Getting any Facebook user's friend list and partial payment card details
josipfranjkovic.com
Getting any Facebook user's friend list and partial payment card details
1–10 of 95 posts
Re: Getting any Facebook user's friend list and partial payment card details
#2Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
Re: Getting any Facebook user's friend list and partial payment card details
#3Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card!
That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
Re: Getting any Facebook user's friend list and partial payment card details
#4Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV.
https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...
Re: Getting any Facebook user's friend list and partial payment card details
#5Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
Neither first six nor last four are considered PCI sensitive data. Not saying they should be randomly displayed, but in the context of many fintech apps they will be displayed together.
Re: Getting any Facebook user's friend list and partial payment card details
#6Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
You should vs human nature. We introduce bugs. Please don't be cynical, and cheer this up.
Kudos to facebook team that they responded shortly, I cannot tell if it was work hours or not, but either way, this is very very short in the context of large corporations.
Re: Getting any Facebook user's friend list and partial payment card details
#7Earlier quoted context omitted.
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
You should vs human nature. We introduce bugs. Please don't be cynical, and cheer this up. Kudos to facebook team that they responded shortly, I cannot tell if it was work hours or not, but either way, this is very very short in the context of large corporations.
I don't read at all the cynicism you seem to read.
A: that was fast!
B: that's because it was very serious!
Where is the cynicism? Can it not be summarized as: they fixed a serious issue very quickly?
Re: Getting any Facebook user's friend list and partial payment card details
#8Textbook.
As in: an exemplar of how these sorts of things ought to proceed
Re: Getting any Facebook user's friend list and partial payment card details
#9Wait, why would facebook have CC info? I have never paid facebook for anything (except in terms of ad views), and I'm not even sure what I could pay them for? Posting ads I guess? But that's gonna be not a lot of people.
So if somehow their graph api has pulled up my credit card number into their database, that's the disturbing thing...
Re: Getting any Facebook user's friend list and partial payment card details
#10Wait, why would facebook have CC info? I have never paid facebook for anything (except in terms of ad views), and I'm not even sure what I could pay them for? Posting ads I guess? But that's gonna be not a lot of people. So if somehow their graph api has pulled up my credit card number into their database, that's the disturbing thing...
They offer a cash transfer service via Messenger (similar to Apple Pay Cash or Snap Cash where you hand over a debit card and then you can send money to friends).
I believe they also used to have a system (maybe they still do?) where you could buy "Facebook Credits" to use on Facebook platform games, essentially microtransactions.