The underground world of credit card network exploitation • Hacker News Board

Re: The underground world of credit card network exploitation

#261

Post by chinathrow » Thu, Aug 03, 2023, 9:53 AM UTC

edwinwee wrote: post #152

(Edwin from Stripe here.) Worth noting this is copypasta from an older post from a month ago ( https://piotrmierzejewski.com/p/card-networks-exploitation ). We've fixed most of these issues since then. This type of card testing has dwindled—Radar should now be catching these types of attacks. On the chargeback point—we hate chargebacks too and we want to limit them as much as possible (we're actually working on a few…

> Radar should now be catching these types of attacks.

No, your base offering should catch these.

Sincerely, a customer of yours.

Re: The underground world of credit card network exploitation

#262

Post by cubefox » Thu, Aug 03, 2023, 12:03 PM UTC

lxgr wrote: post #256

cubefox wrote: post #171

Earlier quoted context omitted.

I don't think customer protection is necessary unless you are dealing with unusually small or shady companies. I live in Germany and do not own a credit card, they are uncommon here. Mostly we pay per bank transfer or debit card. Even with the possibility of fraud, this is probably significantly cheaper in expectation than paying a 2% credit card fee each time just to have the possibility of chargeback.

Have you ever considered that what’s keeping most companies proactively honest and consumer-friendly are consumer protection laws and regulations?

Have you ever considered that those don't require credit card chargebacks?

Re: The underground world of credit card network exploitation

#263

Post by iggldiggl » Thu, Aug 03, 2023, 12:03 PM UTC

pas wrote: post #206

Detrytus wrote: post #188

Earlier quoted context omitted.

What if you lose your phone? In my country banks only allow you to use one phone for mobile authorization, so you can't even have a backup phone. I really wish 3DSecure was optional so I can turn it of when going to foreign vacation.

On a vacation I have my card (and can use PIN auth), the issue is usually online transactions ("card not present", ie. vPOS transactions).

… and it already brings us halfway to the point where you can't buy a new phone if you don't have a phone already.

Re: The underground world of credit card network exploitation

#264

Post by joenot443 » Thu, Aug 03, 2023, 12:05 PM UTC

delusional wrote: post #98

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa). I don't really think there's…

As is often the case, the answer to the European asked question of "Why don't you just _____" is not "We seemingly don't want it", it's "America has a population 66 times that of Denmark."

Systematic change is slow and difficult. FedNow (secure, instant payments directly between accounts) was released 12 days ago, after nearly a decade in preparation.

Pretending that Americans just "don't want" more secure payments is just ignorant, in my opinion, and really screams that the author should spend more time with folks of other cultures.

Re: The underground world of credit card network exploitation

#265

Post by gpvos » Thu, Aug 03, 2023, 12:05 PM UTC

TacticalCoder wrote: post #68

platelminto wrote: post #15

Earlier quoted context omitted.

As someone whose lived in multiple European countries since I was born, I also don't understand this comment. I don't know anyone who uses these smartcard readers at home. I don't think it's common at all.

> As someone whose lived in multiple European countries since I was born, I also don't understand this comment. I don't know anyone who uses these smartcard readers at home. I don't think it's common at all. Which EU countries? Bank card readers are super common in .nl (ING for sure) and .be (just about every single bank there) for example. Nowadays banks often allow to use either that or, say, an app on your phone o…

I am an ING customer in the Netherlands and have never heard of those things, so I doubt their commonness.

Re: The underground world of credit card network exploitation

#266

Post by acdha » Thu, Aug 03, 2023, 12:10 PM UTC

Sylamore wrote: post #231

acdha wrote: post #106

Earlier quoted context omitted.

I’ve never had a card stolen where either of those would have helped - they’re stopgaps trying to avoid upgrading the banking system to use public-key encryption with reuse protection. A couple of times, merchants with my card on file were compromised. The thief could make charges because the merchant had to be able to as well. What would have stopped that would have been having a way to restrict a charge to a partic…

>What would have stopped that would have been having a way to restrict a charge to a particular merchant so the attacker couldn’t have been able to get the money out. This is one of the primary use cases for privacy.com (if you are in the US). The virtual cards are either single-use only or they are merchant locked, plus you can set spending limits on the card. I use these for 100% of my online and recurring payment…

Yes - it’s a neat hack to get some of the benefits without breaking compatibility with legacy terminals.

Re: The underground world of credit card network exploitation

#267

Post by vanderZwan » Thu, Aug 03, 2023, 12:27 PM UTC

joenot443 wrote: post #264

delusional wrote: post #98

Earlier quoted context omitted.

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa). I don't really think there's…

As is often the case, the answer to the European asked question of "Why don't you just _____" is not "We seemingly don't want it", it's "America has a population 66 times that of Denmark." Systematic change is slow and difficult. FedNow (secure, instant payments directly between accounts) was released 12 days ago, after nearly a decade in preparation. Pretending that Americans just "don't want" more secure payments i…

That argument goes both ways: each country in Europe might be smaller individually, but at the same time I can pay with my debit/credit card all across Europe, and the same is true for each other EU country. And I still enjoy all of the aforementioned protections and services.

So despite the EU consisting of 27 separate member states, with their own banking systems, we still managed to standardize those banking systems enough to offer all of these services across the continent.

Re: The underground world of credit card network exploitation

#268

Post by acdha » Thu, Aug 03, 2023, 12:30 PM UTC

lxgr wrote: post #258

acdha wrote: post #106

Earlier quoted context omitted.

I’ve never had a card stolen where either of those would have helped - they’re stopgaps trying to avoid upgrading the banking system to use public-key encryption with reuse protection. A couple of times, merchants with my card on file were compromised. The thief could make charges because the merchant had to be able to as well. What would have stopped that would have been having a way to restrict a charge to a partic…

> upgrading the banking system to use public-key encryption with reuse protection. This is exactly what chip and PIN does. The chip is a smart card holding keys; the PIN authorizes its use. Online, there is 3DS which can be used similarly. We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/…

> We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off.

Exactly: it’s not like this was a technological breakthrough but that companies were trying to avoid breaking backwards compatibility - not just things like the readers but backend payment systems using something like fixed length records, but also restaurants needing to stop having a single terminal used for every table (this is why they went chip and no PIN).

Going back to the original comment, that’s the peace of mind benefit I see: those businesses can slack on security without me getting stuck with a potentially massive bill.

Re: The underground world of credit card network exploitation

#269

Post by kentonv » Thu, Aug 03, 2023, 2:49 PM UTC

newusertoday wrote: post #246

Ubergeek99 wrote: post #236

Cloudflare has tools to prevent too many form submits. You can specify which page, how many submits and so on. I found out about this when I had a problem of somebody running a script of trying different credit cards over a two hour window. My payment processor told me I should prevent these types of things. So I investigated and never had this problem anymore. Cloudflare is amazing at preventing all kinds of attacks…

are you using cloudflare workers for this? i don't see any tool for form submission and rate limiting in cf. Can you elaborate what tool are you using?

https://developers.cloudflare.com/waf/rate-limiting-rules/ maybe?

Re: The underground world of credit card network exploitation

#270

Post by lxgr » Thu, Aug 03, 2023, 3:03 PM UTC

acdha wrote: post #268

lxgr wrote: post #258

Earlier quoted context omitted.

> upgrading the banking system to use public-key encryption with reuse protection. This is exactly what chip and PIN does. The chip is a smart card holding keys; the PIN authorizes its use. Online, there is 3DS which can be used similarly. We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/…

> We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off. Exactly: it’s not like this was a technological breakthrough but that companies were trying to avoid breaking backwards compatibility - not just things like the readers but backend payment systems using something l…

> that’s the peace of mind benefit I see: those businesses can slack on security without me getting stuck with a potentially massive bill.

That's a false dichotomy, though: Regulators can mandate merchants and issuers to make fraud less likely without allowing the liability for any remaining fraud to be pushed onto cardholders.