Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Advertising Solutions (VAS) Opt Out

marketingreportoptout.visa.com

Post reply on HN
Print view View original

231–240 of 253 posts

Re: Visa Advertising Solutions (VAS) Opt Out

#231

Post by boston_clone »

zelly wrote: post #170
throwaway894345 wrote: post #2

The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?

They'll just throw out all the ones spammed from your IP. If you become obnoxious they will call the FBI because this would be a CFAA violation.

Not a lawyer - would it really be a violation of the CFAA? I'd also be surprised if Visa involved the FBI for someone excessively hitting their API...

Re: Visa Advertising Solutions (VAS) Opt Out

#234

Post by kevin_thibedeau »

z77dj3kl wrote: post #205
aljarry wrote: post #201

Earlier quoted context omitted.

rand() produces linear distributon, which is uniform. Do I understand properly that rand() + rand() would return normal distribution, so #2, for which you can determine the non uniformity? What would be a proper first step to harden API for timing attacks?

rand() + rand() does not give normal. If there is any statistical difference between the timings, it's in theory possible to break. An easy mitigation would be to just drop the card number into a queue and process asynchronously without waiting and returning to the user.

Flood the queue with invalid numbers and timings can still be worked out.

Re: Visa Advertising Solutions (VAS) Opt Out

#235

Post by jhart99 »

inakarmacoma wrote: post #135
jhart99 wrote: post #102

Earlier quoted context omitted.

If you want a real trip, I'd suggest getting your data from DT Client Services via CCPA request if you are in California. That was really shocking.

What process did you follow? Were there costs associated with printing, delivery, etc?

I sent them an email with my request. The email address can be found on the CA Attorney General's webpage here https://oag.ca.gov/data-brokers?combine=dt+client I used the form from Epic which is on this page https://epic.org/ccpa/ There are no costs associated with this and they are required to provide the information to you up to two times in a year. Not every business must comply.

Re: Visa Advertising Solutions (VAS) Opt Out

#236

Post by ksk »

alpb wrote: post #52
3gg wrote: post #51

What would be better is if the US had (does it?) a nation-wide law requiring explicit opt-in, as opposed to having to opt out of surveillance. Small steps forward. Also, does this form really amount to anything other than "we promise we won't spy you that much?" Are banks audited in this regard, or are they subject to the same non-existent regulations as the Sillycon Valley surveillance?

“Better” for who? The corporations or the people? United States usually favors one over the other by design.

By design, democracy favors entities who care, and therefore lobby for change. Corporations do the majority of the lobbying and it shows.

Re: Visa Advertising Solutions (VAS) Opt Out

#237

Post by renewiltord »

odonnellryan wrote: post #229
renewiltord wrote: post #186

Earlier quoted context omitted.

Why not just run the thing (which takes some small fraction of time), then pad to five seconds, and respond. Since your work will be done in milliseconds, padding to nearest five seconds will remove any noise. And it's not a thing anyone has a legitimate interest in submitting more than that per second.

Adding five seconds to everything just adds five seconds, it doesn't matter if the difference between the two requests is .01s or 5.01s.

Pad to, not pad by.

I.e. the padding to add is (5 - duration_of_operation) with duration of operation being far lower than 5 s.

Re: Visa Advertising Solutions (VAS) Opt Out

#238

Post by eximius »

boston_clone wrote: post #231
zelly wrote: post #170

Earlier quoted context omitted.

They'll just throw out all the ones spammed from your IP. If you become obnoxious they will call the FBI because this would be a CFAA violation.

Not a lawyer - would it really be a violation of the CFAA? I'd also be surprised if Visa involved the FBI for someone excessively hitting their API...

CFAA is draconian, the courts are behind the times, and even if you win, it'd be in court where you don't want to be in the first place.

Re: Visa Advertising Solutions (VAS) Opt Out

#239

Post by twosdai »

wpietri wrote: post #224
miked85 wrote: post #217

Earlier quoted context omitted.

Does that mean that you don't trust subdomains by default? That seems a bit extreme/unnecessary.

I don't know that I trust anything by default. It's always a risk assessment. When I saw a kinda basic-looking site asking for my credit card number, I definitely looked at the domain, and alongcomplicatedthingineverheardof.visa.com was definitely more concerning than, say, www.visa.com.

Can't even trust myself these days, its really awful. /s

Re: Visa Advertising Solutions (VAS) Opt Out

#240

Post by eyeareque »

durpkingOP wrote: post #156
eyeareque wrote: post #48

To verify that this is a legit site: Go to: https://usa.visa.com/legal/global-privacy-notice/additional-... Then click on: “Visa Products & Services: How does Visa use personal information to benefit consumers and businesses?” Then scroll to the bottom of that section and you’ll see the VAS link: ”U.S. cardholders can opt out of Visa using their card transaction data for VAS.” where you can opt out. iPhones will auto…

You are suggesting people do something that is completely unnecessary. It's a subdomain of visa.com. If your concern was valid, you could put your comment disclaimer on every single link ever posted on hackernews.

It can be hard to clearly identity website urls on a mobile browser, but also as others pointed out here there is a common attack called sub domain takeover.

I don’t personally like typing my credit cards into websites without making sure it is legit.

Post reply on HN