11–20 of 253 posts
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
Or you do it like the EU and make excessive data processing opt-in. (Where by "excessive" I mean something that doesn't fall within recital 47 of GDPR: "legitimate [e.g. marketing] interests of [the company] may provide a legal basis for processing, provided that [users' rights] are not overriding, taking into consideration the reasonable expectations of [users]". It's a grey area where this line is exactly, but Visa can't simply do whatever they want. They have to tell you what data they process, but nobody reads that, and for unexpected (arguably excessive) things they'd have to ask you to opt in.) But I guess that's a little beyond the scope of this comment thread.
Earlier quoted context omitted.
Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
Only one way to find out! What are the possible legal risks to an innocent researcher testing this worthy hypothesis? Asking for a friend of course ;)
IANAL, though.
It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
What processing companies are available to use that don't sell your transaction data by default?
Earlier quoted context omitted.
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
I'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.