Live data from Hacker News

Takeaways from the $566M BriansClub Breach

krebsonsecurity.com

21–29 of 29 posts

Re: Takeaways from the $566M BriansClub Breach

#21

I find this kind of black hat cybercrime stuff fascinating. If I wanted to learn more about it (just for learning sake) what would be some good resources?

Learn Russian and read their forums. Otherwise it'll be a bit more difficult. If you don't know anyone involved in fraud it can be difficult to get inside. You really won't get anywhere if you don't have much to offer.

Re: Takeaways from the $566M BriansClub Breach

#22
post #14

Earlier quoted context omitted.

If you don’t know something as basic as how to make bitcoin untraceable, then you’re the idiot.

I don't know anything about Bitcoin. Am I an idiot?

No, that's an unwarranted extrapolation of what I said.

Re: Takeaways from the $566M BriansClub Breach

#23
post #8

Earlier quoted context omitted.

Can they handle monthly subscriptions?

I learned about privacy.com here on HN and it has been very helpful for me. You can create virtual cards for single-use or recurring payments. Each card can only be used by one vendor. You also set a max amount.

Exactly, some implementations can even lock it to a single "message" (what you see on the credit card statement) so that it can't be used for a different purchase. Needs cooperation from the merchant not to put the subscription date in the message but otherwise, it's not exactly rocket science.

Re: Takeaways from the $566M BriansClub Breach

#24

Are these idiots really still using bitcoin for doing shady stuff lol? Bitcoin can totally be traced. Most people using it are so weak in terms of their security.

This is not looking at the whole picture. The key is, you do not allow your BTC usage to comingle with your real identity. This means you both buy and sell stuff solely with BTC. If you want to buy stuff in the "real world" then you can trade some for Monero or maybe ZCash, and then convert to USD. (Optionally mix it further in other ways..)

BTC is really "psuedoanonymous" because while you can certainly trace my transactions if you know a wallet address, you still have no idea who or where I am as long as I do not reveal that wallet to be connected to any "real world" identity.

This is still not easy though. For example, if you're serious then you must only transmit transactions within Tor, otherwise the originating IP may single you out. Ideally you should use different wallets for each transactions, and only pool them together after they have each been converted to XMR or similar.

There's lots of gotchas but frankly it's a decent system.

Re: Takeaways from the $566M BriansClub Breach

#25
post #22

Earlier quoted context omitted.

I don't know anything about Bitcoin. Am I an idiot?

No, that's an unwarranted extrapolation of what I said.

It doesn't seem like an extrapolation given how you phrased it. If you meant to say that "it is only idiocy if you don't know how to anonymize your Bitcoin usage", that is not at all how your comment comes across.

Re: Takeaways from the $566M BriansClub Breach

#26
post #6

Earlier quoted context omitted.

This is a solved problem, really, some banks are less keen on implementing it: generate single use / single purpose credit card numbers in your ebank / mobile app. Leaks are total useless. Also, more than a decade ago already many European banks were sending a text SMS above a treshold and only approved on a positive reply. Today you'd likely offer sending a push notification. You have 16 digits on a Visa/MasterCard,…

Bank of America has discontinued their ShopSafe system for single-use credit cards. Citibank seems to still have their virtual credit card system, but it requires Flash. Are any banks currently embracing it? The impression I've gotten is that since most of the costs of fraud are on the bank, rather than the cardholder, there's not much incentive for the cardholder to go through the trouble of using single-use cards.…

Also, since they now just text you, they can make the algorithm more stringent.

I've had BoA fraud detection ping me about a monthly rent check before, so I'm not sure it's really good.

Re: Takeaways from the $566M BriansClub Breach

#27
post #25
post #22

Earlier quoted context omitted.

No, that's an unwarranted extrapolation of what I said.

It doesn't seem like an extrapolation given how you phrased it. If you meant to say that "it is only idiocy if you don't know how to anonymize your Bitcoin usage", that is not at all how your comment comes across.

The parent comment cast the first stone by calling the bitcoin users idiots because bitcoin is traceable.

The gap between knowing enough to trace bitcoin, and knowing enough to make bitcoin untraceable is tiny, which means anyone understanding enough to know that bitcoin is traceable bit not bothering to research how it can be untraceable is an idiot (when they go online and call all users idiots, dsspite not having done a tiny bit of research into something pretty well known int the community).

Not normally my choice of words, but I chose to use the language of the comment to humble him a little.

And I was talking to the commenter directly, not generalizing to all bitcoin users. THAT IS an unwarranted extrapolation.

Re: Takeaways from the $566M BriansClub Breach

#28
post #27
post #25

Earlier quoted context omitted.

It doesn't seem like an extrapolation given how you phrased it. If you meant to say that "it is only idiocy if you don't know how to anonymize your Bitcoin usage", that is not at all how your comment comes across.

The parent comment cast the first stone by calling the bitcoin users idiots because bitcoin is traceable. The gap between knowing enough to trace bitcoin, and knowing enough to make bitcoin untraceable is tiny, which means anyone understanding enough to know that bitcoin is traceable bit not bothering to research how it can be untraceable is an idiot (when they go online and call all users idiots, dsspite not having…

> And I was talking to the commenter directly, not generalizing to all bitcoin users.

That is worse. Personal attacks on HN are not acceptable.

Re: Takeaways from the $566M BriansClub Breach

#29
post #28
post #27

Earlier quoted context omitted.

The parent comment cast the first stone by calling the bitcoin users idiots because bitcoin is traceable. The gap between knowing enough to trace bitcoin, and knowing enough to make bitcoin untraceable is tiny, which means anyone understanding enough to know that bitcoin is traceable bit not bothering to research how it can be untraceable is an idiot (when they go online and call all users idiots, dsspite not having…

> And I was talking to the commenter directly, not generalizing to all bitcoin users. That is worse. Personal attacks on HN are not acceptable.

so it's ok for the parent? and what about responding to the rest of my comment/points rather than nit picking
Post reply on HN