Visa Advertising Solutions (VAS) Opt Out • Hacker News Board

Re: Visa Advertising Solutions (VAS) Opt Out

#131

Post by zymhan » Wed, Dec 30, 2020, 5:05 AM UTC

repsilat wrote: post #121

c3534l wrote: post #97

Earlier quoted context omitted.

Its the banking industry: it is intentionally misleading/ They've gotten in trouble for it a number of times and even when the Obama administration cracked down on it, they eventually learned how to legally make their fine print incomprehensible again after a few years.

This post contains some strong statements. Some are likely not verifiable here (" it is intentionally misleading "), but others (" the Obama administration cracked down on it ") deserve sources, even if well attested -- they're not common knowledge.

You should look up the Consumer Financial Protection Bureau

Re: Visa Advertising Solutions (VAS) Opt Out

#132

Post by oauea » Wed, Dec 30, 2020, 5:12 AM UTC

yumraj wrote: post #125

Why does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..

This is the first time you encountered a cloudflare site?

Re: Visa Advertising Solutions (VAS) Opt Out

#133

Post by hansvm » Wed, Dec 30, 2020, 5:18 AM UTC

WaxProlix wrote: post #23

throwaway894345 wrote: post #2

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

There's an unspoken assumption here and elsewhere that the captcha doesn't present any kind of difficulty at all; is that true? If so, why?

If you're about to make a billion calls per visa card issuer then you can afford a small amount of engineering effort to break that specific captcha. Most individual captchas are pretty rudimentary and can be attacked with simple image processing techniques and pattern matching.

This one in particular is simple enough that nearly any technique you wanted to throw at it would succeed with minimal fine tuning. I'd be shocked if it took an afternoon even if you'd never broken a captcha or done any image processing before, and that's without borrowing an off-the-shelf ML solution.

Plus, even if you had a 50% failure rate you'd just need twice as many calls. That's not trivial, but it doesn't really affect the viability of the idea.

Re: Visa Advertising Solutions (VAS) Opt Out

#134

Post by overscore » Wed, Dec 30, 2020, 5:20 AM UTC

netsharc wrote: post #83

Nextgrid wrote: post #13

Earlier quoted context omitted.

I'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.

Huh... create script to fill DB with all possible Visa numbers, tomorrow's "marketing insight" will suddenly be an empty file because everything will be excluded. Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database. Of course, no one should do this...

> Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database.

I think they would probably just declare them all invalid, and roll back to yesterday.

Re: Visa Advertising Solutions (VAS) Opt Out

#135

Post by inakarmacoma » Wed, Dec 30, 2020, 5:22 AM UTC

jhart99 wrote: post #102

mikehollinger wrote: post #41

So where do I go to see my profile and data? I got a kick out of requesting my lexis nexis profiles - which eventually resulted in two very large packets of paper (several hundred pages) arriving in the mail.

If you want a real trip, I'd suggest getting your data from DT Client Services via CCPA request if you are in California. That was really shocking.

What process did you follow? Were there costs associated with printing, delivery, etc?

Re: Visa Advertising Solutions (VAS) Opt Out

#136

Post by cbsks » Wed, Dec 30, 2020, 5:31 AM UTC

Santosh83 wrote: post #128

yumraj wrote: post #125

Why does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..

I believe it is the standard free level, "Universal SSL" cert that Cloudflare will provide sites on free tier, if they opt for proxying through Cloudflare.

So all credit card numbers submitted by the form are viewable by Cloudflare? That does not inspire confidence

Re: Visa Advertising Solutions (VAS) Opt Out

#137

Post by cbsks » Wed, Dec 30, 2020, 5:34 AM UTC

soared wrote: post #100

ciabattabread wrote: post #81

Earlier quoted context omitted.

What kind of individual data is in that set of “flys to the Bahamas very often”? Zip codes? Closest city?

Not sure what you meant, but you buy data like that based on airport codes, dates, frequency, and tier (like top 10% of spenders). I’ve only used visa data for targeted advertising. Like tourism destinations target people who are flying to their destination in the near future.

What data do you get on each person who matches the query?

Re: Visa Advertising Solutions (VAS) Opt Out

#138

Post by nielsbot » Wed, Dec 30, 2020, 5:45 AM UTC

Is this secure at all?

Re: Visa Advertising Solutions (VAS) Opt Out

#139

Post by enw » Wed, Dec 30, 2020, 5:46 AM UTC

imajoredinecon wrote: post #67

jackson1442 wrote: post #24

Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...

Is it just me, or is the wording hugely misleading? > To opt-out from our anonymization of your personal information to perform data analyses, please provide your Mastercard or Maestro payment card number What we're opting out from is the use of the data, right? I guess the charitable interpretation is that this was written by somebody incompetent, not by someone trying to be deliberately obfuscatory...

> To opt-out from our anonymization of your personal information

Doesn’t opting out from anonymization mean opting in for PII?

Re: Visa Advertising Solutions (VAS) Opt Out

#140

Post by r1ch » Wed, Dec 30, 2020, 5:48 AM UTC

cbsks wrote: post #136

Santosh83 wrote: post #128

Earlier quoted context omitted.

I believe it is the standard free level, "Universal SSL" cert that Cloudflare will provide sites on free tier, if they opt for proxying through Cloudflare.

So all credit card numbers submitted by the form are viewable by Cloudflare? That does not inspire confidence

Yes, and you also have no guarantee that Cloudflare is sending them back to the origin over a secure connection. 3 of the 4 SSL options they give customers would be considered insecure by browser standards.