Live data from Hacker News

Casa Client Case Study: The Tinder Trap

blog.keys.casa

111–120 of 211 posts

Re: Casa Client Case Study: The Tinder Trap

#112

Earlier quoted context omitted.

> Are there plans to build equivalent features on Blockchain for crypto currencies? Basically every crypto enthusiast out there touts the non-reversibility of crypto transactions as its primary feature , not a bug, and that is why I see crypto as generally useless for your average person.

Not a fan of crypto, but your argument applies to cash, wish is still widely used (not only by shady people ;) )

I don’t keep me entire net worth in cash. ATMs have limits, and banks typically require in person presence and reporting when dealing with large amounts of cash. Crypto not so much.

Re: Casa Client Case Study: The Tinder Trap

#113

I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a comp…

My bank also in theory supports reversing transactions but last two times I've asked them to they didn't do it anyway.

Anyway, there's no issue with building and using a service to handle that for you both on top of the currencies and as a smart contract on the blockchain itself. Most current crypto users just don't seem likely to use it as they prefer the control. This might change as the audience changes.

Re: Casa Client Case Study: The Tinder Trap

#114
post #50

Earlier quoted context omitted.

Ethereum has had a couple of reversible payment systems built over the years, but nobody used them. Non-reversible, immediate, guaranteed transactions are just more convenient outside of a few edge cases

Similarly, outside of a few edge cases, it is a lot easier and cheaper to build a house with no fire protection whatsoever.

Brakes just make the car go slower or even stop, but the entire purpose of a car is to go and go fast.

Re: Casa Client Case Study: The Tinder Trap

#115

I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a comp…

> Or do their users have to go through the same painful failures?

This might actually be the first time for people to learn these lessons. They've been free-riding on the protections that banking regulations provide for all of their lives.

Re: Casa Client Case Study: The Tinder Trap

#116

Earlier quoted context omitted.

Our client's privacy is more important than your curiosity; it's as simple as that.

So it is made up then.

Nope, but the value of the educational takeaways from the report are not contingent upon me providing evidence of this specific attack. You are welcome to be skeptical.

Re: Casa Client Case Study: The Tinder Trap

#117

This is one of my biggest fears. As a result I use the supposedly not ok, security by obsecurity. (Along with other normal precautions) I don't tell people which Bitcoin wallet I recommend, I simply say "I don't tell people where I hide gold". Although not sure if I could survive devil's breath.

> As a result I use the supposedly not ok, security by obsecurity. (Along with other normal precautions)

It's not that it's somehow wrong, the problem with security-by-obscurity is that it's often mistaken for cryptographic security of the Kerchoff kind, where you can reveal the entire scheme, minus the secret key.

Something like port-knocking is a form of security-by-obscurity that is technical enough that someone might mistake it for cryptographic security.

Re: Casa Client Case Study: The Tinder Trap

#118

"Not your keys, not your Crypto" is good advice, but I personally prefer to leave my wallet in the hands of a trusted large exchange like Gemini, Coinbase, or Kraken. Not only do they have better security than I do, they also have a whole slew of extra barriers in the event a malicious actor wants to drain my funds. I can freeze withdrawals, whitelist specific addresses, and put time/wait barriers to all of these thi…

What if any of those exchanges get hacked or exit? Store offline.

Insurance?

Re: Casa Client Case Study: The Tinder Trap

#119

Earlier quoted context omitted.

Our client's privacy is more important than your curiosity; it's as simple as that.

So it is made up then.

So you have no idea then. We both know you have no information about this story so let's not pretend. If it's made up or not your have no clue

Re: Casa Client Case Study: The Tinder Trap

#120

I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a comp…

> To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a compensating transaction) and finally the chargeback and legal recourse

I'm vaguely aware that there are several checks at the different layers... but I'm puzzled, are there really options to reverse payments at all those layers?

I'm asking, because I've seen multiple times some surprising transactions/unapproved transaction/forgot to cancel a recurring payment...

and, each and every time... the e-money institution/bank/credit card provider, was unable to do anything, until the transaction actually posted.

i.e. while the transaction was still shown as "pending", I couldn't do anything (besides contacting the seller, which obviously wouldn't do anything). Each and every time (when I couldn't eventually get a refund from the seller), I had to wait for the transaction to be posted to be able to file a chargeback

Post reply on HN