Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards are vulnerable to brute force kind attacks

metin.nextc.org

Post reply on HN
Print view View original

121–130 of 201 posts

Re: Credit cards are vulnerable to brute force kind attacks

#121

Post by Sohcahtoa82 »

spankalee wrote: post #52
evan_a_a wrote: post #39

>As a consumer, I thought I was safe; when saving my credit card to a billion dollar valued european merchant, or when i purchase something from supermarket and ignore the receipt, but the reality is slightly different from that. >I got the money back via chargeback in short time. So as evidenced, you are protected by the fraud infrastructure. The bank ate the loss for the fraud and you were made whole. In the end, t…

> The bank ate the loss for the fraud and you were made whole _If_ you notice the fraudulent charge.

It never ceases to amaze me how many people don't even look at their bank/credit card statements and just let their credit cards auto-pay.

Back when I was poor, I was logging into my bank and credit card accounts at least twice/week. I always knew within $20 how much money I had.

As a well-paid tech worker, I'm still checking at each paycheck (2x/month) and paying the credit card card off every time, but I'm still scanning the statements for any unexpected charges and to keep a pulse on my spending.

Fun anecdote, my wife started talking to me while I was scanning my statement once and she noticed there was a $20 charge from a business named "Your Side Chick" that she questioned in a joking way. It was from a food cart that specializes in chicken strips.

Re: Credit cards are vulnerable to brute force kind attacks

#122

Post by pxeboot »

julienchastang wrote: post #31

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new e…

> I again called the credit card company and this time, told them to cancel all the digital wallets (there were 99 of them!). There is no way to do this online.

This is highly dependent on your bank. For example, Bank of America lets you view and delete any cards that have been added to a digital wallet right on their website.

Re: Credit cards are vulnerable to brute force kind attacks

#123

Post by XorNot »

Why credit card numbers are full persistent baffles me. They were never meant to be memorable, and the whole process is electronic: surely this can be replaced by cryptography at this point?

I've deliberately demagnetized me and my wife's cards and we have black electrical tape over the numbers in public now.

Online purchases are the last remaining problem which would be completely solved if payments were to random keys rather then depending on everyone having the same number.

Re: Credit cards are vulnerable to brute force kind attacks

#124

Post by thechao »

SkiFire13 wrote: post #72
cj wrote: post #54

Earlier quoted context omitted.

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies. Blog post from Stripe: https://stripe.com/resources/more/what-is-a-card-account-upd...

There are also "network tokens" that allow you to skip this step and instead remain linked to the new credit card when it changes.

I discovered this "quirk" when the local ice rink started charging me for dozens of charges — I was watching them come in. There were two "child2 thechao"s (insert crazy common name); and ... they just picked one and started charging. They didn't want to reverse the charges because the mom of child2 didn't want to pay.

Re: Credit cards are vulnerable to brute force kind attacks

#125

Post by subhobroto »

tptacek wrote: post #100
subhobroto wrote: post #91

Earlier quoted context omitted.

> Under the law, credit card issuers actually have more time to deliberate before making you whole, not less. Could be but in my personal experience, it has been the exact opposite. That said, I don't use banks. I work with credit unions exclusively. Maybe they have very different rules when it comes to handling debit card fraud. The only time I have needed a debit card are when a place doesn't accept credit or charg…

I bought my first property in 2000, when I was in my very early 20s, and definitely wasn't wealthy. I bought a house in Ann Arbor in 2004, when I had no savings and was living on an ordinary developers salary; another in Chicago in 2005 (don't do what I did) when were starting Matasano. We sold Matasano in 2012 and my credit score was bad enough then that I was still required to get a secured card despite a relativel…

> another in Chicago in 2005 (don't do what I did) when were starting Matasano

Uff. I perhaps can imagine what you were going through the next 10 years.

PS: I actually would like to hear your thoughts on where cybersec is headed in the age of LLMs (Mythos or not), would it be OK for me to reach out about it (unless you've written about it already)?

Re: Credit cards are vulnerable to brute force kind attacks

#126

Post by lxgr »

resonantjacket5 wrote: post #95
cj wrote: post #54

Earlier quoted context omitted.

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies. Blog post from Stripe: https://stripe.com/resources/more/what-is-a-card-account-upd...

it's called automatic billing updaters. like Visa: Visa Account Updater (VAU) https://developer.visa.com/capabilities/vau Mastercard: Automatic Billing Updater (ABU) it worked fine for sometime, but the problem is that now the stolen credentials are being refreshed now as well.

Ideally, the issuer is able to investigate what type of fraud exactly happened on the card, and in case of a suspected compromised card number they can choose to simply not perform account updates or carry over tokens to the new card.

Practically, it's of course not that simple or clear-cut. As most things in payments, this too is a trade-off of cardholder inconvenience, support effort, fraud losses etc.

Re: Credit cards are vulnerable to brute force kind attacks

#128

Post by lxgr »

cft wrote: post #120
cj wrote: post #54

Earlier quoted context omitted.

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies. Blog post from Stripe: https://stripe.com/resources/more/what-is-a-card-account-upd...

I also noticed that my Google Wallet cards no longer have expiration dates- when a card expires and they issue a new one, the Wallet card works without any intervention on my part

Wallets usually don't store the card information directly anyway, but only a token, which can be re-associated with new underlying card details when the card is replaced.

The token itself does also have an expiry date (it's a mandatory field in most protocols), but that can be updated as well, I believe.

Re: Credit cards are vulnerable to brute force kind attacks

#129

Post by lxgr »

pxeboot wrote: post #122
julienchastang wrote: post #31

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new e…

> I again called the credit card company and this time, told them to cancel all the digital wallets (there were 99 of them!). There is no way to do this online. This is highly dependent on your bank. For example, Bank of America lets you view and delete any cards that have been added to a digital wallet right on their website.

Only digital wallets, or also any merchant that saved the card using a token? The latter is getting more and more common, but usually happens transparently to the cardholder.

Theoretically, it would allow a pretty neat feature of being able to manage all merchants that have a copy of the card in the banking app and revoke said copies – but since token use is not mandatory, that would be fairly confusing, so I haven't seen this yet as far as I remember.

FWIW, India has taken a pretty radical step towards that future at a regulatory level by effectively mandating merchants to no longer store the underlying card number and use tokens instead. I suspect that such an interface would be more common there, but I don't have any personal experience.

Re: Credit cards are vulnerable to brute force kind attacks

#130

Post by lxgr »

tialaramex wrote: post #114

This blog doesn't mention the most critical part Settlement the part where the bank agrees to transfer money from your account (in this case increasing your debt on the card) to the merchant is completely separate from Authorization. Authorization is the modern EMV ("Chip and pin") authentication, the CVV stuff for online, and any other mechanism by which the bank protects themselves from your fraud and, maybe, as an…

> if you do they just claw it back from the merchant and it's not their problem.

This is true for non-3DS online payments, but not for in-person payments or when using 3DS online. In those cases, the issuer is usually liable.

Post reply on HN