Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

51–60 of 158 posts

Re: Detect breaches with Canary credit cards

#51

Post by acdha »

kibwen wrote: post #49
acdha wrote: post #48

Earlier quoted context omitted.

Think about it at the population level: nobody is impervious to theft but it lowers the window for an attacker to quietly steal money considerably and forces them to slow down their activity trying to avoid canaries. To use a physical security analogy, real world bank robbery is a fool’s game now because of many measures which do not perfectly prevent theft but effectively reduce the profits & odds of avoiding captur…

I'd say this is still putting the burden on the wrong party, though. For this to serve as a useful deterrent in general, canaries need to be quite common. Rather than hoping that thousands of customers will choose to use a canary and monitor individually, any company that stores credit cards should instead contract with an outside auditor, whereby any time a user stores a real credit card in the system, the auditor g…

I don’t think those options are mutually exclusive: merchants should definitely be doing it but note also that many of the scenarios are things where you might want to verify your personal data storage or deal with internal business security.

Re: Detect breaches with Canary credit cards

#52

Post by europeanguy »

This idea has an obvious problem. It's a lot of hard work. How many people are going to be diligent in planting canaries etc? And if you are, can you be diligent for the next 1, 2, 3 decades? That's a lot of time spent on this.

You know what would be better? If every bank provided as a service/feature the ability to create single-use (and single-merchant!) debit cards. Revolut can do it, why can't huge banks do it as well? (BTW if you know one that does, let me know.)

Re: Detect breaches with Canary credit cards

#53

Post by europeanguy »

rich_sasha wrote: post #28

I find it crazy that making a payment requires giving your full details. Using a credit card is less writing a cheque, more handing over a chequebook and saying "help yourself". I dream of a payment system where payment generates some token, which the intended recipient can redeem, perhaps bearer ones for casual transactions, with support for periodic payments, revoking existing tokens or placing per-token limits. On…

How about this?

https://en.wikipedia.org/wiki/GNU_Taler

Re: Detect breaches with Canary credit cards

#54

Post by jay-barronville »

madsbuch wrote: post #2

Very neat! I can definitely see that adding a couple of these to ones password manager would be hugely valuable!

True, but if your password vault becomes compromised, you have significantly bigger problems than credit cards being compromised.

Re: Detect breaches with Canary credit cards

#57

Post by europeanguy »

duckmysick wrote: post #47
marcosdumay wrote: post #41

Earlier quoted context omitted.

Most countries have something like this already.

Here's a list of some of them in Europe: https://en.wikipedia.org/wiki/European_Mobile_Payment_System...

Well, that was a rabbithole. I learned that (BME - Bolsa y Mercados Espanoles - Spanish stock market) is owned by a Swiss company. It blows my mind that countries sell off such important infrastructure, even if in this case to a friendly country.

Re: Detect breaches with Canary credit cards

#59

Post by [deleted] »

DerekBickerton wrote: post #23

This is tangential, but still related: a few years ago I could buy disposable VISA cards which were these vouchers you bought in a store and were preloaded with a fixed amount. They didn't even have to be in your legal name. I put the numbers on e-crime forums for people to snap up, and it was funny watching what kinds of transactions were being made. Most people were using it to buy cryptocurrency. Most of the trans…

[deleted]
Post reply on HN