Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards are vulnerable to brute force kind attacks

metin.nextc.org

Post reply on HN
Print view View original

141–150 of 201 posts

Re: Credit cards are vulnerable to brute force kind attacks

#141

Post by lxgr »

mercutio2 wrote: post #117
beejiu wrote: post #71

Earlier quoted context omitted.

In Europe, the max interchange fee is 0.3%. In the US, the average is 2%. So the relative impact of fraud is much higher.

Huh? Your conclusion does not follow. A large fraction of the interchange fee is kicked back to customers. The size of the pie being so much bigger means the issuer’s tolerance for fraud is much larger, but it’s orthogonal to whether there’s actually more fraud. In practice credit cards fraud actually impacting customers is vanishingly rare at this point.

A large fraction, yes, but I believe in absolute numbers, US issuers still retain much more interchange than European ones.

The numbers are even public: https://usa.visa.com/content/dam/VCOM/download/merchants/vis...

If you take a look at some of the more "expensive" cards, interchange is often higher than 2%, yet issuers often pay as much only on certain categories, and flat cashback cards usually pay 1.5% (2% is relatively rare).

Compare that difference to a total interchange of 0.3% in the EU.

Re: Credit cards are vulnerable to brute force kind attacks

#142

Post by maxgashkov »

They absolutely are. Fun example: when Revolut launched in Japan few years back they had a period of a relatively explosive success (especially within the immigrant community), so most of the cards of the period were issued with the same expiration month and with the same IIN (I'm assuming specific to Japan as well) which left very little entropy and lead to brute-force attacks via merchants not requiring 3DS (Uber etc.). Within only one community (approx. 1.5k people) we have had a handful of a 100% verified cases when the card was compromised without any exposure at all (i.e. the card was not used online or offline).

In all cases Revolut promptly reverted the charges and eventually they did a complete reissue of the cards for Japanese market (not sure how they've got around the entropy issue: maybe they've randomized the expiry dates or spread out IINs some more).

Re: Credit cards are vulnerable to brute force kind attacks

#143

Post by lxgr »

bradley13 wrote: post #33

Credit cards as a while use a security model from...what, the 1970s? Sure, they've patched by adding the 3-digit CVC, but really? A huge industry can't do better than that? Honestly, it's pathetic...

Between 3DS for online payments and EMV for POS payments (both launched in the 1990s), payment cards could be plenty secure – if the industry were to decide to mandate them for every payment.

The fact that it hasn't is an interesting study in game theory and economics.

Re: Credit cards are vulnerable to brute force kind attacks

#144

Post by lxgr »

jongjong wrote: post #127

Credit cards are a horrible idea. We are essentially forced to use them. It's like giving every person you buy from the password to your bank account and trust them not to steal your money. Wire transfers are better.

Arguably it's even more ironic how credit card applications work in the US: Based on yet another, even shorter number used as both an identifier and a bearer token, and that one you can't even change ever...

Re: Credit cards are vulnerable to brute force kind attacks

#145

Post by lxgr »

bediger4000 wrote: post #7

Some have speculated that the entire credit card system is compromised, end to end. I think the real question is why NSA didn't intervene in the early 1990s. Online commerce was just beginning, and the importance of electronic funds transfer was obvious, but the method wasn't set in stone. NSA knew about public key crypto well before the rest of us did. They could have helped set up very secure electronic payments, b…

What do you mean by "compromised end to end"? A compromise implies that something isn't working as originally designed.

Credit and debit cards (except for 3DS and EMV) are working exactly as designed; the design just isn't very good from a security perspective.

Re: Credit cards are vulnerable to brute force kind attacks

#146

Post by rstupek »

gustavus wrote: post #105
eterm wrote: post #81

Earlier quoted context omitted.

Legislate that the banks are liable for refunding this class of fraud and you'll find they suddenly take this stuff a lot more seriously and "discover" the technology.

I don't understand your point. The banks and credit card companies are already responsible. If I have a fraudulent charge I call and tell them it's fraudulent and they say okay and take it off and either getit back from the issuer or eat the difference.

I think what you're missing is the bank and credit card companies rarely eat the difference. The business who sold the item which was charged back is the one paying the cost of the transaction (no income, lost item) plus a chargeback processing fee (typically $15 per chargeback).

Re: Credit cards are vulnerable to brute force kind attacks

#147

Post by lxgr »

mothballed wrote: post #80
NavinF wrote: post #74

Earlier quoted context omitted.

in what country?

USA. In USA your chargeback initially is usually taken on face. They'll usually reverse the charge within a week or so. But after that they let the merchant appeal it. Most merchants won't. But if they do, your bank isn't going to bat for you. If it looks like it's going to take them much time or effort to deal with it they're liable to just throw up their hands and let you duke it out in small claims court. In my ca…

> If it looks like it's going to take them much time or effort to deal with it they're liable to just throw up their hands and let you duke it out in small claims court.

In the US, couldn't you just make it their problem by not paying the disputed portion of your bill? (I haven't tried this myself and don't know how hard it is to dispute a negative credit report without going to small claims court in the end.)

Re: Credit cards are vulnerable to brute force kind attacks

#148

Post by kay_o »

rconti wrote: post #93
cj wrote: post #54

Earlier quoted context omitted.

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies. Blog post from Stripe: https://stripe.com/resources/more/what-is-a-card-account-upd...

Yep. I've been able to use the "wrong" (but still valid) expiration date on my AmEx for a long time. I've had other credit cards where the autopay info was never updated and it just kept working for at least 6 months.

You can run a charge with only the card number if you have sufficient trust. Each additional piece you add reduces liability and transaction fees (add exp, add cvc, add 3ds, ...)

Re: Credit cards are vulnerable to brute force kind attacks

#149

Post by rstupek »

lxgr wrote: post #136
neom wrote: post #110

Earlier quoted context omitted.

FWIW, HSBC USA Mastercard uses 3D secure if it's something you want and you're in the states.

Capital One also offers it for their credit cards, which makes them the only ones usable in countries where requiring 3DS is common. (No idea why this is a thing actually – merchants get the fraud chargeback liability shift as soon as they request 3DS, whether the issuer actually supports it or not.) The real problem is that in the US, almost no merchants request it in my experience, despite the fact that they'd get…

Yeah from a software dev perspective the implementations are shockingly terrible from a UX perspective. I'm surprised Stripe doesn't make it automatic with their integration

Re: Credit cards are vulnerable to brute force kind attacks

#150

Post by lxgr »

rstupek wrote: post #149
lxgr wrote: post #136

Earlier quoted context omitted.

Capital One also offers it for their credit cards, which makes them the only ones usable in countries where requiring 3DS is common. (No idea why this is a thing actually – merchants get the fraud chargeback liability shift as soon as they request 3DS, whether the issuer actually supports it or not.) The real problem is that in the US, almost no merchants request it in my experience, despite the fact that they'd get…

Yeah from a software dev perspective the implementations are shockingly terrible from a UX perspective. I'm surprised Stripe doesn't make it automatic with their integration

One problem is that the UX is largely defined by the issuer. 3DS (on the web) is literally an issuer-rendered iframe.
Post reply on HN