Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#51

Post by mattmanser »

DrTarantism wrote: post #50
awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

That's not close to being a chicken and egg. The card companies just have to release the cards, then up the fees for using it without chip & pin.

What's the point of buying the POS systems when no-one can use it and there's no guarantee the cards will be rolled out?

It happened very rapidly here in Britain once the cards were out.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#52

Post by DangerousPie »

DrTarantism wrote: post #50
awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

How is that? I have a Chip+PIN enabled credit card and if the shop doesn't support that I can still swipe the magnetic stripe.

I don't see why they don't just provide credit cards with both options for a while until enough of the PoS hardware has been upgraded that they can get rid of the magnetic stripe. I guess cost plays a role, but I would assume that the decrease in fraud might offset that somewhat.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#53

Post by dghughes »

jvm wrote: post #48
awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

http://m.youtube.com/watch?v=B80SyRmtbdI

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#54

Post by jacquesm »

hayksaakian wrote: post #33
MichaelApproved wrote: post #25

Earlier quoted context omitted.

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

Could you do a frontend validation? At the point of accepting a card, before it is tokenized?

What do you mean with 'tokenized'?

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#55

Post by ceejayoz »

jacquesm wrote: post #54
hayksaakian wrote: post #33

Earlier quoted context omitted.

Could you do a frontend validation? At the point of accepting a card, before it is tokenized?

What do you mean with 'tokenized'?

Stripe turns a card number into a token, which you can store without needing to worry about PCI compliance. That token can be used with Stripe to use the card from their secure store.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#56

Post by ownagefool »

aianus wrote: post #23
jacquesm wrote: post #13

Earlier quoted context omitted.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

As far as I'm aware if you tip via chip and pin the vendor will generally keep a percentage. I tend to pay by card, tip with cash. :)

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#57

Post by ceejayoz »

willvarfar wrote: post #16
GabrielF00 wrote: post #3

I was at a home depot on September 1st and my credit card was declined for security reasons. I just moved to a different state, but I had no problem using the card at other stores that same day, including to make a larger purchase at the same mall as the home depot.

So you may have been lucky and avoided your card getting breached, if that's the only time you went to home depot that is.

To get a decline the POS would have had to take the card number, so probably not.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#58

Post by GFK_of_xmaspast »

MichaelApproved wrote: post #25
nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

If you can "100% detect the fraudulent transactions from real ones" why don't you refuse to send the details to Stripe.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#60

Post by listic »

abrkn wrote: post #35
nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

Why do they use ICQ?

You mean, while the rest of the world have moved on to something else? It is popular in Russia.

For some reason, it became popular way back then and that's what nearly everyone uses ever since. Why did the rest of the world switch?

Post reply on HN