Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Advertising Solutions (VAS) Opt Out

marketingreportoptout.visa.com

Post reply on HN
Print view View original

171–180 of 253 posts

Re: Visa Advertising Solutions (VAS) Opt Out

#171

Post by faeyanpiraat »

animex wrote: post #168
bitexploder wrote: post #93

Earlier quoted context omitted.

100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).

I just found a use-case for the sleep( rand(1000) ) function :-)

Nope!

If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise.

If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again.

Use proper security instead of obscurity.

Re: Visa Advertising Solutions (VAS) Opt Out

#172

Post by zelly »

mrweasel wrote: post #150
olliej wrote: post #89

This is the most dodgy looking “enter your CC info” site to ever exist. I can’t imagine why /s

Generally I’ve found that most opt out pages regarding advertising looks like they been built with just the basic understanding of html.

This is intentional

Re: Visa Advertising Solutions (VAS) Opt Out

#173

Post by zelly »

sneak wrote: post #148
xyst wrote: post #21

Earlier quoted context omitted.

by using physical cash

I use physical cash at every opportunity already. How do you buy airline tickets that way? How do you purchase things online for delivery during a pandemic?

you can go to an airport, which has never closed, and buy a ticket in cash

you can purchase things in cash at Walmart, Target, etc. which has never closed during the pandemic

Re: Visa Advertising Solutions (VAS) Opt Out

#174

Post by tialaramex »

quesera wrote: post #38
aaomidi wrote: post #28

Earlier quoted context omitted.

Technically to someone who has demonstrated control on visa.com at the time the cert was issued. It doesn't necessarily mean its actually visa.com. Although I didn't check to see if they're using OV or EV certs.

The cert appears to be DV, and is issued to and by Cloudflare. Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 Subject: C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=marketingreportoptout.visa.com The cert for visa.com is similar.

This certificate is actually OV. It has a Certificate Policy OID inside it, which is 2.23.140.1.2.2 for OV

This is set side in section 7.1.6.1 "Reserved Certificate Policy Identifiers" of the Baseline Requirements, although you could just Google it because OIDs are unique.

Cloudflare, as issuer, have confirmed that Cloudflare, the certificate subscriber, are really Cloudflare, because they're the same entity. That's actually an allowed shortcut, and, I'd argue, one of the most secure possibilities for such validation of business entities.

If you were wondering if this is really Visa that doesn't help you at all. For that you'd best rely on the fact that visa.com is the domain you care about and so logically Visa must have authorised Cloudflare to serve this name.

The predecessor of this site, back in summer, was not on Cloudflare, that too had an OV certificate, but for "Visa International Service Association" in Foster City. I guess somebody decided that letting Cloudflare handle this was cheaper/ easier.

Edited to add: Predecessor's certificate https://crt.sh/?id=3134907318

Re: Visa Advertising Solutions (VAS) Opt Out

#175

Post by zelly »

sneak wrote: post #5

What processing companies are available to use that don't sell your transaction data by default?

if there are any that don't sell your data, they are legally required to let the government see all the transaction data due to 9/11

the only way to free yourself from counterparties is to use cash or crypto. no company will help you.

Re: Visa Advertising Solutions (VAS) Opt Out

#176

Post by globular-toast »

bombcar wrote: post #162
eyeareque wrote: post #48

To verify that this is a legit site: Go to: https://usa.visa.com/legal/global-privacy-notice/additional-... Then click on: “Visa Products & Services: How does Visa use personal information to benefit consumers and businesses?” Then scroll to the bottom of that section and you’ll see the VAS link: ”U.S. cardholders can opt out of Visa using their card transaction data for VAS.” where you can opt out. iPhones will auto…

It astounds me how many of these official sites look like bad phishing attempts.

That's on purpose. They don't want people opting out.

Re: Visa Advertising Solutions (VAS) Opt Out

#177

Post by animex »

faeyanpiraat wrote: post #171
animex wrote: post #168

Earlier quoted context omitted.

I just found a use-case for the sleep( rand(1000) ) function :-)

Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.

Easily accommodated for. I can get the execution run-time and store in an average in memory for some time-period and have the sleep function top-up the difference between the two paths. Not sure what the "proper security" method is to prevent execution deltas.

Re: Visa Advertising Solutions (VAS) Opt Out

#178

Post by b112 »

enw wrote: post #139
imajoredinecon wrote: post #67

Earlier quoted context omitted.

Is it just me, or is the wording hugely misleading? > To opt-out from our anonymization of your personal information to perform data analyses, please provide your Mastercard or Maestro payment card number What we're opting out from is the use of the data, right? I guess the charitable interpretation is that this was written by somebody incompetent, not by someone trying to be deliberately obfuscatory...

> To opt-out from our anonymization of your personal information Doesn’t opting out from anonymization mean opting in for PII?

Hah!

I bet in the mind of a bank exec, it may very well. An amusing point.

There are laws in some countries preventing this, but your point is entirely valid and even makes me wonder about opting out.

Heeeey, wait a minute, is this some banking MILDEC type scenario? Who are you? (j/k)

Re: Visa Advertising Solutions (VAS) Opt Out

#179

Post by antpls »

yumraj wrote: post #125

Why does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..

On my side, Firefox Android, it is verified as "Cloudflare\, Inc", which looks even more suspicious

Re: Visa Advertising Solutions (VAS) Opt Out

#180

Post by b112 »

cwt137 wrote: post #31
jackson1442 wrote: post #24

Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...

I get "System Error" when I submit my card number

If this is about the MC form, I found that if I pasted my CC number (such as from a pass manager), it would bork unless:

- I entered the number

- Then moved to the front of the input field

- Deleted a char, and re-entered it, because

- an end-of-field char change removes the whole number

Wait a sec, even two seconds, and the number will auto-obscure.

Then it works.

Post reply on HN