Visa Advertising Solutions (VAS) Opt Out

#1

Post by enjoyyourlife » Tue, Dec 29, 2020, 10:59 PM UTC

Visa Advertising Solutions (VAS) Opt Out
marketingreportoptout.visa.com

Re: Visa Advertising Solutions (VAS) Opt Out

#2

Post by throwaway894345 » Wed, Dec 30, 2020, 12:27 AM UTC

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

Re: Visa Advertising Solutions (VAS) Opt Out

#3

Post by hansvm » Wed, Dec 30, 2020, 12:28 AM UTC

It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.

Re: Visa Advertising Solutions (VAS) Opt Out

#4

Post by [deleted] » Wed, Dec 30, 2020, 12:29 AM UTC

[deleted]

Re: Visa Advertising Solutions (VAS) Opt Out

#5

Post by sneak » Wed, Dec 30, 2020, 12:32 AM UTC

What processing companies are available to use that don't sell your transaction data by default?

Re: Visa Advertising Solutions (VAS) Opt Out

#6

Post by say_it_as_it_is » Wed, Dec 30, 2020, 12:33 AM UTC

So all I need to do is provide my full credit card number in this random page and then it'll opt me out?

And this was somehow brought to the front page of Hacker News?

This is a very low effort scam. At least put in some effort beyond your dozen shadow accounts on HN.

Re: Visa Advertising Solutions (VAS) Opt Out

#7

Post by olyjohn » Wed, Dec 30, 2020, 12:34 AM UTC

hansvm wrote: post #3

It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.

Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in?

Or would they just create a "different" marketing campaign, and just opt everybody into that one?

Re: Visa Advertising Solutions (VAS) Opt Out

#8

Post by flatiron » Wed, Dec 30, 2020, 12:34 AM UTC

say_it_as_it_is wrote: post #6

So all I need to do is provide my full credit card number in this random page and then it'll opt me out? And this was somehow brought to the front page of Hacker News? This is a very low effort scam. At least put in some effort beyond your dozen shadow accounts on HN.

Domain and cert are visa. So at least you know you are talking to Visa so it’s not really entirely random.

Re: Visa Advertising Solutions (VAS) Opt Out

#9

Post by bitexploder » Wed, Dec 30, 2020, 12:35 AM UTC

throwaway894345 wrote: post #2

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)

Re: Visa Advertising Solutions (VAS) Opt Out

#10

Post by vultour » Wed, Dec 30, 2020, 12:36 AM UTC

say_it_as_it_is wrote: post #6

So all I need to do is provide my full credit card number in this random page and then it'll opt me out? And this was somehow brought to the front page of Hacker News? This is a very low effort scam. At least put in some effort beyond your dozen shadow accounts on HN.

How dare they ask for you email and password when logging into Facebook?!