Live data from Hacker News

Delta Dental says data breach exposed info of 7M people

bleepingcomputer.com

81–90 of 152 posts

Re: Delta Dental says data breach exposed info of 7M people

#81

Earlier quoted context omitted.

> Storing security codes at all is totally forbidden by PCI rules. It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date. Once you give it out once or hand your credit card to literally anyone, it's out. Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers. Our payment system needs something like: struct { string credit_card_number;…

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k. If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authe…

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand.

If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you only had to try about 24 or 36 cards with one month/year.

Re: Delta Dental says data breach exposed info of 7M people

#82

Earlier quoted context omitted.

Because smart card readers aren't very common on home computers.

It’s a weird skeuomorphism that online payments are even related to physical cards. It should just be through your online banking account.

It's just a legacy pattern. Online credit card payments predate online banking. The whole model for US card payments online was created as an extensions of the way credit cards were used to pay via mail or telephone.

Re: Delta Dental says data breach exposed info of 7M people

#84
post #11

Earlier quoted context omitted.

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or con…

> A customer asked for a screen to be able to see CC numbers for their own customers I'd be curious what reason they had.

A fly-by-night IT training/certification/voucher reseller I worked for around that time saved customer billing information as a convenience.

No joke-- credit card numbers, billing addresses, CVV codes, all stored in plaintext in an Access database. Tiny shop though; I don't know if they were big enough for PCI to even apply.

Re: Delta Dental says data breach exposed info of 7M people

#85

It’s super fun and cool that dentistry is controlled by a cartel and we just let it happen out in the open. It is NOT insurance, because there is no risk pooling or coverage for adverse events. It’s just a payment plan that sets prices unilaterally.

As someone that used Dental Insurance heavily after I didn't take good care of my teeth in my 20's and previously negotiated many different Dental policies as an agent for a large employer this really isn't true.

1. I found that different Dental Insurance companies have wildly different negotiated rates and there is no real standard. Delta Dental tends to have better negotiated rates in my experience and United Healthcare's dental plans seem like they don't negotiate at all and using a specialized Dental company results in the lowest rates overall as the large health insurers are simply profiting off the insurance and don't seem to care how much they pay, which sucks when you pay a percentage for a procedure.

2. The totally covered population for dental insurance is not big enough to control the market. Generally, I found that when I wasn't covered by dental insurance, dental costs were a lot higher and you do generally receive a savings from dental insurance and they really don't have enough market share to control the market.

3. The coverage for adverse events is mostly just limited, because if you go to the dentist regularly, you generally don't have tons of adverse events within one year. I think most people will find a decent dental insurance plan will mostly cover them. Even if you exceed the negotiated rate,

I just find that in general having dental insurance is beneficial to me as a person and not a scam like vision insurance where you are generally better off finding a coupon or deal, or ridiculous like health insurance where they have manipulated the networks and deductibles so that the average person has no idea what they are buying or how to evaluate it.

My criticism of dental insurance would simply be that I think that policy holders should benefit from company negotiated rates under a policy even when a particular item isn't covered under their policy. I find that is the one area where dental insurance in general is lacking, because dental insurance takes the negotiation out of pricing and gives you the benefit of the companies negotiated rates.

Re: Delta Dental says data breach exposed info of 7M people

#88

Earlier quoted context omitted.

> A customer asked for a screen to be able to see CC numbers for their own customers I'd be curious what reason they had.

In 2002? Probably something now-crazy like “how else will I process returns?” It is not directly related, but as a hopefully funny semi-related anecdote, the federal government stopped states from putting social security numbers on drivers licenses in 2004. Renewals frequency depends on the state, but it is typically in the 4-8 year range, so plausibly until 2012 people were going around showing their SSN to anybody…

At one time it was routine to have your SSN and Drivers License # printed on your checks. And in 1988 my student ID number as university was my SSN.

Re: Delta Dental says data breach exposed info of 7M people

#89
post #65

If you've been putting it off, a friendly reminder to freeze your account at the credit card agencies. Make sure you do all 3! Here's details from NerdWallet: https://www.nerdwallet.com/article/finance/how-to-freeze-cre...

Good tip! It's awful what this entails:

1) Creating accounts with the major credit reporters, presumably subject to hacks or social engineering

2) Accounts that require answering an easily guessed "secret question"

3) Password "rules" that restrict both the length and special characters of your password

4) After all that, creating the account results in a "Congratulation!" NOT FROZEN account. You have to go through an extra step to actually feeze it.

5) "Sorry, we can't freeze your account right now!"

Re: Delta Dental says data breach exposed info of 7M people

#90
post #32

Earlier quoted context omitted.

Even as a tech person, I am indifferent. I’ve adapted to a world where cards get stolen, so I never use debit, review my statements, and have spending notifications turned on for my phone. I have the apps so I can instantly lock my card. I have already learned to live in a financial castle. It is obviously not great, but an additional breach has little marginal impact on my life.

The real question is why online credit card payments still involve using the whole card number, as opposed to some message signed by the card's private key authorizing certain spending limits for a retailer.

Apple Pay is a virtual number all the time, and Amex with Google Chrome is or can do it too

baby steps, significant ones, but an incomplete solution

Post reply on HN