Like the fox offering an opt-out list to the chickens...
It's probably a service mandated by regulation, not out of the goodness of VISA.
I doubt it. They state "Because your issuing bank may change your card number, your opt out will be honored for five years. After five years, you will need to resubmit your card number." This strikes me as the kind of bullshit that would not be permitted if the opt-out was legally mandated. I suspect this opt-out may instead be an attempt to avoid regulation, by trying to appear to be doing the right thing even without regulation.
The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
Coming from the industry - MC & Visa typically don't know if exact card is valid or not. They admit range of numbers to an issuer (bank, revolut-type, whatever), and issuers system is queried for each transaction - card can be created at any time without notifying card schemes.
There's some exceptions (tokens etc.), but not relevant to this use case.
Huh... create script to fill DB with all possible Visa numbers, tomorrow's "marketing insight" will suddenly be an empty file because everything will be excluded. Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database. Of course, no one should do this...
I think that millions of requests from a particular IP address might give the game away.
Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.
rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity? What would be a proper first step to harden API for timing attacks?
rand() + rand() does not produce normal, but adding together a few thousand rands does start to approach it. Central limit theorem.
If something is sufficiently scary to the lay person, you have a good chance of going to jail. I wouldn't make the mistake of thinking that laws are interpreted and applied fairly.
You wouldn't go to jail for 1 submission. But if courts could prove that you created a bot that tried many combinations, in my opinion you should. It's like lockpicking a door lock. Even if you don't get in, I'm sure it's still a crime.
Nope! If the rand function produces uniform random numbers, then with enough samples the signal comes out ontop the noise. If it is non-uniform, then with enough samples you can determine the non uniformity, and you are at square 1 again. Use proper security instead of obscurity.
Easily accommodated for. I can get the execution run-time and store in an average in memory for some time-period and have the sleep function top-up the difference between the two paths. Not sure what the "proper security" method is to prevent execution deltas.
Depends. With comparison functions you can implement a constant time comparison that takes the same amount of time. In this case it isn’t really a crypto problem, so anything where we are confident about things taking the same amount of time is fine. Basically in some parent method/func make sure we always spend 2000ms or whatever time is that is always greater than the max runtime of the slowest path. Secondary / defense in depth mitigations would be rate limiting this page and making it purposefully slow on response, just to make it that much harder to collect samples / abuse it without being noticed. The captcha is a nice touch, but it didn’t seem particularly strong (a good captcha solver could break it). Still, captcha will chase off a lot of script kiddies. You don’t have to be faster than the bear, just faster than the slowest person ;)
The site is already marketingreportoptout. visa.com . How would your random link add anything?
The "random link" is on a domain that the Wayback machine has back to 2001. Whereas the marketingreportoptout subdomain doesn't appear to be there at all. I could certainly imagine a compromise where somebody who doesn't have access to the main sites still manages to sneak in a plausible-sounding subdomain.
Does that mean that you don't trust subdomains by default? That seems a bit extreme/unnecessary.
This website doesn't seem to be ADA compliant. There's a CAPTCHA, but no audio option. I guess blind people have to stay in that database, whether they want to or not.
The "random link" is on a domain that the Wayback machine has back to 2001. Whereas the marketingreportoptout subdomain doesn't appear to be there at all. I could certainly imagine a compromise where somebody who doesn't have access to the main sites still manages to sneak in a plausible-sounding subdomain.
How is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.
Not one submission. Hundreds or thousands of submissions could be seen as a DoS. Yes, it's a stretch. Yes, they will try to use this to get you. Do you really want to play legal chicken with Visa?
Of course not this is just a civil liberties thought experiment. It’s not clear the founding fathers intended for this. Who makes the list? Is MasterCard bad (probably, visa equivalent)? AmEx? Brex? Mint? Random form on hacker news?
Who decides? On what criteria? Can you appeal? Are they elected or appointed officials? Who supervises the “list makers”?