Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 116 posts

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#11

Post by jacquesm »

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards.

Wouldn't purchasing them create just one more incentive?

Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#12

Post by jacquesm »

mzuvella wrote: post #10
aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

Even online I have to authorize transactions using my token and the chip on the card. So that definitely would make a difference.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#13

Post by jacquesm »

btbuilder wrote: post #6
arrrg wrote: post #5

Earlier quoted context omitted.

Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt.

For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#14

Post by __david__ »

mzuvella wrote: post #10
aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

I hear this a lot and I don't really know how EU's chip and pin works, but wouldn't it be best for the the card to spit out an encrypted blob that only the originating bank can decrypt? IE, no number that's useful to anyone in the middle at all? That seems like a better design to me.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#15

Post by arrrg »

jacquesm wrote: post #13
btbuilder wrote: post #6

Earlier quoted context omitted.

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

Yeah, right, there is lots that can be done. Sadly, also Germany is still somewhat backward in that regard. Every reader seems to work differently, so I’m always a bit hesitant to just stick in my card unprompted (and maybe prematurely), lest I get yelled at or something.

There is lots to optimise, but chip and PIN is not inherently slow. In fact, for me it’s already as fast as cash in most cases.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#16

Post by willvarfar »

GabrielF00 wrote: post #3

I was at a home depot on September 1st and my credit card was declined for security reasons. I just moved to a different state, but I had no problem using the card at other stores that same day, including to make a larger purchase at the same mall as the home depot.

So you may have been lucky and avoided your card getting breached, if that's the only time you went to home depot that is.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#17

Post by kubiiii »

aianus wrote: post #8
arrrg wrote: post #5

Earlier quoted context omitted.

Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)

Before Canada implemented Chip and PIN, you usually didn't have to sign the receipt for those kind of small purchases. It takes at least 10x longer now to do the insert, type PIN, remove than just a swipe.

Contactless payment is more and more widespread in france for purchases < € 20.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#18

Post by __david__ »

aianus wrote: post #4
aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

I wish they would deny merchant accounts to merchants too cheap/lazy to roll out contactless payments alongside chip and pin. There's nothing more stupid and frustrating than holding up the line doing chip and pin to buy a $5 meal at Subway.

Where are you from? Around here (Southern California) every card reading machine defaults to debit transactions, where you have to enter your PIN anyway. At least when you do credit cards you don't have to sign them for small purchases any more (less than $50 at Home Depot, for instance).

I really can't say I've ever felt frustrated waiting for the person ahead of me to pay (except for maybe old people hand writing checks at the grocery store—and even then it's kind of interesting to see such old-school payments in action).

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#19

Post by clarkm »

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

Well the FAQ on the homepage says "Do NOT contact us about Bitcoin transfer that has status of Unconfirmed Transaction on Blockchain.info" so I'm guessing they don't use PayPal.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#20

Post by jahewson »

btbuilder wrote: post #6
arrrg wrote: post #5

Earlier quoted context omitted.

Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

That's the case for chip and pin too, low-cost transactions can be authorised with just a swipe.
Post reply on HN