Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

261–270 of 430 posts

Re: New startup sells coffee through SSH

#261

Post by thescriptkiddie »

miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

The burden of PCI compliance is a lot lighter than you might think. You basically just have to fill out a bunch of forms, there's no inspection or anything.

Re: New startup sells coffee through SSH

#262

Post by fragmede »

Jenda_ wrote: post #251
fragmede wrote: post #208

Earlier quoted context omitted.

Check for yourself with ssh -v -i /dev/null terminal.shop vs ssh -v terminal.shop What you're looking for is that there is no line that says something like debug1: Offering public key: /Users/fragmede/.ssh/id_rsa RSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Upon further testing, the full command you want is: ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop to forcibly disable a local identity ag…

For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768 ). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.

It's quite useful! I can give someone access to my server by grabbing their public key and creating an account for them, no need figure out how to send them the password to my server.

Re: New startup sells coffee through SSH

#263

Post by fragmede »

lxgr wrote: post #219
fragmede wrote: post #120

Earlier quoted context omitted.

if you are aware of other stores-over-ssh, I’d genuinely love to hear about them because this one is so fun. Or even not-stores that are reachable via ssh. Any MUDs still going?

You might like https://tildeverse.org/ !

Doesn't seem to work:

    fragmede@samairmac:~$ ssh tildeverse.org
    fragmede@tildeverse.org: Permission denied (publickey).

Re: New startup sells coffee through SSH

#264

Post by jamesdutc »

Intralexical wrote: post #258
fragmede wrote: post #47

Earlier quoted context omitted.

The full command you want is: ssh -a -i /dev/null terminal.shop to disable agent forwarding, as well as to not share your ssh public key with them, but that's just a little less slick than saying just: ssh terminal.shop to connect.

I just ran it in a `tmpfs` without any credentials: $ bwrap --dev-bind / / --tmpfs ~ ssh terminal.shop

I think you may want to clear the environment (e.g., of `SSH_AUTH_SOCK`) as well as isolate in a PID namespace as well. I also reflexively `--as-pid-1 --die-with-parent`.

    bwrap --dev-bind / / --clearenv --tmpfs ~ --unshare-pid --as-pid-1 --die-with-parent ssh terminal.shop
(The `bwrap` manpage says “you are unlikely to use it directly from the commandline,” yet I use it like this all the time. If you do, too, then we should be friends!)

Re: New startup sells coffee through SSH

#267

Post by Cu3PO42 »

miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

Not just EU companies. Also EU customers. I cannot use my cards in a Card-Not-Present transaction that does not support 3D Secure. This obviously isn't a concern for them yet since they only ship to the US, but it might become one.

In the past one of my banks required me to put in a One-Time Password on the frame I'm shown. While it's different right now, you do need to show that page in the general case. That would really break the immersion of their process :/

Re: New startup sells coffee through SSH

#268

Post by hn_throwaway_99 »

srinathkrishna wrote: post #171
miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

They mention in the faq that they use Stripe - https://www.terminal.shop/faq . Stripe does offer integrations that are not natively using their widgets. Ultimately, the PII data is stored at Stripe. PS: I work at Stripe but I don't really work on the PCI compliant part of the company.

The fact that the card number data is stored at Stripe doesn't matter that much. As parent commenter says, the card numbers are still visible on terminal.shop's network because it all goes over their SSH connection.

For most websites that use the Stripe widget, the website owner can never see the full card number, because the credit card number entry fields are iframed in on the page. That means website owners in this scenario are PCI compliant just by filling out PCI SAQ A (self assessment questionnaire A), which is for "Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced": https://listings.pcisecuritystandards.org/documents/SAQ_A_v3...

But that questionnaire is only for merchants where "Your company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely on a third party(s) to handle all these functions;" For e-commerce merchants who CAN see the card number, they need to use SAQ D, https://listings.pcisecuritystandards.org/documents/SAQ_D_v3.... This includes additional requirements and I believe stuff like a pen test to be PCI compliant.

Re: New startup sells coffee through SSH

#269

Post by raggi »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

You actually want to verify first or someone will mitm you, e.g. mitm.terminal.shop.rag.pub

Re: New startup sells coffee through SSH

#270

Post by raggi »

Before a bunch of you run off and make more of these “because it’s cool”, they’ll likely lose access to stripe once stripes security team pay attention and realize that this can be trivially man in the middled and doesn’t actually offer the equivalent protection to https.

I wrote up a little demo and explainer at

   https://mitm.terminal.shop.rag.pub
  
   ssh mitm.terminal.shop.rag.pub
Post reply on HN