Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#61

Post by tzs »

mrb wrote: post #2

Edit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become? Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach. ¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.

> Say what you want about Bitcoin, but it does solve credit card theft for good

Bitcoin is very similar to cash in many respects, especially when compared to credit cards.

I doubt anyone would say this:

> Say what you want about cash, but it does solve credit card theft for good. If I could use my cash wallet to pay Sonic, I wouldn't be affected by this security breach

It's obviously true, but it's also trivial and pointless. Saying Bitcoin instead of cash doesn't change any of that.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#63

Post by KGIII »

tzs wrote: post #51
rb808 wrote: post #34

Earlier quoted context omitted.

It is a good way to track customer's buying habits. eg how many people go weekly, or to different stores, or buy same products etc. eg HomeDepot tracks credit card back to userid https://consumerist.com/2013/01/16/home-depot-sort-of-explai...

For that it should be good enough to just store the first 6 digits and the last 4 digits of the card number. You might occasionally get two different customers whose first 6/last 4 are the same but it should not happen often enough to be a significant issue. If even that small risk of conflating two different customers is too high, you could go with a hash of the credit card number. If you go with the hash, then don'…

The first four digits are pretty generic. They tell you who issued the card. Many people will have the same first four digits. Maybe the second set of four and the last set of four would be better?

Usually the first four is the issuer and whatever numbers signify the specific type of card. The next set is the bank, I think. The third set is, as I recall, the account number, and the last numbers equate to your routing number.

Actually, just the last eight digits should be adequate. Hash them with a salt based on the last name and collisions are very, very unlikely. Don't store them at all, just store the hashes.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#64

Post by noir_lord »

losteric wrote: post #38
DarkTree wrote: post #11

So I'm pretty ignorant to the history of personal identity/credit breaches, but for those who aren't, is this only getting to get worse? More and more companies are holding more and more data, to the point that these breaches seem to affect so many people. I entered the credit card game pretty recently, and almost immediately I'm affected by the Equifax breach. As a young person, this doesn't make the future of priva…

The news looks bad, but reality is worse. Remember that huge trove of NSA hacking tools and exploits that dumped last year? And the numerous follow-up dumps? There are LOTS of new weapons in the hands of everyone from everyday script kiddies to organized crime to enemy nations. It's possible Equifax was the only credit agency with enough information to require public disclosure... if Transunion doesn't have the right…

I've operated under the assumption that anything that leaves my computer will eventually become public since the 90's.

One of the few times I don't enjoy been right, I'm fortunate in that I'm vanilla, FSM help people under repressive regimes or who hold opinions that worry those in authority wherever they are.

We managed to combine a panopticon with a Skinner box somehow and people like it because it's shiny.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#65

Post by b3lvedere »

mrb wrote: post #2

Edit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become? Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach. ¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.

You can't have 'free money' in Bitcoin in the same way a lot of people (ab)use their credit cards.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#66

Post by BHSPitMonkey »

knz wrote: post #60
abalone wrote: post #54

Earlier quoted context omitted.

Not sure what you're talking about. Apple Pay is so much easier and more pleasant to use than chip-and-PIN. It is designed to be easier for the average consumer. And in terms of speed, are we living on the same planet? Chip-and-PIN is notoriously slow in the U.S. Apple Pay takes a second. Also I'm not saying plastic will go away anytime soon. There will be legacy terminals. I'm saying Apply Pay and its ilk are superi…

> are we living on the same planet? Are we? I assume you have never experienced the requests for support from tech illiterate relatives since childhood for assistance with VCR's, PC's, basic cell phones, printers, anything USB related in the 90's, scanners, cable boxes, modems, endless websites/web applications, and of course, smartphones. Demographic changes are shifting the definition of "average consumer" but boom…

I've switched to Android Pay pretty much everywhere because it's nearly instantaneous, whereas chip transactions require 10-20 seconds of awkward waiting around. Before I had a phone with a fingerprint reader it took more effort to wake and unlock the device, but now that part is frictionless.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#67

Post by BHSPitMonkey »

b3lvedere wrote: post #56
abalone wrote: post #45

I'm surprised Krebs end up plugging chip-and-PIN instead of the current leapfrog technology exemplified by Apple Pay. I feel there is not enough awareness of just how much more secure this is. A huge advantage of Apply Pay is that you get the security of a PIN without the hassle of entering a PIN -- or the risk of it being stolen during PIN entry. You just authenticate with your fingerprint or, soon, your face. (Plea…

A huge disadvantage of Apple Pay is that you must have an Apple device.

Android Pay is accepted everywhere Apple Pay is.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#68

Post by KGIII »

losteric wrote: post #38
DarkTree wrote: post #11

So I'm pretty ignorant to the history of personal identity/credit breaches, but for those who aren't, is this only getting to get worse? More and more companies are holding more and more data, to the point that these breaches seem to affect so many people. I entered the credit card game pretty recently, and almost immediately I'm affected by the Equifax breach. As a young person, this doesn't make the future of priva…

The news looks bad, but reality is worse. Remember that huge trove of NSA hacking tools and exploits that dumped last year? And the numerous follow-up dumps? There are LOTS of new weapons in the hands of everyone from everyday script kiddies to organized crime to enemy nations. It's possible Equifax was the only credit agency with enough information to require public disclosure... if Transunion doesn't have the right…

No computer system, or even individual computer that has the ability to be turned on, is 100% safe. Every system can be compromised, if the attackers have enough time and resources.

So, your last sentence is true.

However, there are ways to secure things in a practical manner and ways to detect, and stop, intrusions - though those ways look nothing like they do in the movies.

There are practical ways to limit exposure and to make data exfiltration more difficult. There are layers and practices that can be put in place to make it more difficult to do and easier to notice.

They are expensive and they do impact efficiency and may impact efficacy.

The easiest way to avoid data exfiltration is to not store it in the first place. But, that means they are less able to track the consumer and then less able to do effective targeting of ads and things like that.

The bottom line is it is expensive to reasonably secure your systems and the penalty for not doing so is less than the profits being made from not securing their systems in a reasonable manner.

Without larger penalties, this is unlikely to change. Maybe, just maybe, enough people will be impacted to where they actually start imposing serious penalties for negligence or willfully neglecting security. Maybe...

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#69

Post by yellowapple »

rb808 wrote: post #34
TheGRS wrote: post #8

Maybe I'm a little ignorant on how/why companies store this sort of info. Someone at work informed me that Target storing CC numbers at least made sense when you needed to make a return. But at a Sonic Drive-In? I'm not returning my burger+shake combo. What is possessing Sonic to keep the number any longer than the period it takes to receive money from the CC company? And why is this period any longer than the 20 or…

It is a good way to track customer's buying habits. eg how many people go weekly, or to different stores, or buy same products etc. eg HomeDepot tracks credit card back to userid https://consumerist.com/2013/01/16/home-depot-sort-of-explai...

This is what hashing is for.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#70

Post by coredog64 »

yellowapple wrote: post #69
rb808 wrote: post #34

Earlier quoted context omitted.

It is a good way to track customer's buying habits. eg how many people go weekly, or to different stores, or buy same products etc. eg HomeDepot tracks credit card back to userid https://consumerist.com/2013/01/16/home-depot-sort-of-explai...

This is what hashing is for.

RSA sells a very nice hardware device that will tokenize credit cards such that it's safe to store the tokenized value _AND_ you can detokenize it in order to charge (or refund) the card.
Post reply on HN