Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing Safeway's private APIs to automate coupon collection

blog.jonlu.ca

Post reply on HN
Print view View original

131–140 of 148 posts

Re: Reversing Safeway's private APIs to automate coupon collection

#131

Post by goatsi »

cjslep wrote: post #101

This reminds me of a very similar case a decade ago I never figured out. Anyone remember Coupon Guy from 4chan in the 2009/2010 timeframe? You could make your own "Buy 1 Get 1 Free" or variant (for both N, "buy 1 get 10", or for kind of coupon, like "buy 1 get half off") Tv, Xbox 360, near anything etc. For Walmart, Best Buy, other chains etc. The tools were passed around stegonographically in the instruction images.…

>and of course rumors of "the FBI" apparently grabbing the guy.

They did get him: http://www.thesmokinggun.com/documents/internet/fbi-busts-4c...

This story about a similar arrest has a good explanation about how to fake coupons: https://www.wired.com/2015/05/inside-a-million-dollar-dark-w...

Re: Reversing Safeway's private APIs to automate coupon collection

#132

Post by davchana »

SamuelAdams wrote: post #86
rainyMammoth wrote: post #6

Earlier quoted context omitted.

Exactly this. I did the same thing to find available camping spots in Hawaii because they are super difficult to get. Wrote a script that would query their "API" every 5 minutes and alert me if a spot became available anywhere.

Yep, I do this for fun custom license plates.

I am interested in looking at your script and/or code.

Re: Reversing Safeway's private APIs to automate coupon collection

#133

Post by Cd00d »

fingerlocks wrote: post #125
rovr138 wrote: post #77

Earlier quoted context omitted.

The club card acts as unique id to track you. The credit swiped at the machine has a unique id that they can use to track you. The club card works across multiple credit cards and cash. That’s the main difference. And you might possibly track 2 people who control the household (wife gets one, husband gets one)

Using Apple Pay would circumvent the CC tracking because it only transmits a one-use number.

I've been wondering about returns lately using Google Pay consistently. It seems with returns they often ask 'do you have the card used for the purchase?', but with one-time numbers I don't know if the card will be recognized. My last several purchases I don't recognize the last 4 at all, and wouldn't be able to exclaim, 'yes, that's my card'

Re: Reversing Safeway's private APIs to automate coupon collection

#134

Post by roland00 »

greyfox wrote: post #105

Anyone know if the dev lurks here? I'm wondering if there's a way to fork his code or add Kroger functionality to it. If im not mistaken Kroger is a safeway acquisition that is a popular grocer in the south/southwest of the USA. this would be very helpful for those of us without safeways.

Kroger is the second largest supermarket in the US (after Walmart) that has many subsidiaries grocery chains that they have acquired in its 100+ years of existence. Pretty much Kroger bought up other "family" grocery chains and then keeps those chains local names such as Dillons, Frys, King Soopers, City Market, Gerbes, Kwik Mart, etc.

Safeway by contrast is part of the Albertson and Albertsons and its Subsidiaries is the 3rd largest Supermarket chain.

Re: Reversing Safeway's private APIs to automate coupon collection

#135

Post by tspike »

withinrafael wrote: post #29

I did something similar with Safeway's API back in the day. But rather than chew up their API with unsupported usage--CFAA case territory--I now just log into Safeway's website and issue a one-liner on the coupon page: $(".grid-coupon-clip-button button").click();

jQuery? Shouldn't you be running a React front-end from a bookmarklet and figuring out a way to Dockerize it?

Re: Reversing Safeway's private APIs to automate coupon collection

#136

Post by jacobwil »

fingerlocks wrote: post #125
rovr138 wrote: post #77

Earlier quoted context omitted.

The club card acts as unique id to track you. The credit swiped at the machine has a unique id that they can use to track you. The club card works across multiple credit cards and cash. That’s the main difference. And you might possibly track 2 people who control the household (wife gets one, husband gets one)

Using Apple Pay would circumvent the CC tracking because it only transmits a one-use number.

Unfortunately (from some perspectives), this isn’t true. Each instance of a card in Apple Pay has a long term Device Account Number (DAN) that functions the same as a physical card’s number (though there is no link between the DAN and actual card number from the merchant’s perspective). The same DAN is used across every transaction. The only way to get a new one (which is pretty easy, relatively speaking) is to unload the card from Apple Pay then re-enroll.

Re: Reversing Safeway's private APIs to automate coupon collection

#137

Post by jacobwil »

Cd00d wrote: post #133
fingerlocks wrote: post #125

Earlier quoted context omitted.

Using Apple Pay would circumvent the CC tracking because it only transmits a one-use number.

I've been wondering about returns lately using Google Pay consistently. It seems with returns they often ask 'do you have the card used for the purchase?', but with one-time numbers I don't know if the card will be recognized. My last several purchases I don't recognize the last 4 at all, and wouldn't be able to exclaim, 'yes, that's my card'

While returns are made more complicated by Google and Apple Pay, the card numbers aren’t single-use (which I’m not sure if you mean to imply is the case with google pay today). On both iOS and Android you can view the last few digits of the Device/Virtual Account Number.

I don’t have an Android device to test these instructions on but they seem plausible and corroborated: https://supportcentre.natwestinternational.com/Searchable/91...

When I made a return for an Apple Pay purchase at Target, they saw that the transaction was marked “Tapped” as card type and took my word for which card was correct. Who knows how long that’ll last. Where I really expect to run into problems down the line is when I try to take advantage of the insurance benefits offered by cards and can’t produce an invoice/receipt with the expected card number on it.

Re: Reversing Safeway's private APIs to automate coupon collection

#138

Post by fingerlocks »

jacobwil wrote: post #136
fingerlocks wrote: post #125

Earlier quoted context omitted.

Using Apple Pay would circumvent the CC tracking because it only transmits a one-use number.

Unfortunately (from some perspectives), this isn’t true. Each instance of a card in Apple Pay has a long term Device Account Number (DAN) that functions the same as a physical card’s number (though there is no link between the DAN and actual card number from the merchant’s perspective). The same DAN is used across every transaction. The only way to get a new one (which is pretty easy, relatively speaking) is to unloa…

Was not aware, thanks for the clarification.

Re: Reversing Safeway's private APIs to automate coupon collection

#139

Post by benj111 »

samstave wrote: post #90
bredren wrote: post #10

Another tip: (area code) 867-5309 works for Safeway club card discounts in most area codes while piping tracking of your purchases to essentially null. Yes, Jenny’s number.

Ok now I know to type that in any time getting gas at safeway. Too bad? I don’t have a car

Just get a Jerry can

Re: Reversing Safeway's private APIs to automate coupon collection

#140

Post by benj111 »

nyquist wrote: post #34
rainyMammoth wrote: post #6

Earlier quoted context omitted.

Exactly this. I did the same thing to find available camping spots in Hawaii because they are super difficult to get. Wrote a script that would query their "API" every 5 minutes and alert me if a spot became available anywhere.

Have you considered whether doing this might be...wrong? Presumably those campsites are permitted by some government agency (NPS, BLM, the state of Hawaii, etc.), and presumably that agency designed permitting system with the assumption that people with limited time and attention would be vying for the permits by having to visit the site themselves to get one. This encodes a particular definition of fairness: that th…

I can't afford to have a holiday in Hawaii, so a particular definition of fairness is already encoded.
Post reply on HN