PayPal Denies Providing Payment Information to Twitter Username Hacker

Post by Uchikoma » Thu, Jan 30, 2014, 4:34 PM UTC

rahimnathwani wrote: post #61

Uchikoma wrote: post #57

Earlier quoted context omitted.

If you display 4 digits to the user for CC validation, as basically everyone does, then there will always be someone who can read those 4 digits and give them to someone else.

You don't need to display them to the user. The user can ask for them from the customer. The user types in the 4 digits the customer provides. The computer compares the two strings. The user need never see the real stored digits.

Post by jorgem » Thu, Jan 30, 2014, 4:40 PM UTC

ScottWhigham wrote: post #52

chris_wot wrote: post #28

Earlier quoted context omitted.

It's done all the time with class actions.

This line of reasoning doesn't make a whole lot of sense. As a member of several class action lawsuits over the past 20+ years, I bet I've made out like a bandit - no less than $2.50 distributed over maybe 5-7 CALs. Sweet! The lawyers, however, probably made $500,000,000 with those 5-7 lawsuits. So while there's a financial want from the lawyers' perspective, why would I want to go that route?

Post by pessimizer » Thu, Jan 30, 2014, 4:55 PM UTC

jessedhillon wrote: post #56

bushido wrote: post #47

Earlier quoted context omitted.

When you are a financial company. edit: financial companies, or any company when dealing with a financial or privacy breach usually needs to prove their innocence when they are attributed to allegedly causing financial loss (to varied extents depending on the situation). This is an expectation from society in general. It may not seem fair or be legally required, but that's just the way it is.

You need a course in elementary logic. Specifically, on the burden of proof. Also, everything you wrote in this comment here seems to be a complete fabrication.

Post by jader201 » Thu, Jan 30, 2014, 5:00 PM UTC

Uchikoma wrote: post #63

jader201 wrote: post #60

Earlier quoted context omitted.

My argument is, this attention wouldn't even be here had he just kept quiet. I don't think he was clever enough to have foresight that a) this would get this much attention, and b) he would need to deflect said attention by fabricating an elaborate hoax. The guy was simply wanting to brag about what he did in the excitement of him actually pulling it off. I think this is much more believable than him fabricating this…

After all the prison sentences lately, I'm not sure he wants to brag about himself.

Post by hfsktr » Thu, Jan 30, 2014, 5:19 PM UTC

chilldream wrote: post #43

bushido wrote: post #27

What's interesting is in the original "i got hacked" post[0]. The email from the hacker says that he called paypal and posed as an employee. That may not be tough to do, i.e. if you call a call center, select the wrong department and request an internal transfer, it is quite possible that the person receiving the call would not be able to distinguish between an internal call or a customer call. So if the hacker told…

- When I worked in a bank's call center, it would be impossible for such an attacker to gain any information without the (receiving) agent screwing up unless the attacker had already successfully phished a different employee. - The situation you describe in particular, where one employee might cold transfer to another employee without the receiver verifying whether the customer had identified already...if that is eve…