Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you didn't cancel the credit card you used for linode.com, now is the time

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#51

Post by rosser »

ChuckMcM wrote: post #49
rosser wrote: post #42

Anecdata to the contrary, I've seen no suspicious activity on my Linode-associated card.

Yet? One of the things I've learned by reading Danchev and other blogs on the scourge of credit card fraud is that 'carders' seem to have waaaaaay more cards than they need so the turnaround time between having it be made public and having it used can be quite long. So far for me every time one of my cards has been compromised there was a small charge that went through before the bigger charges came in. And my bank h…

Fair enough. "Yet."

I've also noticed the same pattern with compromised cards: a couple of small auths to test the waters, and then increasingly large charges coming from decreasingly likely places. I regularly log onto my online banking and inspect the recent activity looking for exactly that kind of activity.

I've long wished for the same, "whitelist-only card" type thing, too. I think I might smell an opportunity...

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#52

Post by davidw »

madmaze wrote: post #2

Thanks, I was thankfully canceled my card. Is there anyone else here that has had their card compromised?

I had some issues with a card several months ago that was used for very few things, including Linode. Security on one of the other services I used was actually pretty bad, rather than inadvertently bad: they resent me my own password, and I canceled immediately, so it may not have been Linode, but it's impossible to say.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#54

Post by gee_totes »

OP, I'm confused how your system for paying for things online works.

If it's a prepaid card, I'm assuming that you have to load it with money. Since you're just using it for Linode, you couldn't have loaded that much money on it (unless you're paying for huge Linodes). I'm wondering how large these large amounts were and why they didn't simply empty out the amount on the prepaid card.

Besides my confusion (if I were using your system, I would load $20 or whatever onto the card each month and then the maximum I could lose if the card was stolen was $20), I would also like to point out that while prepaid cards are easy to dispose of, Credit Cards typically provide better fraud protection.

With credit cards, there is normally a $50 liability if the card is stolen and no time limits around reporting it. With debit cards, there are time limits around reporting the card being lost or stolen. With prepaid cards, they are not subject to the jurisdiction of the FDIC and consumer protections are voluntary on the part of the issuer.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#55

Post by archon »

rapsourly wrote: post #31

My credit card was recently reissued without my request. The accompanying letter said it was being reissued to prevent fraud, as a merchant had recently disclosed a compromise. It did not say which merchant, but not I suspect it could have been linode. Has anyone else had this happen?

I'm not positive that it was Linode, but I received this email from my bank about the card I used for Linode (bank name removed):

"We were notified by a payment processor that your debit card information, such as your name, debit card number and expiration date may have been compromised. Unauthorized access to non-_____ systems may have occurred through a merchant where you shopped or dined, or by other fraudulent activity. Specific details about the compromise were not reported to _____."

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#57

Post by ry0ohki »

ibudiallo wrote: post #17
azinman2 wrote: post #5

To be fair, that still doesn't mean it's from linode 100%. I recently had a fraudulent charge on a Chase Freedom card that I never once used anywhere (their fine print when it arrived showed they mislead me in the rewards I was promised). I had even shredded it when I got it so its not possible someone took it from my place. When they called me about the possible fraudulent charge, they guy explained that various gov…

You are right, i cannot say it's linode 100%, maybe 99%. however it is still a good idea to cancel those cards.

Maybe if they are debit cards, but the hassle of changing cards everywhere combined with the protection against fraudulent charges banks give, I don't plan on doing anything just for the heck of it. IE, lets say your correct and I start seeing fraudulent charges? I call my bank and they reverse them all immediately, it's not a big deal.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#58

Post by jmillikin »

dllthomas wrote: post #47
jmillikin wrote: post #40

Earlier quoted context omitted.

The fact that Linode stored the public and private keys in the same directory is strong evidence that they do not have any competence in security. Their reluctance to disclose the compromise of their customer's passwords and financial data is evidence that they are not trustworthy. So on one hand we have someone who is careful enough about their finances to use disposable prepaid cards for renting a VPS. On the other…

"stored the public and private keys in the same directory" People keep harping on that, but as phrased that's not a problem. Wherever you have your private key, there's no reason not to also have your public key. The issue is if the private key was living somewhere inappropriate. Consider that "public and private keys in the same directory" is exactly what happens when you run ssh-keygen on any of the typical setups;…

The entire purpose of having separate public and private keys is for the private key to be stored in a secure location. That way, when your data-writer is compromised, none of the previously written data is at risk without an additional compromise of the key bastion.

If the private key is stored in the same directory, then there no effectively no additional security over simple symmetric-key encryption with a passphrase.

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#59

Post by [deleted] »

stock_toaster wrote: post #28
greenyoda wrote: post #26

Signing up for on-line services is a good use for "virtual account numbers". This is a feature offered on some Citibank and Discover credit cards (maybe others) that allows you to generate a separate credit card number that's billed to your original account. The nice thing about them is that once a virtual account number has been billed by a vendor, it does not accept any charges in the future except from the same ve…

I wish other banks offered that functionality. I am not a fan of Citibank.

[deleted]

Re: If you didn't cancel the credit card you used for linode.com, now is the time

#60

Post by cmsmith »

Tangentially:

Why do merchants really need to store CC numbers? From the consumers' standpoint, there would be no difference if, during the first transaction, the merchant is issued some alterate key with which to charge the account. Each merchant would be issued their own key, so there would be no risk of a security breach spreading outside of the merchant.

Post reply on HN