Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards are vulnerable to brute force kind attacks

metin.nextc.org

Post reply on HN
Print view View original

171–180 of 201 posts

Re: Credit cards are vulnerable to brute force kind attacks

#171

Post by criddell »

tptacek wrote: post #166
criddell wrote: post #164

Earlier quoted context omitted.

I haven’t really talked about that kind of stuff with people I know. I could be surrounded by people who have big debt and just don’t know. A quick googling says that about half of all credit card holders carry some kind of balance each month, so clearly there must be some people in my orbit not paying it off.

I'd be one of them, but I can't be, because I don't use credit cards.

I’m too much of a cheapskate to carry a balance and pay interest. And it’s my cheapskate tendencies that makes me use the credit card for everything for the benefits.

Re: Credit cards are vulnerable to brute force kind attacks

#172

Post by cnst »

jonathanlydall wrote: post #50

If 3D secure was mandatory everywhere that would help a lot, but if I understand correctly, it’s not really used in the US and with them being so big, card issuers are largely forced to allow non 3D secure requests or their clients will be unable to use their cards for too many things. So an enormously good anti-fraud mechanism is severely handicapped. It’s really frustrating for most of the rest of the world. I don’…

IIRC, MasterCard SecureCode and Visa's verified-by-visa were more of a thing in the US maybe like decade or two ago? I think NewEgg and B&H did support it at one point? Afterwards, everyone has simply disabled the thing, and you simply get a wave-through by most issuers when shopping on foreign sites, where you get redirected to issuer's website, then back to the online shop, without having to type or confirm anything.

Back when it was a thing, it was quite a nightmare, where you had to register for a 3ds account, often separate from your normal online account, and keep a separate password etc. Then those iframe windows look exactly like the phishing websites, too.

Honestly, it's much ado about nothing. If the transaction is suspicious or likely fraudulent, today, you already get an SMS or an alert within bank's app on your phone. All you have to do is confirm and retry the transaction a minute later. This works for both in-person transactions, as well as remote ones, with the same flow, unlike 3ds, which only works for online shopping.

Re: Credit cards are vulnerable to brute force kind attacks

#173

Post by e28eta »

opengrass wrote: post #78
janpeuker wrote: post #27

Payment processors don't allow just brute forcing all card numbers a.k.a. card enumeration or card testing [1][2] and card schemes penalise merchants and payment processors heavily if they don't take measures against it [3]. 1) https://stripe.com/newsroom/news/card-testing-surge 2) https://stripe.com/blog/the-ml-flywheel-how-we-continually-i... 3) https://docs.stripe.com/disputes/monitoring-programs#enumera...

Until 6 years ago Stripe didn't obfuscate card numbers in API logs at all.

That’s untrue. While I would be willing to believe that for a brief period of time there was a bug that could expose it, having been at Stripe between 2017 and 2020, it was my experience that they had a robust system preventing PANs from being disclosed.

That included efforts to mask PANs that were in the wrong place.

We didn’t want them in our internal logging systems, and we certainly didn’t want to leak them back to the merchants.

Re: Credit cards are vulnerable to brute force kind attacks

#174

Post by tptacek »

criddell wrote: post #171
tptacek wrote: post #166

Earlier quoted context omitted.

I'd be one of them, but I can't be, because I don't use credit cards.

I’m too much of a cheapskate to carry a balance and pay interest. And it’s my cheapskate tendencies that makes me use the credit card for everything for the benefits.

I 100% get it. I have minmaxer friends who do the same thing, are very good at it, and will never get into trouble. My thing is, revolving credit is a default in the US, and it's not a sensible default for most people.

Re: Credit cards are vulnerable to brute force kind attacks

#175

Post by fortran77 »

We had a 5.15 cent charge for "TikTok" on a business card we never used. We have very good password hygene, and we have Ubikey authentication for all our business accounts. The bank initially told us to file a police report (!) for identity theft.

I knew it wasn't identity theft. We got a notice a week later that the charge had been reversed; we never bothered with a police report, we just cancelled the card. It had been flagged as suspicious by the bank when it was initially processed, but I'm not sure what was wrong. Perhaps one factor, like expiration date or zip code wasn't right.

I have a feeling it was stolen with some scheme like this where people just guess numbers by some algorithm.

Re: Credit cards are vulnerable to brute force kind attacks

#176

Post by mothballed »

NavinF wrote: post #165
mothballed wrote: post #96

Earlier quoted context omitted.

Scammer created two e-bay accounts. One with my name but e-mail address "pirate" something. A second one, a scammer merchant account to wash the money. They stole my credit card and used the bogus "me" ebay account to generate invoices (to my real address) and payments for goods from the second scammer merchant account. Then they found tracking numbers to my zip code. They bought the (fake) items from their scammer m…

You didn't provide any evidence that the charge was fraudulent. If they have a tracking number you gotta provide something, at least a police report. Also you likely filed "merchandise/services not received" when you should have filed "unauthorized transaction". Even if you really did get the item, you don't have to pay for it if it was ordered by someone else using your card.

Honestly the only thing I had was one tracking number was generated an entire day before the supposed purchase, the 'pirate' email address (they were taunting me), that the religious items purchased were not of my religion, and that ebay had closed the scammer account. But my bank was not interested in taking on ebay. To the scammers credit, by creating both the buyer and seller account they made their scam a lot more resistant.

Also it was charged back as fraud. I had other fraud transactions that day and my bank reversed them. They were too scared to fight ebay or something.

I've learned proving a negative of "prove you didnt buy this" is pretty hard and thus fraud protection is more of a facade that only kind of works.

Re: Credit cards are vulnerable to brute force kind attacks

#178

Post by what »

Sohcahtoa82 wrote: post #121
spankalee wrote: post #52

Earlier quoted context omitted.

> The bank ate the loss for the fraud and you were made whole _If_ you notice the fraudulent charge.

It never ceases to amaze me how many people don't even look at their bank/credit card statements and just let their credit cards auto-pay. Back when I was poor, I was logging into my bank and credit card accounts at least twice/week. I always knew within $20 how much money I had. As a well-paid tech worker, I'm still checking at each paycheck (2x/month) and paying the credit card card off every time, but I'm still sc…

$20 for food cart chicken strips is the real scam.

Re: Credit cards are vulnerable to brute force kind attacks

#179

Post by AnthonyMouse »

lxgr wrote: post #138
AnthonyMouse wrote: post #101

Earlier quoted context omitted.

> You can reverse the charges on debit cards, but the money is withdrawn at the time the charge is made. This is not the case for credit cards. In a sense it is though, because it lowers your available credit by the amount of the charge. And the fraudsters are going to try to run you right up to your credit limit, so you end up at the same problem: You now have legitimate charges being declined because the fraudsters…

Having multiple credit cards in the US is quite common, since there's no practical downside (unlike having multiple checking accounts, which locks up liquidity at usually no interest payment) and it can even be beneficial for your credit score.

That's not the problem. After all, if it happened to your debit card you could likewise make purchases on a different card, regardless of whether the other card is a debit or credit card.

It's also not that hard to get two debit cards. There are credit unions with no minimum balance requirement.

The actual problem is that if it happens to any card, all the stuff configured to use that card is now failing. You have a toll tag and the company goes to charge your card for a road toll, it's a perverse unaccountable bureaucracy that has captured the government so enjoy your $50 declined payment fee. You have autopay on for several services which will naturally suspend your account if you don't pay them. That's an inconvenience for something like Netflix but for your various information services it can be a big problem even if all they do is turn it off temporarily, and an even bigger problem if the turning it off involves deleting your stuff. Likewise for things like insurance where a gap in coverage can cause you to get fined or negatively impact your future rates.

Some of that can be mitigated by chasing it all down and switching them before the charge comes, but the labor to do that is a significant cost in itself and plenty of people aren't going to recognize the need to do it until it's too late, or try to and still miss some.

Re: Credit cards are vulnerable to brute force kind attacks

#180

Post by SkiFire13 »

e28eta wrote: post #173
opengrass wrote: post #78

Earlier quoted context omitted.

Until 6 years ago Stripe didn't obfuscate card numbers in API logs at all.

That’s untrue. While I would be willing to believe that for a brief period of time there was a bug that could expose it, having been at Stripe between 2017 and 2020, it was my experience that they had a robust system preventing PANs from being disclosed. That included efforts to mask PANs that were in the wrong place. We didn’t want them in our internal logging systems, and we certainly didn’t want to leak them back…

This is pretty much a PCI DSS requirement for anyone that directly handles PANs.
Post reply on HN