Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

5900 online stores found skimming

gwillem.github.io

Post reply on HN
Print view View original

71–80 of 104 posts

Re: 5900 online stores found skimming

#71

Post by ryanlol »

jliptzin wrote: post #69
4ad wrote: post #33

Earlier quoted context omitted.

I am not liable for credit card fraud. The last thing in the world I want is inconvenience for me , when it's other people's money at risk (bank, merchant, CC company, whoever), not mine. On the other hand, Paypal itself is a liability. Blocking your account (and your money!) for months without recourse, randomly reducing expense limits to nothing (50 EUR) are not just some Internet stories, but things that have happ…

As a merchant, I am the one responsible. When a stolen credit card gets used on my site, I am the one that has to pay for that (assuming Stripe does not block it through fraud prevention). Which is fine, because my fraud rate is very low. But it's an odd situation because in effect I am being penalized for someone else's lax security. Sure I could try to come up with my own fraud prevention algorithm but I highly dou…

>Sure I could try to come up with my own fraud prevention algorithm but I highly doubt that as a small vendor I could beat Stripe in that department.

You're seriously overestimating the fraud protection Stripe does.

Re: 5900 online stores found skimming

#73

Post by Cyph0n »

4ad wrote: post #61
Cyph0n wrote: post #54

Earlier quoted context omitted.

I'm assuming you ended up with no debit card for a few days at least. That's a huge inconvenience in my opinion.

No, because I have many debit cards from different banks in order to have redundancy and increase availability when the bank's system is down, or a particular card simply won't work at some merchant, but other will (usually happens in the US with my European cards).

And that adds the overhead of managing multiple balances, fees, and credentials. You don't seem to be a typical bank user, so I'm still going to conclude that getting a credit/debit card stolen is a huge inconvenience.

Re: 5900 online stores found skimming

#74

Post by MarkMc »

mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

> You should NEVER have the user enter credit card information on your site

My app client sends the card info to Stripe, then forwards the Stripe token to my server to charge the card each month. So far this is a standard security model.

The problem is that if PayPal come along to offer me a cheaper commission on processing subscription payments, I cannot simply switch my sever to use PayPal for all my existing customers. So I'm tempted to encrypt the credit card info and store it in my database in case I want to switch in future.

Re: 5900 online stores found skimming

#75

Post by [deleted] »

qwertyuiop924 wrote: post #23
jwilcoxson wrote: post #20

Earlier quoted context omitted.

Not that I know of. My guess is that somebody on that list threw a DMCA takedown notice at Github/Gitlab to get it pulled. Knee jerk reaction is to pull first, verify later.

That may have been the case with GitHub. Gitlab claimed that it fell into the same category as zero-day exploits (which is ridiculous), and that as such posting it wasn't responsible disclosure and it thus violated their ToS.

[deleted]

Re: 5900 online stores found skimming

#77

Post by jghn »

mrb wrote: post #59
phil21 wrote: post #36

Earlier quoted context omitted.

> Is this a minority view? I don't know, maybe. I have zero liability on credit card purchases, and while it's certainly an inconvenience I never don't buy something because my details might be leaked. Who cares, why put yourself through the constant mental effort for an event that happens maybe once or twice a decade if you are exceedingly careless? I absolutely despise being sent to a third party site - usually a b…

"I have zero liability on credit card purchases" Not quite right. Many banks make you liable for the first $50, for each occurrence of fraud. Also they typically require you to notice and report a fraudulent charge within 30-90 days or else you are liable for 100% of the amount.

The person said they have no liability, how is saying that many banks don't refuting what they said?

Re: 5900 online stores found skimming

#78

Post by 0xmohit »

catshirt wrote: post #68

"We don’t care, our payments are handled by a 3rd party payment provider" "Thanks for your suggestion, but our shop is totally safe. There is just an annoying javascript error." please share the stores sending these negligent and insulting responses. they don't deserve any sort of protection.

There were a couple of occasions quite some time back (circa 2010) when I reported issues to e-commerce sites:

- trivial enumeration attacks that could be used to retrieve customer information (name, address, order, payment details, ...)

- XSS issues that could be exploited by sending crafted URLs to customers

In all cases, I received rather lame responses as if the person in question was completely nonchalant about the issues.

All I could do was to avoid those stores myself.

Re: 5900 online stores found skimming

#80

Post by shoegumfoot »

mrb wrote: post #59
phil21 wrote: post #36

Earlier quoted context omitted.

> Is this a minority view? I don't know, maybe. I have zero liability on credit card purchases, and while it's certainly an inconvenience I never don't buy something because my details might be leaked. Who cares, why put yourself through the constant mental effort for an event that happens maybe once or twice a decade if you are exceedingly careless? I absolutely despise being sent to a third party site - usually a b…

"I have zero liability on credit card purchases" Not quite right. Many banks make you liable for the first $50, for each occurrence of fraud. Also they typically require you to notice and report a fraudulent charge within 30-90 days or else you are liable for 100% of the amount.

In theory, maybe. But phil21 is correct that credit card users have zero liability in practice.

Most card issuers these days will proactively contact the customer to inquire about suspicious charges.

Post reply on HN