Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards are vulnerable to brute force kind attacks

metin.nextc.org

Post reply on HN
Print view View original

21–30 of 201 posts

Re: Credit cards are vulnerable to brute force kind attacks

#21

Post by idontwantthis »

Natfan wrote: post #17
janalsncm wrote: post #6

At least with a credit card you have some fraud protection. Report it and the charge should be reversed. And chargebacks are possible. With a debit card you’re playing with your own money.

how is it not also your money when using a credit card? It's in the name, "credit" card. you have to pay it off, no? (i have never ever used a credit card)

It comes with fraud protection and your money does not move anywhere until the end of the next month. With a debit card your money moves immediately.

Re: Credit cards are vulnerable to brute force kind attacks

#23

Post by majorchord »

dogma1138 wrote: post #5
badgersnake wrote: post #4

Oh okay, so this is why Amex launched the online card in the app that changes the Cvv2 every few minutes.

Amex was late to the party with virtual cards.

None of my banks or credit cards support them... not sure how widespread it really is.

Re: Credit cards are vulnerable to brute force kind attacks

#25

Post by kadoban »

sixtyj wrote: post #2

People should have a separate card for online payments and have just enough money on it for a payment. I know that I am naïve :) Back to the article: Weak point was a password that lead to another merchant not using 3D secure. It seems from the article that bad actors have fully automated system, so (big) merchants should have handle automatic login attempts from the same ip address with different accounts. I see it…

Tbh, fraud for credit cards is covered by the bank, so I typically just don't care. I just check my statements for anything that looks off.

Re: Credit cards are vulnerable to brute force kind attacks

#26

Post by J8K357R »

I once had a person that was hired by my company and then started bragging about finding a way to add stored value to gift cards. Then come to find out they were under investigation by the FBI. This was a government contractor mind you, so the biggest security guard I’ve ever seen showed up to escort them out.

Re: Credit cards are vulnerable to brute force kind attacks

#27

Post by janpeuker »

Payment processors don't allow just brute forcing all card numbers a.k.a. card enumeration or card testing [1][2] and card schemes penalise merchants and payment processors heavily if they don't take measures against it [3].

1) https://stripe.com/newsroom/news/card-testing-surge

2) https://stripe.com/blog/the-ml-flywheel-how-we-continually-i...

3) https://docs.stripe.com/disputes/monitoring-programs#enumera...

Re: Credit cards are vulnerable to brute force kind attacks

#28

Post by epcoa »

tptacek wrote: post #9
janalsncm wrote: post #6

At least with a credit card you have some fraud protection. Report it and the charge should be reversed. And chargebacks are possible. With a debit card you’re playing with your own money.

That has not been my experience with debit cards in the US at major banks, at all , over decades. (I'm pathologically avoidant of credit cards, which I think are mostly pointless.)

Well good for you. Us poors in the US like them for what they’re worth.

Re: Credit cards are vulnerable to brute force kind attacks

#29

Post by tptacek »

yladiz wrote: post #10
tptacek wrote: post #9

Earlier quoted context omitted.

That has not been my experience with debit cards in the US at major banks, at all , over decades. (I'm pathologically avoidant of credit cards, which I think are mostly pointless.)

Why do you think they’re pointless?

For most of my adult life I haven't been able to get a credit card --- even after we sold Matasano Security, with the proceeds of that acquisition sitting in a money market checking account at the giant bank I use, that bank would still only issue me a secured card. I pay my bills and all, but at some point when I was like 19 I bought a shirt at Nordstroms and they signed me up for a card and I didn't pay enough attention so I presumably still somehow owe them $40, and it wrecked my credit score.

No part of my life has been harder for not having revolving credit. I had a family, with two kids, starting in my very early 20s; I have lived on ramen wages several times since then; I've bought houses, rented cars, all that stuff. There's really been no point I can think of where I felt like having a revolving credit card would have made any of it more manageable.

I'd get points and stuff (I have a card now, it has a fuckload of points on it) but that's just an incentive to use the cards, not an intrinsic case for them.

I think most people would be much better off just using debit cards, and operating with the funds they actually have. And, again: it is in fact easy for me to say that today, but I believed the same thing when I was younger.

The crazy thing is coming to realize how little your credit score matters if you decide not to play this game. People say it will impact your ability to get a mortgage or a lease, but: not my experience!

Re: Credit cards are vulnerable to brute force kind attacks

#30

Post by stavros »

sixtyj wrote: post #2

People should have a separate card for online payments and have just enough money on it for a payment. I know that I am naïve :) Back to the article: Weak point was a password that lead to another merchant not using 3D secure. It seems from the article that bad actors have fully automated system, so (big) merchants should have handle automatic login attempts from the same ip address with different accounts. I see it…

I think https://privacy.com is the best solution we can have with the current system.
Post reply on HN