Visa Advertising Solutions (VAS) Opt Out • Hacker News Board

Re: Visa Advertising Solutions (VAS) Opt Out

#221

Post by throwaway0a5e » Wed, Dec 30, 2020, 2:57 PM UTC

zymhan wrote: post #131

repsilat wrote: post #121

Earlier quoted context omitted.

This post contains some strong statements. Some are likely not verifiable here (" it is intentionally misleading "), but others (" the Obama administration cracked down on it ") deserve sources, even if well attested -- they're not common knowledge.

You should look up the Consumer Financial Protection Bureau

I'm still pissed at Obama for not making Warren the chair of it.

She's no more qualified than any other Masshole when it comes to dutifully towing the party line[1] and but she was uniquely qualified to head the CFPB and shouldn't have been passed over for that.

[1] Which is basically all she's done in congress but as someone who was a republican until they stopped being fiscally conservative and who studied markets and fought for the little guy all her life who can blame her for being a little tepid on some of the fiscally wilder things that come out of the Bernie/AOC crowd and the jackboot-ier things that come out of the authoritarian neoliberal old guard.

Re: Visa Advertising Solutions (VAS) Opt Out

#222

Post by paxys » Wed, Dec 30, 2020, 2:57 PM UTC

dal wrote: post #185

paxys wrote: post #114

Earlier quoted context omitted.

From a technical standpoint, it is possible to configure separate DNS records for subdomains, so something.visa.com can be set up completely independently from their main website. And it won't have to share cookies either, making it more secure. For visa.com/something, you would need to add a routing rule at the application level in whatever server is hosting visa.com.

No, this can be done in the loadbalancer before any application. You can load balance on L7. This would be a trivial thing.

Nothing is trivial for a decades-old website.

Re: Visa Advertising Solutions (VAS) Opt Out

#223

Post by wpietri » Wed, Dec 30, 2020, 3:34 PM UTC

ianlevesque wrote: post #141

wpietri wrote: post #77

Earlier quoted context omitted.

The "random link" is on a domain that the Wayback machine has back to 2001. Whereas the marketingreportoptout subdomain doesn't appear to be there at all. I could certainly imagine a compromise where somebody who doesn't have access to the main sites still manages to sneak in a plausible-sounding subdomain.

That's not how any of this works.

Oh? https://www.hackerone.com/blog/Guide-Subdomain-Takeovers

Re: Visa Advertising Solutions (VAS) Opt Out

#224

Post by wpietri » Wed, Dec 30, 2020, 3:37 PM UTC

miked85 wrote: post #217

wpietri wrote: post #77

Earlier quoted context omitted.

The "random link" is on a domain that the Wayback machine has back to 2001. Whereas the marketingreportoptout subdomain doesn't appear to be there at all. I could certainly imagine a compromise where somebody who doesn't have access to the main sites still manages to sneak in a plausible-sounding subdomain.

Does that mean that you don't trust subdomains by default? That seems a bit extreme/unnecessary.

I don't know that I trust anything by default. It's always a risk assessment. When I saw a kinda basic-looking site asking for my credit card number, I definitely looked at the domain, and alongcomplicatedthingineverheardof.visa.com was definitely more concerning than, say, www.visa.com.

Re: Visa Advertising Solutions (VAS) Opt Out

#225

Post by gingerlime » Wed, Dec 30, 2020, 3:42 PM UTC

dwighttk wrote: post #199

gingerlime wrote: post #152

Earlier quoted context omitted.

Even Apple makes opting out of sharing data with advertisers (IDFA) confusing[0] > Allow apps to ask permission to track you across apps and websites owned by other companies. [0] https://blog.gingerlime.com/2020/does-ios-14-protect-your-pr...

If Apple made that say “allow apps to track you” and everyone set it to off and they didn’t mention that apps that don’t ask will still try to track you they’d be exposing themselves to a lawsuit when a company tracked Apple users without the IDFA. I think it could be better stated, but changing to to “allow apps to track you” would not be a setting they could actually offer.

Yeah I’m sure plenty of lawyers laboured over this thing... Still doesn’t make it easy to understand. I think they could say that they (Apple) does not allow to track you, and they won’t facilitate tracking, but if an app does this covertly and without Apple’s blessing, it’s on the app and not on Apple. Of course that would put Apple on the line. Apple claims to care about privacy, but apprently not enough :)

Re: Visa Advertising Solutions (VAS) Opt Out

#226

Post by soared » Wed, Dec 30, 2020, 4:05 PM UTC

iamacyborg wrote: post #192

soared wrote: post #147

Earlier quoted context omitted.

This is correct. I worked at oracle, who is the go between for advertisers/agencies and vendors like visa who sell data but don’t do the “client facing” kind of stuff.

Aren’t Oracle (and Salesforce) currently dealing with a class action suit in Europe because of these services?

If oracle isn’t getting sued, they’re not doing business the oracle way. Unrelated, I no longer work there.

Re: Visa Advertising Solutions (VAS) Opt Out

#227

Post by kritiko » Wed, Dec 30, 2020, 4:20 PM UTC

dmix wrote: post #129

repsilat wrote: post #121

Earlier quoted context omitted.

This post contains some strong statements. Some are likely not verifiable here (" it is intentionally misleading "), but others (" the Obama administration cracked down on it ") deserve sources, even if well attested -- they're not common knowledge.

That's a good point, those contain assumptions that need some backing up because they might not hold up water, even if it's the common perception in politics of American culture. But otherwise it probably comes down to occams razor and they had some random corporate web guy half-ass the copy on the website which they aren't investing any sort of high quality resources. It's easy to mistake poor workmanship or miss in…

I can assure you that many lawyers worked on some boilerplate Ts&Cs that were applied here or that many lawyers reviewed the language on this specific page rather than a “random web guy”.

Re: Visa Advertising Solutions (VAS) Opt Out

#228

Post by foepys » Wed, Dec 30, 2020, 4:33 PM UTC

wpietri wrote: post #223

ianlevesque wrote: post #141

Earlier quoted context omitted.

That's not how any of this works.

Oh? https://www.hackerone.com/blog/Guide-Subdomain-Takeovers

Plus the site uses a certificate that is not only issued by but also owned by Cloudflare according to its metadata. It's undistinguishable from a free tier Cloudflare cert unless you know what exactly you need to look for.

Re: Visa Advertising Solutions (VAS) Opt Out

#229

Post by odonnellryan » Wed, Dec 30, 2020, 4:35 PM UTC

renewiltord wrote: post #186

animex wrote: post #177

Earlier quoted context omitted.

Easily accommodated for. I can get the execution run-time and store in an average in memory for some time-period and have the sleep function top-up the difference between the two paths. Not sure what the "proper security" method is to prevent execution deltas.

Why not just run the thing (which takes some small fraction of time), then pad to five seconds, and respond. Since your work will be done in milliseconds, padding to nearest five seconds will remove any noise. And it's not a thing anyone has a legitimate interest in submitting more than that per second.

Adding five seconds to everything just adds five seconds, it doesn't matter if the difference between the two requests is .01s or 5.01s.

Re: Visa Advertising Solutions (VAS) Opt Out

#230

Post by throwaway894345 » Wed, Dec 30, 2020, 4:41 PM UTC

odonnellryan wrote: post #229

renewiltord wrote: post #186

Earlier quoted context omitted.

Why not just run the thing (which takes some small fraction of time), then pad to five seconds, and respond. Since your work will be done in milliseconds, padding to nearest five seconds will remove any noise. And it's not a thing anyone has a legitimate interest in submitting more than that per second.

Adding five seconds to everything just adds five seconds, it doesn't matter if the difference between the two requests is .01s or 5.01s.

The parent said "pad to 5 seconds" not "add 5 seconds". Thus everything would be 5 seconds (never 5.01). The difference between a hit and a miss would be exactly 0s. Note that I'm not advocating for or against this solution; rather, clarifying the conversation.