This needs to end. Surveillance capitalism should be opt in (or just plain illegal).
Visa Advertising Solutions (VAS) Opt Out
91–100 of 253 posts
Re: Visa Advertising Solutions (VAS) Opt Out
#92It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
Yes.
Source: That is what everyone did when microsoft turned Do Not Track on by default on IE. That's what you get with "self regulation".
Visa will just say, on their news page: "we updated our terms and condition, if you opted out in the past you must opt out again"
The only winning move against corporation involves NOT giving them your money. Anything else is futile in the current US legal landscape.
Oh, and they will probably work with the FBI to get whoever did that behind bars pretty quick.
Re: Visa Advertising Solutions (VAS) Opt Out
#93Earlier quoted context omitted.
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa. For Visa it was 835ms for…
100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
Re: Visa Advertising Solutions (VAS) Opt Out
#94Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
Anyone have one for Amex? Or Discover? (or JCB? What other weird cards do HN users even have?)
For Amex, I found this: https://global.americanexpress.com/account-management/privac... (Maybe the checkbox at the bottom does a similar thing)
Re: Visa Advertising Solutions (VAS) Opt Out
#95Earlier quoted context omitted.
2captcha is about 0.0005/solve, give or take do to their failure rate. There are other services as well and pre-paid bulk purchases lead to lower pricing. I wouldn't want to ballot stuff the crazy number that is the combination of all Visa credit cards but for much smaller problem spaces 2captcha and others are very reasonably priced.
I would easily pay 0.0005 per solve if it meant I don't have to deal with a captcha again when browsing.
I assume there is a business opportunity here.
Re: Visa Advertising Solutions (VAS) Opt Out
#96It looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
Wonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
Pretty sure that someone would be prosecuted for violating the CFAA.
Not saying that’s right, just that’s my commentary on the state of things today.
Re: Visa Advertising Solutions (VAS) Opt Out
#97Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
Is it just me, or is the wording hugely misleading? > To opt-out from our anonymization of your personal information to perform data analyses, please provide your Mastercard or Maestro payment card number What we're opting out from is the use of the data, right? I guess the charitable interpretation is that this was written by somebody incompetent, not by someone trying to be deliberately obfuscatory...
Its the banking industry: it is intentionally misleading/ They've gotten in trouble for it a number of times and even when the Obama administration cracked down on it, they eventually learned how to legally make their fine print incomprehensible again after a few years.
Re: Visa Advertising Solutions (VAS) Opt Out
#98The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
please opt me out
Re: Visa Advertising Solutions (VAS) Opt Out
#99A great showcase why GDPR is a good thing.
Re: Visa Advertising Solutions (VAS) Opt Out
#100My favorite visa data to sell/buy is airfares. Visa gets the airport code of your departure and arrival, so you can group people into like “visiting Florida during the first week of June”. Or “flys to the Bahamas very often”. Good stuff.
What kind of individual data is in that set of “flys to the Bahamas very often”? Zip codes? Closest city?
Not sure what you meant, but you buy data like that based on airport codes, dates, frequency, and tier (like top 10% of spenders). I’ve only used visa data for targeted advertising. Like tourism destinations target people who are flying to their destination in the near future.