81–90 of 253 posts
My favorite visa data to sell/buy is airfares. Visa gets the airport code of your departure and arrival, so you can group people into like “visiting Florida during the first week of June”. Or “flys to the Bahamas very often”. Good stuff.
What would be better is if the US had (does it?) a nation-wide law requiring explicit opt-in, as opposed to having to opt out of surveillance. Small steps forward. Also, does this form really amount to anything other than "we promise we won't spy you that much?" Are banks audited in this regard, or are they subject to the same non-existent regulations as the Sillycon Valley surveillance?
I will take what I can get, but the obviously correct thing is for user targeting and sale of third party information to be illegal, never-mind opt in.
Earlier quoted context omitted.
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
I'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.
Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database.
Of course, no one should do this...
Earlier quoted context omitted.
I'd only seen relatively pricey solver farm solutions, hence the question. What constitutes "cheap" here? For a baseline, .05USD/captcha seems not cheap to me.
2captcha is about 0.0005/solve, give or take do to their failure rate. There are other services as well and pre-paid bulk purchases lead to lower pricing. I wouldn't want to ballot stuff the crazy number that is the combination of all Visa credit cards but for much smaller problem spaces 2captcha and others are very reasonably priced.
Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
Is it just me, or is the wording hugely misleading? > To opt-out from our anonymization of your personal information to perform data analyses, please provide your Mastercard or Maestro payment card number What we're opting out from is the use of the data, right? I guess the charitable interpretation is that this was written by somebody incompetent, not by someone trying to be deliberately obfuscatory...
My favorite visa data to sell/buy is airfares. Visa gets the airport code of your departure and arrival, so you can group people into like “visiting Florida during the first week of June”. Or “flys to the Bahamas very often”. Good stuff.
What kind of individual data is in that set of “flys to the Bahamas very often”? Zip codes? Closest city?
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
I can’t imagine why /s
Earlier quoted context omitted.
You would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :)
> You would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :) I used to work at a big bank in the US and the parent's description sounds exactly like how it would work.