Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#71

Post by rconti »

knz wrote: post #53
abalone wrote: post #45

I'm surprised Krebs end up plugging chip-and-PIN instead of the current leapfrog technology exemplified by Apple Pay. I feel there is not enough awareness of just how much more secure this is. A huge advantage of Apply Pay is that you get the security of a PIN without the hassle of entering a PIN -- or the risk of it being stolen during PIN entry. You just authenticate with your fingerprint or, soon, your face. (Plea…

> A huge advantage of Apply Pay is ... without the hassle of entering a PIN You are forgetting that tools like Apple Pay are not hassle free for most people, especially those outside of IT circles. Millions of people struggle to use anything beyond basic technology (American banks have even decided that PIN's are too confusing! A four digit number that has been common in the rest of the world for decades!). Combine t…

The banks can "decide" all they want, but virtually every American with a bank account already has a PIN for their ATM card.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#73

Post by mrb »

abalone wrote: post #52
mrb wrote: post #2

Edit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become? Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach. ¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.

Your digital wallet gives up consumer protections such as chargebacks which is a regression in consumer benefits. It is also accepted approximately nowhere, with very little incentive for merchants to add support. Apple Pay and related solutions offer "tamper proof isolation of private keys" while still offering all of the consumer protections of cards, plus broad and growing acceptance via compatibility with standar…

«gives up consumer protections such as chargebacks»

True. On the flip side, most merchants are honest so chargebacks are rarely needed. It's a different tradeoff: credit cards open you to ID theft, which is a lot more prevalent than the need for a chargeback, so personally I prefer Bitcoin.

«accepted approximately nowhere»

Any new technology, such as Bitcoin or Apple Pay, has to start from zero. So it is an irrelevant argument anyway. Today Bitcoin is in fact accepted at about 160,000 merchants.

«very little incentive for merchants to add support»

Not true. The biggest, and arguably most important, incentive for merchants to accept Bitcoin is that it allows them to avoid chargeback fraud (payments are irreversible.)

Apple Pay & similar technologies are a huge step up from plain credit/debit cards. Really, it's important to recognize this. But they still have multiple drawbacks. For example, (1) it has transaction limits, (2) it isn't usable for person-to-person payments (eg. paying back lunch money to a coworker), (3) purchases are still subject to authorization so in a way you don't have 100% control of your own money (eg. the system could accidentally flag the transaction as fraudulent and prevent you from buying something.)

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#75

Post by powvans »

abalone wrote: post #54
knz wrote: post #53

Earlier quoted context omitted.

> A huge advantage of Apply Pay is ... without the hassle of entering a PIN You are forgetting that tools like Apple Pay are not hassle free for most people, especially those outside of IT circles. Millions of people struggle to use anything beyond basic technology (American banks have even decided that PIN's are too confusing! A four digit number that has been common in the rest of the world for decades!). Combine t…

Not sure what you're talking about. Apple Pay is so much easier and more pleasant to use than chip-and-PIN. It is designed to be easier for the average consumer. And in terms of speed, are we living on the same planet? Chip-and-PIN is notoriously slow in the U.S. Apple Pay takes a second. Also I'm not saying plastic will go away anytime soon. There will be legacy terminals. I'm saying Apply Pay and its ilk are superi…

I 100% agree with you. It's so much better and faster that it's almost confusing. The chip reader POS devices almost all make it seem as though an error has occurred when the transaction succeeds. When the Apple Pay transaction just magically happens I'm left wondering what else I need to do.

I would use Apple Pay all the time if more of the places I frequent supported it.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#76

Post by stordoff »

perseusprime11 wrote: post #62

Can we all now move to Bitcoin? We have enough evidence with all the breaches so far. This is not going to stop anytime soon.

Does that actually help all that much? I doubt most people know how to, or want to, keep their keys secure enough, so you'd likely end up with them being managed by central services anyway.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#77

Post by stordoff »

mrb wrote: post #73
abalone wrote: post #52

Earlier quoted context omitted.

Your digital wallet gives up consumer protections such as chargebacks which is a regression in consumer benefits. It is also accepted approximately nowhere, with very little incentive for merchants to add support. Apple Pay and related solutions offer "tamper proof isolation of private keys" while still offering all of the consumer protections of cards, plus broad and growing acceptance via compatibility with standar…

« gives up consumer protections such as chargebacks » True. On the flip side, most merchants are honest so chargebacks are rarely needed. It's a different tradeoff: credit cards open you to ID theft, which is a lot more prevalent than the need for a chargeback, so personally I prefer Bitcoin. « accepted approximately nowhere » Any new technology, such as Bitcoin or Apple Pay, has to start from zero. So it is an irrel…

> On the flip side, most merchants are honest so chargebacks are rarely needed.

You also lose the convenience factor of that I don't need to care if a merchant is honest. If it's a merchant I haven't heard of it, I can just make the order without worrying too much (providing there are no obvious red flags) as there's very little risk. On the other hand, Bitcoin's irreversibly would mean I'd have to look into the company before ordering, and I'd probably avoid smaller merchants as a result.

> it allows them to avoid chargeback fraud (payments are irreversible.)

How big of an issue is this in practice? My gut reaction is most customers are honest so it's not big enough incentive to add another payment flow, but I've got no idea if that is accurate or not.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#78

Post by mrb »

stordoff wrote: post #77
mrb wrote: post #73

Earlier quoted context omitted.

« gives up consumer protections such as chargebacks » True. On the flip side, most merchants are honest so chargebacks are rarely needed. It's a different tradeoff: credit cards open you to ID theft, which is a lot more prevalent than the need for a chargeback, so personally I prefer Bitcoin. « accepted approximately nowhere » Any new technology, such as Bitcoin or Apple Pay, has to start from zero. So it is an irrel…

> On the flip side, most merchants are honest so chargebacks are rarely needed. You also lose the convenience factor of that I don't need to care if a merchant is honest. If it's a merchant I haven't heard of it, I can just make the order without worrying too much (providing there are no obvious red flags) as there's very little risk. On the other hand, Bitcoin's irreversibly would mean I'd have to look into the comp…

«If it's a merchant I haven't heard of it...»

You are right. However, examine your pattern of purchases: if you are like the typical consumer, most of your purchases are made at the same merchants that you have been shopping at for years and already trust.

«How big of an issue is this in practice»

It's a huge issue in some markets (eg. online shopping.) I can't remember the stats but CC fraud actually has bankrupted some merchants because it is so prevalent. Dishonest clients are a lot more common than dishonest merchants. It's easy to understand why: by being dishonest, a merchant damages its reputation instantly, however if someone attempts to use a stolen CC and gets flagged, he would simply try another CC number or try another merchant.

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#79

Post by mrb »

jff wrote: post #44
mrb wrote: post #2

Edit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become? Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach. ¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.

You're getting downvoted because everyone hates when Bitcoin idiots force it into every damn conversation.

I would have never guessed I was downvoted because "Bitcoin is mentioned too often"…

I need to point out that your comment ("idiots") is against HN guidelines ("be civil"): https://news.ycombinator.com/newsguidelines.html

Re: Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

#80

Post by mulmen »

TheGRS wrote: post #8

Maybe I'm a little ignorant on how/why companies store this sort of info. Someone at work informed me that Target storing CC numbers at least made sense when you needed to make a return. But at a Sonic Drive-In? I'm not returning my burger+shake combo. What is possessing Sonic to keep the number any longer than the period it takes to receive money from the CC company? And why is this period any longer than the 20 or…

If there is a fingernail in my milkshake you can bet I will get a refund. That's still no excuse to be storing this information because as pointed out they should only need the transaction ID to issue refunds.
Post reply on HN