't care about keeping my credit card safer that it already is. I am not liable for credit card fraud. In this insecure world we live in, I have not lost a single dime, nor any time, nor was I inconvenienced in any way by card theft. It's not my problem to worry about.

My debit card was skimmed once, a few weeks ago. The bank detected fraud, notified me that they sent me a new card, and I didn't lost any money. I only lost two minutes of my life while I was talking to the bank on the phone.

Re: 5900 online stores found skimming

#36

Post by phil21 »

cillian64 wrote: post #29
notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

I don't understand this at all. I really, really don't want to give my credit card details to some random webshop who are exceedingly unlikely to have solid security. If I can use PayPal or another well known payment provider, great, I don't even have to type in my details. But even a less well known PSP is more likely to get it right than a small business webshop. A slightly jarring user interface seems a small pric…

> Is this a minority view?

I don't know, maybe. I have zero liability on credit card purchases, and while it's certainly an inconvenience I never don't buy something because my details might be leaked. Who cares, why put yourself through the constant mental effort for an event that happens maybe once or twice a decade if you are exceedingly careless?

I absolutely despise being sent to a third party site - usually a broken one that takes forever to load, with some annoying "security" authentication, or OTP, etc. when really all I wanted was amazon one click and to move on with my life.

By far the #1 way a small merchant can get me to click the buy button is make it easy for me to checkout and pay. If I have to sign up for an account, be redirected around the world, etc. I generally tend to lose interest and just go back to newegg/amazon. Note that this sometimes is a third party payment link such as Paypal due to the nature of the service - but you have to think about user experience first, not last.

Also your requirement makes absolutely no sense to me. If a merchant is compromised to the point that javascript can be injected, it's not much more difficult at all to direct you to a fake paypal skimmer that you likely won't notice. I agree it raises the bar a bit, but not by an appreciable degree.

Re: 5900 online stores found skimming

#38

Post by hoorayimhelping »

cillian64 wrote: post #29
notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

I don't understand this at all. I really, really don't want to give my credit card details to some random webshop who are exceedingly unlikely to have solid security. If I can use PayPal or another well known payment provider, great, I don't even have to type in my details. But even a less well known PSP is more likely to get it right than a small business webshop. A slightly jarring user interface seems a small pric…

>Is this a minority view?

Most likely. The fact that you understand what is happening when your store webage you're on goes white the words in the www bar change and then you're on a different site and it's asking for credit card info kind of illustrates this point.

Could you imagine trying to buy eggs at the supermarket then when it comes time to swipe your credit card, being asked to leave all your eggs at the register, go over to a different store with your credit card, swipe your card there, sign the paper, then go back to the original store and pick up your eggs? I imagine that's how a lot of people visualize going to a PSP site to enter credit card info.

Re: 5900 online stores found skimming

#39

Post by Silhouette »

technion wrote: post #25
Silhouette wrote: post #17

Earlier quoted context omitted.

On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all I'm reasonably sure that every payment service I've ever used requires payment pages to be served over HTTPS, not just HTTP, even those that have minimal other requirements and take on most of the security burden themselves with some sort of hosted arrangement. Are there really significant numbers of…

As a low tech experiment, I just grabbed the list that started this thread and tried a few random sites. I only made it to the third one before I found an http:// checkout page. I tried to change the address to https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// address. So.... yes.

That is genuinely disturbing!

Do some payment services not do at least a basic check of integrations before allowing them to go live? I haven't worked on a site starting out with online payments very recently, but the last time I did, there was a short series of entries in the server logs that did look like someone from the payment service had taken at least a very quick look at the relevant pages.

Re: 5900 online stores found skimming

#40

Post by 3pt14159 »

gingerlime wrote: post #26
mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it. Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?

The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.
Post reply on HN