Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

61–70 of 158 posts

Re: Detect breaches with Canary credit cards

#61

Post by myself248 »

pelasaco wrote: post #24
myself248 wrote: post #20

The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.

Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken . I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess,…

How would the operator of an ecommerce website have gotten their hands on these things to seed their data with them? Is this something they would've known to ask for?

Re: Detect breaches with Canary credit cards

#63

Post by loeg »

jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

Reducing friction in repeated transactions? Someone needs to store it.

Re: Detect breaches with Canary credit cards

#64

Post by bentcorner »

europeanguy wrote: post #52

This idea has an obvious problem. It's a lot of hard work. How many people are going to be diligent in planting canaries etc? And if you are, can you be diligent for the next 1, 2, 3 decades? That's a lot of time spent on this. You know what would be better? If every bank provided as a service/feature the ability to create single-use (and single-merchant!) debit cards. Revolut can do it, why can't huge banks do it as…

Capital One can generate single/repeat use virtual cards, although it's for number-only transactions (online only?). I don't know if there's way to use them for tap/swipe transactions.

Re: Detect breaches with Canary credit cards

#65

Post by jameshart »

loeg wrote: post #63
jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

Reducing friction in repeated transactions? Someone needs to store it.

Unless you’re an actual payment platform, that someone should not be you.

Re: Detect breaches with Canary credit cards

#67

Post by teilo »

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert.

I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

Re: Detect breaches with Canary credit cards

#68

Post by hn92726819 »

jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

Do you think companies avoid storing this data? There's no reason for them not to, so they do it. Look at the target hack for an example of real word credit card info stored.

Also, tons of companies have one-click payment options (ever order something from Chipoltle or Dominos app?)

Edit: It should be disincentivised, but look at any "punishment" for a data leak and it's cheaper for them to just lose the data

Re: Detect breaches with Canary credit cards

#69

Post by b3morales »

europeanguy wrote: post #52

This idea has an obvious problem. It's a lot of hard work. How many people are going to be diligent in planting canaries etc? And if you are, can you be diligent for the next 1, 2, 3 decades? That's a lot of time spent on this. You know what would be better? If every bank provided as a service/feature the ability to create single-use (and single-merchant!) debit cards. Revolut can do it, why can't huge banks do it as…

Capital One does still have these: https://www.capitalone.com/digital/eno/ though caveat the feature is only available via a browser plugin, I assume because they want to be able to scrape your shopping habits/history in the process.

Re: Detect breaches with Canary credit cards

#70

Post by jameshart »

hn92726819 wrote: post #68
jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

Do you think companies avoid storing this data? There's no reason for them not to , so they do it. Look at the target hack for an example of real word credit card info stored. Also, tons of companies have one-click payment options (ever order something from Chipoltle or Dominos app?) Edit: It should be disincentivised, but look at any "punishment" for a data leak and it's cheaper for them to just lose the data

PCI-DSS compliance auditing is not cheap. There’s the incentive right there.

Individual retailers have no need to store actual cardholder information. All the payment platforms provide ways to persist cardholder information, in a way that allows it to be reused but never read.

Post reply on HN