Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Advertising Solutions (VAS) Opt Out

marketingreportoptout.visa.com

Post reply on HN
Print view View original

201–210 of 253 posts

Re: Visa Advertising Solutions (VAS) Opt Out

#201

Post by aljarry »

faeyanpiraat wrote: post #171
animex wrote: post #168

Earlier quoted context omitted.

I just found a use-case for the sleep( rand(1000) ) function :-)

Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.

rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity?

What would be a proper first step to harden API for timing attacks?

Re: Visa Advertising Solutions (VAS) Opt Out

#202

Post by w3ll_w3ll_w3ll »

dal wrote: post #185
paxys wrote: post #114

Earlier quoted context omitted.

From a technical standpoint, it is possible to configure separate DNS records for subdomains, so something.visa.com can be set up completely independently from their main website. And it won't have to share cookies either, making it more secure. For visa.com/something, you would need to add a routing rule at the application level in whatever server is hosting visa.com.

No, this can be done in the loadbalancer before any application. You can load balance on L7. This would be a trivial thing.

A trivial thing that would became a mess really fast on a complex website.

A new subdomain for every different "website" is the clean solution in my opinion.

Re: Visa Advertising Solutions (VAS) Opt Out

#203

Post by thetanil »

Havoc wrote: post #200

>U.S cardholders may opt out of Visa So is the rest of the world not covered by this data collection effort or are they just denied the opportunity to opt out at all?

In EU you would have to opt in since there are actual data protections for consumers (that's if it is abusing user specific data which I have to assume it is)

Re: Visa Advertising Solutions (VAS) Opt Out

#204

Post by thetanil »

thih9 wrote: post #196

> your opt out will be honored for five years. After five years, you will need to resubmit your card number. This requirement seems very easy to abuse. Annoying and inconveniencing users into submission already works wonders, people accept all kinds of EULAs, cookie conditions and privacy policies. I wouldn't want expiring user choices to become another tool in this arsenal.

the fact that you were at any time automatically opted in means they already scraped your whole history anyway. They will do it again in the future anyway since you will be automatically opted in in the future too. Get Zuckerd

Re: Visa Advertising Solutions (VAS) Opt Out

#205

Post by z77dj3kl »

aljarry wrote: post #201
faeyanpiraat wrote: post #171

Earlier quoted context omitted.

Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.

rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity? What would be a proper first step to harden API for timing attacks?

rand() + rand() does not give normal. If there is any statistical difference between the timings, it's in theory possible to break.

An easy mitigation would be to just drop the card number into a queue and process asynchronously without waiting and returning to the user.

Re: Visa Advertising Solutions (VAS) Opt Out

#206

Post by thetanil »

csnover wrote: post #144
cbsks wrote: post #136

Earlier quoted context omitted.

So all credit card numbers submitted by the form are viewable by Cloudflare? That does not inspire confidence

Does it matter? I really feel like I am missing some key knowledge about why people care that their credit card number might be stolen—especially when compared to much more immutable private information like your email address, home address, or phone number. Cardholder agreements for credit cards typically say that you aren’t liable for any fraudulent charges so long as you report them within a couple of billing cycl…

There are a lot of people who don't care at all about their personal info, and the only negative effect of an identity theft is having to call the bank and changing your CC# (my mother for example who has had her ID stolen multiple times because she is careless with her personal info)

Re: Visa Advertising Solutions (VAS) Opt Out

#209

Post by eru »

aljarry wrote: post #201
faeyanpiraat wrote: post #171

Earlier quoted context omitted.

Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.

rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity? What would be a proper first step to harden API for timing attacks?

Adding any random noise, even perfect randomness, doesn't prevent the attack. It just means the attacker needs more samples.

Re: Visa Advertising Solutions (VAS) Opt Out

#210

Post by thetanil »

forgotmypw17 wrote: post #53

Like the fox offering an opt-out list to the chickens...

Seriously, people don't understand how opt-outs are nonsense. Say I am facebook. In 2020 I make an opt-out data grab. I turn it on and grab all the data, and then put up a site to opt-out. Then in 2021 I make another grab with a new opt-out. They literally don't care who opts out, they never need to even look at that list because they already grabbed it all.
Post reply on HN