Sometimes I wonder how certain deals show up as website advertisements and recommendations. Certain blog posts or forum posts appear magically in my search result knowing what I was planning for. Deals and YouTube recommendations also seemed coincidental. Now I know that my debit card has been also leaking my purchase patterns and location. I better add more hosts to my Raspberry Pi-Hole.
Your credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.
Visa Advertising Solutions (VAS) Opt Out
111–120 of 253 posts
Re: Visa Advertising Solutions (VAS) Opt Out
#112Earlier quoted context omitted.
Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa. For Visa it was 835ms for…
100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
Re: Visa Advertising Solutions (VAS) Opt Out
#113The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
Maybe I’m misunderstanding.
Re: Visa Advertising Solutions (VAS) Opt Out
#114Pet peeve: Why do they use subdomains (marketingreportoptout.visa.com), thus making it a bit easier for the scammers to register similar domains? marketingreportoptout-visa.com is still available for any scammer to register. It costs Visa (or anyone) less than $200 to register it for 10 years. Can't they at least register these very obvious domains? How difficult is it to use URLs like this? visa.com/marketingoptout…
Re: Visa Advertising Solutions (VAS) Opt Out
#115Earlier quoted context omitted.
100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
This comment is why I love hackernews
Also in infosec: what is old is new. We still find shitty comparison routines (timing attacks) and SQL injection... some day :)
Re: Visa Advertising Solutions (VAS) Opt Out
#116The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
Re: Visa Advertising Solutions (VAS) Opt Out
#117Is it just opt out once forever or do you have to "opt out" each time they update and send you a new card holder agreement? Who has the discipline to read each packet Visa sends you every few months and re-opt out each and every time? Out of pure attrition, I'm guessing 99% of their customers will eventually be "opt-in". Besides, considering that Visa, Mastercard, etc are all headed toward "data and AI" model, it's n…
Re: Visa Advertising Solutions (VAS) Opt Out
#118Jesus Christ no accessibility on the CAPTCHA and even I failed it 8 times.
Re: Visa Advertising Solutions (VAS) Opt Out
#119Sometimes I wonder how certain deals show up as website advertisements and recommendations. Certain blog posts or forum posts appear magically in my search result knowing what I was planning for. Deals and YouTube recommendations also seemed coincidental. Now I know that my debit card has been also leaking my purchase patterns and location. I better add more hosts to my Raspberry Pi-Hole.
Your credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.
Re: Visa Advertising Solutions (VAS) Opt Out
#120Earlier quoted context omitted.
Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.