41–50 of 158 posts
I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. On…
I wonder if the BIN/IIN (Bank/Issuer Identification Number[0]) of canary cards give it away. For this to work against sophisticated attackers, I'd expect a canary card to be indistinguishable from a regular one, though I still love the ingenuity of it. edit: They mention this in the article, I missed it. [0] https://en.wikipedia.org/wiki/Payment_card_number#Issuer_ide...
The blog post specifically calls out BINs and their limitations and some things they are doing to improve it.
I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. On…
I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. On…
This is part of the reason that a lot of people are excited about stablecoins and blockchain payments.
That makes quite the contrast with the large sums routinely and irrecoverably stolen from blockchain users. If you want people to buy your random hashes, spend your time unbreaking the system instead of marketing it.
The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.
.. lets see .. a penny for the peep show [canary token] or a dollar for the lap dance [privacy.com]. No argument here - lap dance it is.
I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. On…
Most countries have something like this already.
The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.
I wouldn't say this is much of a solution to the problem, though. There's no guarantee that anyone will attempt to use your canary card before they use your actual card. For one-time purchases, a better approach is to generate ephemeral cards that can only be used for a short amount of time, where it doesn't matter if the card gets leaked. And plenty of credit cards do offer this service.
To use a physical security analogy, real world bank robbery is a fool’s game now because of many measures which do not perfectly prevent theft but effectively reduce the profits & odds of avoiding capture. If attackers can’t get enough money to be worth the risk & effort far fewer people are going to try even though it’s still possible.
Earlier quoted context omitted.
I wouldn't say this is much of a solution to the problem, though. There's no guarantee that anyone will attempt to use your canary card before they use your actual card. For one-time purchases, a better approach is to generate ephemeral cards that can only be used for a short amount of time, where it doesn't matter if the card gets leaked. And plenty of credit cards do offer this service.
Think about it at the population level: nobody is impervious to theft but it lowers the window for an attacker to quietly steal money considerably and forces them to slow down their activity trying to avoid canaries. To use a physical security analogy, real world bank robbery is a fool’s game now because of many measures which do not perfectly prevent theft but effectively reduce the profits & odds of avoiding captur…
Very interesting tool. I'm going to write the canary CC onto a physical card and swipe it first when shopping. If I ever see it randomly accessed, I'll know my 2nd card (actual payment card) is burnt. >Credit Card Rate-Limiting currently in place. Please try again later. Maybe tomorrow.