Detect breaches with Canary credit cards • Hacker News Board

Re: Detect breaches with Canary credit cards

#71

Post by legutierr » Sun, Jan 22, 2023, 6:39 PM UTC

acdha wrote: post #44

legutierr wrote: post #33

Earlier quoted context omitted.

This is part of the reason that a lot of people are excited about stablecoins and blockchain payments.

It’s a common marketing point but people aren’t using blockchains because they cost more, take longer, and have no fraud protection. If someone steals my credit card, I’ll likely lose nothing other than some mild inconvenience updating numbers - and I don’t even need to do that with the modern systems like Apple Pay which use unique per-merchant identifiers. That makes quite the contrast with the large sums routinely…

> If someone steals my credit card, I’ll likely lose nothing other than some mild inconvenience updating numbers

You might not lose money when someone steals your credit card, but someone does: either your bank or the merchant will suffer a fraud loss.

Consumer fraud protections with regards to credit cards are necessary because credit cards are fundamentally insecure technology and would be unusable if issuers didn't take on so much of the fraud risk themselves.

> and I don’t even need to do that with the modern systems like Apple Pay which use unique per-merchant identifiers.

Apple Pay is a big improvement over standard credit card technology. It's also closed and proprietary, and requires special equipment to use, on both the merchant side and the consumer side.

> spend your time unbreaking the system instead of marketing it.

Are you criticizing me for writing this comment on HN because I am not at this very moment writing code? In your mind, people can't even talk about a project they may be interested in or working on until the project is finished?

> If you want people to buy your random hashes

Are you sure you are not confusing stablecoins and cryptocurrencies? These are very different things. Stablecoins are transferrable sovereign currency obligations the balances of which are recorded on a blockchain. Stablecoin tech can be used to allow consumers and merchants to interact with any type of monetary account as might otherwise be embodied by a debit or credit card, with similar business terms.

> That makes quite the contrast with the large sums routinely and irrecoverably stolen from blockchain users.

No doubt blockchain security needs to be substantially improved. It will happen, though!

Re: Detect breaches with Canary credit cards

#72

Post by brightball » Sun, Jan 22, 2023, 6:48 PM UTC

I'm really glad to see this project.

I used to do this all the time by hand when I was actively dealing with phishing sites. I'd submit credentials to the site and watch for it on our account login page to identify the perpetrator.

Re: Detect breaches with Canary credit cards

#73

Post by welder » Sun, Jan 22, 2023, 6:59 PM UTC

I use Stripe so this isn't much use to me, but looking at their other canary tokens I could see the AWS key canary being useful.

https://docs.canarytokens.org/guide/

Re: Detect breaches with Canary credit cards

#74

Post by worble » Sun, Jan 22, 2023, 7:12 PM UTC

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.

Re: Detect breaches with Canary credit cards

#75

Post by notafraudster » Sun, Jan 22, 2023, 7:15 PM UTC

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

I had heard of this service before and assumed it costed money, but thanks to your comment checked it out, and apparently they have a free tier allowing you to create 10 cards per month. Cool!

Re: Detect breaches with Canary credit cards

#76

Post by vlabakje90 » Sun, Jan 22, 2023, 7:18 PM UTC

worble wrote: post #74

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.

Revolut has single use credit cards as part of their offering. You can either choose to create a new one for each transaction (disposable card) or a virtual credit card that you can use more than once but discard if something happens to it.

Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.

Re: Detect breaches with Canary credit cards

#77

Post by sschueller » Sun, Jan 22, 2023, 7:18 PM UTC

worble wrote: post #74

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.

What's absurd is that this is something I have to pay for or find a particular issuer of a visa/mastercard. It should be free and included with every visa and mastercard. They should demand that every issuer of their cards needs to offer virtual cards and 3d secure. If they don't then their fees should be significantly higher.

Re: Detect breaches with Canary credit cards

#78

Post by derefr » Sun, Jan 22, 2023, 7:20 PM UTC

worble wrote: post #74

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.

My understanding was that privacy.com is just a “detached service” implementation of something that many European banks offer natively as a feature of having a credit card (or even just a chequing account) with them; and that privacy.com was only viable as a business because, for some reason, American banks are (or were at the time) totally unwilling to build anything like this, so people were willing to settle for a (strictly worse from a “privacy” perspective) third-party-MITM-proxy card if it meant having this feature.

I’d suggest, rather than looking for a “detached service” that does this, look at what (probably larger) European banks besides than your own offer their customers built-in.

Re: Detect breaches with Canary credit cards

#79

Post by [deleted] » Sun, Jan 22, 2023, 7:20 PM UTC

lazide wrote: post #25

myself248 wrote: post #21

Earlier quoted context omitted.

I thought bounty hunters were supposed to solve that. They ignore our laws, we ignore theirs. This leads to a hell of a dystopia, but spammers have left me no choice but to contemplate dystopias.

Bounty hunters are not really a thing in the way you’re thinking - they can’t just go to Japan, investigate someone, arrest them and bring back someone from there for instance. They’re for returning someone already arrested who jumped bail somewhere. And they typically don’t work internationally, as their legality is dubious even within a specific jurisdiction. For something major, it’s generally already possible to…

[deleted]

Re: Detect breaches with Canary credit cards

#80

Post by ISL » Sun, Jan 22, 2023, 7:21 PM UTC

voakbasda wrote: post #15

I have wanted something like this to give to scammers, to help aid in their detection and capture. This is part of that puzzle. Now if only law enforcement would give a shit and do something about all of the rampant fraud. Sadly, I do not believe that will ever happen.

I'm also interested in knowing which law-enforcement divisions are actively interested in taking on fraud cases -- if the community finds it, which divisions and prosecutors are fired up about chasing down online fraud?

Seems like a great way for an ambitious team to make a popular difference in the world.