Criminals can guess Visa number and security code in six seconds, experts find

Post by pavlik_enemy » Mon, Dec 05, 2016, 2:38 PM UTC

curun1r wrote: post #122

politician wrote: post #105

Earlier quoted context omitted.

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

I've had the same argument many times over error messages for login and forgot password flows. Being security conscious is a way of thinking that many people aren't really capable of and an even greater number have problem maintaining consistently. It's so ingrained in product managers to make their software as friendly as possible that they forget that sometimes their users don't have similarly noble intentions. Thi…

Post by ctrl-j » Mon, Dec 05, 2016, 3:55 PM UTC

phpnode wrote: post #152

pablovidal85 wrote: post #150

Earlier quoted context omitted.

Not really, purse.io does not facilitate fraud more than Amazon itself does. Purse.io just connects people who are willing to buy bitcoin using Amazon gift cards for a premium, and those that would like to purchase products on Amazon using bitcoin.

It's an out and out money laundering service. It exists for no other reason, there are no legitimate circumstances where someone would want or need to sell amazon gift cards at less than their face value. It is straight up money laundering and it's frankly incredible that it's lasted as long as it has.

Post by Mz » Mon, Dec 05, 2016, 6:25 PM UTC

flukus wrote: post #133

Mz wrote: post #90

Earlier quoted context omitted.

there are only 10⁴ = 10,000 four-digit security codes possible Yeah, that's not a big number, even manually, much less for a hacker. I went to school for two months and the TV in my dorm room had been locked down to a few channels by some parental security crap, presumably by a previous occupant. With nothing better to do, I manually went through codes until I found the right one and unlocked it to open up more chann…

> Yeah, that's not a big number, even manually, much less for a hacker. But how many false attempts do you have to make before the suspicious activity is picked up? At one a day you probably aren't going to get it right.

Post by metilda » Mon, Dec 05, 2016, 8:58 PM UTC

tyingq wrote: post #89

mjevans wrote: post #79

Earlier quoted context omitted.

I wonder how much of "Item Not Received" is due to poor transport security, like delivering the item to someone's 'property' but just leaving it outside, unattended and unsecured.

That's part of it. The chargeback system is a complete joke, however. I had one guy that I was very suspicious about, so I hired a PI to see if the item was visible in his small business, and take a picture. The tracking number showed the item delivered to the person, signed for with an known employee's name. I submitted this, as well as a picture of the item in the guy's shop. I still lost the chargeback. Got my rev…

Post by philipw » Tue, Dec 06, 2016, 12:57 AM UTC

tzs wrote: post #30

cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

You generally don't even need to get the right expiration date. As long as the date you supply is in the future it will usually work. The security code also can sometimes be skipped. This varies from region to region, but in the US the credit card companies do not actually require a security code match for card not present transactions. The merchant can supply the code, and if so, the credit card processing system wi…