161–170 of 253 posts
Earlier quoted context omitted.
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
There's already Luhn and a list of valid starting digits...
The first 6 digits of a card number is called the BIN code. That leaves just 9 digits that have to be spammed.
The fact that BIN lists are publicly available is reducing the space significantly.
To verify that this is a legit site: Go to: https://usa.visa.com/legal/global-privacy-notice/additional-... Then click on: “Visa Products & Services: How does Visa use personal information to benefit consumers and businesses?” Then scroll to the bottom of that section and you’ll see the VAS link: ”U.S. cardholders can opt out of Visa using their card transaction data for VAS.” where you can opt out. iPhones will auto…
Earlier quoted context omitted.
If I recall correctly, when I worked on ecommerce payment processing several years ago, the payment processor got a full itemized list for each transaction. Another comment here mentioned airport codes for airfares ( https://news.ycombinator.com/item?id=25577366 ).
That was my comment actually. You could be right, as I’ve only used visa data for advertising which was merchant names only. Lots of merchants do sell itemized data though. Stripe/etc definitely get itemized, but credits cards get less as far as I know.
Lol, I should probably pay more attention to usernames :)
I've worked on the payment processing end, but as I said that was several years ago, as well as on the consumer data end (e.g. using services like Plaid). You could equally be right about what ends up going from Stripe/Braintree/etc to Visa/Mastercard/etc, though comments/links about Level 3 payment data make me think that the itemized level of detail will increase in usage, and also as you say transactional data is certainly bought and sold outside of the payment networks.
Earlier quoted context omitted.
Haven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.
Earlier quoted context omitted.
So all credit card numbers submitted by the form are viewable by Cloudflare? That does not inspire confidence
Yes, and you also have no guarantee that Cloudflare is sending them back to the origin over a secure connection. 3 of the 4 SSL options they give customers would be considered insecure by browser standards.
The case where the backend is plaintext HTTP is different because a third party between Cloudflare and Visa could eavesdrop that silently (split fibre can make this utterly seamless for normal network technology) with no permission from either of them.
But in the other three cases either Visa, or Cloudflare, or both would have to agree to let somebody else snoop, which agreement they could make even if this was on-premises at Visa's own facility. That's not a technical problem, that's Visa betrayed you for whatever reason.
Arguably one of the options that would be "considered insecure by browser standards" is actually safer for Cloudflare sites, because you can't attack it from the Web PKI. Cloudflare Origin CA isolates you from such an attack, bad guys would need to attack Cloudflare to get a valid certificate from them, certificates from another CA would not work if it's locked down to Cloudflare Origin CA.
Why does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..
Earlier quoted context omitted.
Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa. For Visa it was 835ms for…
100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
There's an unspoken assumption here and elsewhere that the captcha doesn't present any kind of difficulty at all; is that true? If so, why?
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?