Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#41

Post by ngneer »

fatnoah wrote: post #11
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or con…

Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?

Re: Delta Dental says data breach exposed info of 7M people

#42

Post by gregw2 »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

Kind of silly? Can’t/don’t the three digits get rotated independently of rotating your credit card or account number though?

Also some clearer rules/expectations in place that nobody should ever persist the data on disk?

Re: Delta Dental says data breach exposed info of 7M people

#43

Post by BytesAndGears »

pants2 wrote: post #32
MattGaiser wrote: post #23

Earlier quoted context omitted.

Even as a tech person, I am indifferent. I’ve adapted to a world where cards get stolen, so I never use debit, review my statements, and have spending notifications turned on for my phone. I have the apps so I can instantly lock my card. I have already learned to live in a financial castle. It is obviously not great, but an additional breach has little marginal impact on my life.

The real question is why online credit card payments still involve using the whole card number, as opposed to some message signed by the card's private key authorizing certain spending limits for a retailer.

That’s exactly what we have in the Netherlands — there is a system where you can go to check out, using iDeal.

It gives you a QR code at checkout, which you can scan with a banking app on your phone. It shows on your phone the amount you’re sending, and to whom, with a button to approve or deny.

You can also set it up as a recurring payment in the app and say “authorize this same payment automatically in the future, up to €xyz amount”. Then you can see a list of all of your authorized recurring payments, and cancel or change them any time from the bank app.

It’s a great system!

Re: Delta Dental says data breach exposed info of 7M people

#44

Post by ryandrake »

gunapologist99 wrote: post #28
gosub100 wrote: post #20

Earlier quoted context omitted.

its not silly just because it can't solve all problems. It goes a long way to gas station type skimmers less valuable because you can't print a phony card from them, or the phony card you can print is limited to a subset of possible purchases. perfect-enemy-of-good yadayda.

You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.

I tried to better clarify what I'm saying in [1]. I'm not saying the small number of digits makes it insecure, it's that "moar numbers" is not really adding anything in terms of multi-factor or secrecy. Instead of knowing N digits, you merely need to know N+M digits. It is not changing the nature of the secret.

1: https://news.ycombinator.com/item?id=38655609

Re: Delta Dental says data breach exposed info of 7M people

#45

Post by chefandy »

ryandrake wrote: post #35
chefandy wrote: post #34

Earlier quoted context omitted.

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k. If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authe…

> If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authentication factor, which seems pretty worthwhile to me. It's not really another factor in the sense of the three types of factors: Something you know, something you have, something you are. It's just more digits of "something you know" so it's the same factor. It's why 2-factor auth isn't just…

Seems to me that when you turn it into data, it pretty much all becomes "something you know." If a credit card required biometric authentication to make credit card transactions and a vendor stored my biometric signature in a database along with my credit card number, it would be no more or less secure than a 3 digit number.

There are better ways to handle it. Policy is a good interim step to mitigate damage before they're implemented.

Re: Delta Dental says data breach exposed info of 7M people

#46

Post by cbsmith »

ryandrake wrote: post #44
gunapologist99 wrote: post #28

Earlier quoted context omitted.

You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.

I tried to better clarify what I'm saying in [1]. I'm not saying the small number of digits makes it insecure, it's that "moar numbers" is not really adding anything in terms of multi-factor or secrecy. Instead of knowing N digits, you merely need to know N+M digits. It is not changing the nature of the secret. 1: https://news.ycombinator.com/item?id=38655609

It's a different sent of protocols, reducing the surface area of successful breach strategies. If you simply added three digits to credit card numbers but maintained the same protocols on the credit card numbers, it wouldn't improve security nearly as much. There's fewer tactics that will successfully get you N+M digits those that would get you the N digits. Most 2FA works the same way. It's not like the six digits of Google Auth add security, but the protocols around them.

To put it another way: the value of those extra three digits is that they are indeed "more secret". They exist on far fewer hard drives.

Re: Delta Dental says data breach exposed info of 7M people

#47

Post by lovecg »

hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

They won’t and it won’t be.

Re: Delta Dental says data breach exposed info of 7M people

#48

Post by glimshe »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

It is a poor person's version of a password for using the credit card, only available to people that has the credit card in their hands. Not silly at all.

Re: Delta Dental says data breach exposed info of 7M people

#49

Post by mikestew »

ryandrake wrote: post #18
hn_throwaway_99 wrote: post #4

> who had their names, financial account numbers, and credit/debit card numbers, including security codes, exposed. Delta Dental should be rightly and truly f'd for that one. Storing security codes at all is totally forbidden by PCI rules. Delta Dental should have their ability to process credit cards completely revoked for this egregious breach.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date.

Apple Card rotates the CCV (fixed time interval, AFAICT, not per transaction), so it is a secret, even if only temporarily.

Once you give it out once or hand your credit card to literally anyone, it's out.

Sure, the cashier now has it, but they're not supposed to be entering it into a database so that everyone has it, hence the "PCI" part.

Re: Delta Dental says data breach exposed info of 7M people

#50

Post by jldugger »

gregw2 wrote: post #42
ryandrake wrote: post #18

Earlier quoted context omitted.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

Kind of silly? Can’t/don’t the three digits get rotated independently of rotating your credit card or account number though? Also some clearer rules/expectations in place that nobody should ever persist the data on disk?

They usually (always?) get rotated at the same time as the expiration date.
Post reply on HN