Won't solve the problem completely, but what about removing eval from the spec? Or making us obfuscation more difficult?
5900 online stores found skimming
41–50 of 104 posts
Re: 5900 online stores found skimming
#42Earlier quoted context omitted.
Not that I know of. My guess is that somebody on that list threw a DMCA takedown notice at Github/Gitlab to get it pulled. Knee jerk reaction is to pull first, verify later.
That may have been the case with GitHub. Gitlab claimed that it fell into the same category as zero-day exploits (which is ridiculous), and that as such posting it wasn't responsible disclosure and it thus violated their ToS.
Sounds like he contacted some of the sites in the article and they blew him off ("We are 100% secure, don't you see the Verisign badge?!"). But yeah, that still makes sense that it could be pulled for that reason.
Re: 5900 online stores found skimming
#43I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction. Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.
There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps…
Would you like another 3DSecure horror story?
All 3DSecure iframe content is bounced through a third-party site, securesuite.co.uk. I invite you to visit one of the following URLs:
Do you feel reassured about entering your credit card details into anything hosted there? At least the domain's whois information doesn't claim it's registered to "yaron shohat" (sic) any more...
Here's a full writeup:
https://web.archive.org/web/20160603034835/http://www.cl.cam...
Re: 5900 online stores found skimming
#44Earlier quoted context omitted.
I've worked with similar organizations that want the transaction on their site due to all the reasons mentioned in the comments. There are providers that use JavaScript to allow you to take payment information on your platform but never let the sensitive details hit your server. I believe this removes your platform as an attack vector for leaking credentials. The only locations that have traces of that information ar…
Which presumably is why the attackers here are injecting their own client-side JavaScript that sends a copy of the payment information to the attacker. Even if the business never sees a copy of the sensitive information, their server can still be made to serve up malicious code that does.
Yep. I completely agree. I hadn't had my early am coffee yet ;)
Re: 5900 online stores found skimming
#45As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…
You know it. I know it. Most of HN knows it. We are, in general, not the customer. On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all, let alone redirect users somewhere else.
We shouldn't be asking this of clients any more. Build the site with SSL on all pages and either require the client buys a cert or implement Let's Encrypt. But at this stage, it makes no sense to make it optional, even for non-commerce sites.
Re: 5900 online stores found skimming
#46Earlier quoted context omitted.
That may have been the case with GitHub. Gitlab claimed that it fell into the same category as zero-day exploits (which is ridiculous), and that as such posting it wasn't responsible disclosure and it thus violated their ToS.
Sounds like he contacted some of the sites in the article and they blew him off ("We are 100% secure, don't you see the Verisign badge?!"). But yeah, that still makes sense that it could be pulled for that reason.
It's not just that it makes sense, that's what GitLab said. I can't find the link right now, but it's on the earlier HN post about Github/lab taking it down.
Re: 5900 online stores found skimming
#47The only reason this is possible is because card payment systems still are using transistor era technologies with zero cryptography. You get someone's card number and you can pay with it. All VISA security is based on trust. With Internet it doesn't work anymore because you never know who your customer is, you don't know what merchant does with card numbers and the laws are different in different countries.
They also lack privacy: your name is written on a card and in every transaction you use the same card number so merchants can collect person's shoppping history (and using a name they can find customer's page in social networks). And maybe they even share this information among themselves.
Not in every country there are laws protecting clients. In US there is a law, but in other countries if your card number got stolen you might never get the money back and even be left with a debt if it was a credit card (because it is client's responsibility to keep his card info secure).
When you are buying something online with a card there is no way to check whether it is a real shop or just a fake site to collect card numbers.
As a result merchants make their own sophisticated antifraud system and you never know whether your card would work or not. For example once I was unable to pay for a Digital Ocean server with virtual prepaid card (of course I would never pay with a real card on the Internet) so I chose another cloud hosting and they lost a customer.
Re: 5900 online stores found skimming
#48Earlier quoted context omitted.
I don't understand this at all. I really, really don't want to give my credit card details to some random webshop who are exceedingly unlikely to have solid security. If I can use PayPal or another well known payment provider, great, I don't even have to type in my details. But even a less well known PSP is more likely to get it right than a small business webshop. A slightly jarring user interface seems a small pric…
I am not liable for credit card fraud. The last thing in the world I want is inconvenience for me , when it's other people's money at risk (bank, merchant, CC company, whoever), not mine. On the other hand, Paypal itself is a liability. Blocking your account (and your money!) for months without recourse, randomly reducing expense limits to nothing (50 EUR) are not just some Internet stories, but things that have happ…
You aren't liable for credit card fraud, but that money comes from somewhere. Today it is a small percentage charged to the vendor; do they pass it on?
And tomorrow, when the problem gets worse and the fees start to climb, will you still not care?
Why be content with a system that may indirectly charge you for other people's lack of security?
Why not look for ways to focus the cost on the vendors who lack security?
Re: 5900 online stores found skimming
#49Earlier quoted context omitted.
There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps…
Would you like another 3DSecure horror story? All 3DSecure iframe content is bounced through a third-party site, securesuite.co.uk. I invite you to visit one of the following URLs: http://securesuite.co.uk https://securesuite.co.uk Do you feel reassured about entering your credit card details into anything hosted there? At least the domain's whois information doesn't claim it's registered to "yaron shohat" (sic) any…
This just reinforces what I tried to say - US and U.K. banks and stores suck. I've never seen 3DSecure in an iframe in Sweden
Re: 5900 online stores found skimming
#50I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction. Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.
> I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions.
A few reasons:
1) Card issuers don't care because it's merchants who are on the hook for card-not-present fraud.
2) Cardholders don't care because they're never on the hook for fraud.
3) If a specific merchant enforced 3DSecure (to move fraud liability back to the issuer/network) they'd lose more money on lost sales from people that hate 3DSecure (everyone?) than they would save on fraud.
That said, I have seen 3DSecure enforced at ultra-high-fraud merchants like Bitcoin resellers.