Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

131–140 of 158 posts

Re: Detect breaches with Canary credit cards

#131

Post by lxgr »

NavinF wrote: post #81
teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

Worth mentioning that several banks offer virtual credit card numbers as a built-in feature so you don't need a separate service: https://www.doctorofcredit.com/list-of-banks-which-offer-vir... I've only used this for the sketchiest of vendors though. Chargebacks are pretty easy for the once-a-decade event where I get billed for something incorrectly.

Per that reference, it seems like only two major issuers still offer the feature.

Re: Detect breaches with Canary credit cards

#132

Post by lxgr »

asciimike wrote: post #103
lobstersammich wrote: post #91

Does anyone have a good alternative to Privacy.com where your virtual credit card transaction data isn't sold to Wall Street? If you're unfamiliar with what a "virtual [credit] card" is here's the page from Privacy.com's website: https://privacy.com/virtual-card I use the Privacy app on my mobile phone to create virtual cards (primarily for work subscriptions). Pro-tip: since each Privacy card can have its own name p…

> (1) Does anyone have a privacy-respecting alternative to Privacy.com's virtual credit cards? Capital One offers virtual cards through Eno ( https://www.capitalone.com/digital/eno/virtual-card-numbers/ ) that are merchant locked. They make it somewhat cumbersome to use, but I've really enjoyed using them. It doesn't block wall street knowing about what you're buying, but at least it's likely got one (or more) fewer…

You can also just create new virtual numbers yourself in their online banking. The option is a bit hidden (in "digital wallets").

Re: Detect breaches with Canary credit cards

#133

Post by pengaru »

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

I wanted to use Privacy.com for virtual CC #s on a checking account, but the enrollment process requires credentials for the linked account's online banking login.

Not just ACH information from a check for the linked account, which is all they should require.

No, despite supposedly being privacy-concerned, they require credentials (or auth token, hopefully) that gain access to everything the login has visibility into. I have multiple accounts at these places, the checking account is a tiny fraction of what's available with creds in hand.

That tab was promptly closed and effort abandoned.

Re: Detect breaches with Canary credit cards

#134

Post by lxgr »

gurchik wrote: post #120
asciimike wrote: post #103

Earlier quoted context omitted.

> (1) Does anyone have a privacy-respecting alternative to Privacy.com's virtual credit cards? Capital One offers virtual cards through Eno ( https://www.capitalone.com/digital/eno/virtual-card-numbers/ ) that are merchant locked. They make it somewhat cumbersome to use, but I've really enjoyed using them. It doesn't block wall street knowing about what you're buying, but at least it's likely got one (or more) fewer…

Citi also offers unlimited virtual card numbers for credit cards, and it is a bit easier than Eno since you can manage directly from the website without needing to install anything.

Capital One lets you manage them on their website as well. They just really seem to be pushing their extension and Chrome integration, which I both don't care too much about, but the functionality is there (albeit well-hidden).

Re: Detect breaches with Canary credit cards

#135

Post by lxgr »

alberth wrote: post #116

xPay (Apple/Google/etc Pay) Isn’t a major value prop of Apple Pay and the likes is your creditial can’t be stolen.

It is, but not nearly all merchants accept Apple Pay or Google Pay.

Apple also seems to have no interest in letting other browsers on macOS use it, and I do most of my shopping on my mac, so I end up using my plain card number in almost all cases.

If the merchant seems particularly sketchy about security or not charging the card for more than what was agreed on (or makes it very hard to cancel their service), I need a one-time use card number anyway, since Apple and Google Pay don't yet protect against the latter.

Re: Detect breaches with Canary credit cards

#136

Post by quickthrower2 »

lxgr wrote: post #123
quickthrower2 wrote: post #100

Earlier quoted context omitted.

Credit card shouldn’t need to be shared with all and sundry. The concept is very old fashioned. We wouldn’t share out side project github keys like this!

Quite the opposite: It should, in an ideal world, be perfectly safe to share your credit card number with everyone, because all it should be is arguably an account number. Payment initiation or confirmation can be an entirely separate layer (such as chip + PIN or 3D Secure). This is actually the goal of European regulators right now (with some carve-outs for low value and low-risk transactions).

That would also be good.

At the moment you need to provide a complete "private key" to each processor, who up the ante to: CC Number + Expiry + Security Code + Name + Address. They all ask for it, so any of them could leak it, or it could be phished.

Re: Detect breaches with Canary credit cards

#137

Post by lxgr »

jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

To charge payments to customers?

Yes, in many cases you can have your payment service provider store that data for you, but sometimes that's impracticable.

Re: Detect breaches with Canary credit cards

#138

Post by nikolay »

mjg59 wrote: post #115
nikolay wrote: post #112

This is a very shortsighted and short-lived idea - cyber criminals will find out the first digits of all these canary credit cards and never bother to test them. Even if multiple prefixes come into existence, unless they are mixed with normal credit cards, this won't ever make practical sense.

From the article: "Savvy attackers may start looking for patterns in the bank identification numbers (BINs) that we issue, and proactively deleting or excluding them from their dumps. For this reason we are in discussions with a number of banks to onboard their BINs to the system too, further mixing in legitimate cards with tokens."

No bank would mix their numbers with other service providers. Being in talks does not mean there will be a successful resolution.

Re: Detect breaches with Canary credit cards

#139

Post by kmoser »

jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

> Why do you have a database containing customer payment information?

To seed with canary credit card numbers! But seriously, for widely implemented (i.e. not-proprietary) databases of CC numbers it would be great if there were more automated ways of seeding them with CC canaries. Sort of a "LetsEncrypt for CC databases." E.g. for CCs saved by your browser, I'd like to see a plugin that lets you use one click to seed that DB with a few random CCs.

The whole idea would be to reduce the burden on the end user, who we all know will probably not take the time to do this manually.

Re: Detect breaches with Canary credit cards

#140

Post by jameshart »

lxgr wrote: post #137
jameshart wrote: post #60

> Some places we recommend putting these include: Databases where you store customer payment information alarm klaxon sounds Why do you have a database containing customer payment information?

To charge payments to customers? Yes, in many cases you can have your payment service provider store that data for you, but sometimes that's impracticable.

Interested in exactly when it becomes impractical. Personally I'm prepared to go to quite an extraordinary amount of effort to make sure PANs and cardholder data never comes near any system I am responsible for.

Honestly shocked by how much pushback I've had on this on this thread. I feel like I made a fairly innocuous comment that, essentially, was just suggesting that it's probably best practice to avoid storing customer card details in your own database. That seems to me about as uncontroversial as saying 'you should not be storing plaintext passwords', but apparently, judging from the replies I've seen, it's hopelessly naive, and you can't actually handle payments without storing CC numbers.

Which comes as a bit of a surprise to me, as in my day job I work on an e-commerce system that handles a billion dollars of credit card transactions a year, including stored payment methods and processing recurring billing - and we haven't got a single credit card number in any of our databases. So I kind of suspect it can be done.

Post reply on HN