Live data from Hacker News

Visa Advertising Solutions (VAS) Opt Out

marketingreportoptout.visa.com

111–120 of 253 posts

Re: Visa Advertising Solutions (VAS) Opt Out

#111
post #103
post #58

Sometimes I wonder how certain deals show up as website advertisements and recommendations. Certain blog posts or forum posts appear magically in my search result knowing what I was planning for. Deals and YouTube recommendations also seemed coincidental. Now I know that my debit card has been also leaking my purchase patterns and location. I better add more hosts to my Raspberry Pi-Hole.

Your credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.

One hundred percent of the time when I've clicked that button, it says "XYZCorp is advertising to people located in the United States", even when the ad is clearly more targeted than that.

Re: Visa Advertising Solutions (VAS) Opt Out

#112

Earlier quoted context omitted.

Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa. For Visa it was 835ms for…

100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).

This comment is why I love hackernews

Re: Visa Advertising Solutions (VAS) Opt Out

#113

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?

How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it?

Maybe I’m misunderstanding.

Re: Visa Advertising Solutions (VAS) Opt Out

#114
post #105

Pet peeve: Why do they use subdomains (marketingreportoptout.visa.com), thus making it a bit easier for the scammers to register similar domains? marketingreportoptout-visa.com is still available for any scammer to register. It costs Visa (or anyone) less than $200 to register it for 10 years. Can't they at least register these very obvious domains? How difficult is it to use URLs like this? visa.com/marketingoptout…

From a technical standpoint, it is possible to configure separate DNS records for subdomains, so something.visa.com can be set up completely independently from their main website. And it won't have to share cookies either, making it more secure. For visa.com/something, you would need to add a routing rule at the application level in whatever server is hosting visa.com.

Re: Visa Advertising Solutions (VAS) Opt Out

#115

Earlier quoted context omitted.

100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).

This comment is why I love hackernews

See: https://rdist.root.org/2010/07/19/exploiting-remote-timing-a... and Crosby 2007. I got into infosec around 06 and tptacek, Nate Lawson and some others were my heroes. Now I run my own consulting firm with a bunch of cool people :)

Also in infosec: what is old is new. We still find shitty comparison routines (timing attacks) and SQL injection... some day :)

Re: Visa Advertising Solutions (VAS) Opt Out

#116

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?

https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

Re: Visa Advertising Solutions (VAS) Opt Out

#117
post #110

Is it just opt out once forever or do you have to "opt out" each time they update and send you a new card holder agreement? Who has the discipline to read each packet Visa sends you every few months and re-opt out each and every time? Out of pure attrition, I'm guessing 99% of their customers will eventually be "opt-in". Besides, considering that Visa, Mastercard, etc are all headed toward "data and AI" model, it's n…

According to this: https://bb.visa.com/legal/privacy-policy-opt-out.html you'll have to opt out if your card number changes, and every five years even if it doesn't.

Re: Visa Advertising Solutions (VAS) Opt Out

#119
post #103
post #58

Sometimes I wonder how certain deals show up as website advertisements and recommendations. Certain blog posts or forum posts appear magically in my search result knowing what I was planning for. Deals and YouTube recommendations also seemed coincidental. Now I know that my debit card has been also leaking my purchase patterns and location. I better add more hosts to my Raspberry Pi-Hole.

Your credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.

Level 3 cc processing is becoming more common though.

Re: Visa Advertising Solutions (VAS) Opt Out

#120

Earlier quoted context omitted.

Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?

How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.

As the other person linked, it did happen, although perhaps it would not happen again. On the other hand, I would not risk it, especially since any competent database admin would have your edits rolled back quickly. What would it accomplish? They'll undo the edits then make it harder to remove yourself from the list in the future. Who does that serve?
Post reply on HN