Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Lost My $50,000 Twitter Username

medium.com

Post reply on HN
Print view View original

291–300 of 394 posts

Re: How I Lost My $50,000 Twitter Username

#291

Post by mathattack »

chavesn wrote: post #162

Why would a company ever ever ever accept 6 digits of a credit card number as a way to authenticate an identity?? Credit card numbers are not secure. Therefore, they should not ever be accepted as authentication. Especially only 6 digits of it! This is by far the most shocking part of this story. As if I needed another reason to despise GoDaddy. [Edited to add] I would sure love to see a scarlet letter list of compan…

Credit card #s and social security #s are not secure. But what should companies use instead? We're a long way from everyone having fingerprint scanners, and I'm sure there will be a way to break that too.

Isn't the solution more around recovering from when the break-ins inevitably happen?

Re: How I Lost My $50,000 Twitter Username

#292

Post by gareim »

jrs99 wrote: post #149
harryh wrote: post #52

Earlier quoted context omitted.

No. But I'd feel less bad for that person than someone who drove their Mercedes every day and had it stolen. Also, a Mercedes and a twitter handle (or domain name) aren't exactly the same thing as a twitter handle is a unique owner of a particular pice of the namespace. A better analogy would be an owner of a valuable piece of property who wasn't putting it to good use.

Good analogy. Another one is email. If you used an email address for personal conversations and commercial transactions, that should not entitle you to keep the email address. You should give your email address to another person that wants it. For example, I used one email for most of my life. But recently, I stopped using that email address, and have used another one due to wanting to boycott that company. Since I n…

I'd have a hard problem going to every single website where I ever made an account and changing the email preferences.. Assuming I'm a normal human being, there are bound to be sites that I forget about and someone dedicated enough could then get access to my accounts on those sites.

Not a security risk I'm willing to take, when I could simply leave that email address dormant. There's not really a huge shortage of good email addresses if you're willing to pay $10 a year for your own domain.

Re: How I Lost My $50,000 Twitter Username

#293

Post by aaronem »

gaius wrote: post #227
blazzar wrote: post #201

Earlier quoted context omitted.

The reason for the 6 digits is probably linked to PCI DSS compliance where agents are allowed to view the first 2 and last 4 of stored card numbers.

The first digit of a credit card number identifies the type of company the issuer is, e.g. 1 is an airline, 3 is a travel agency, 4 and 5 are credit card companies, 7 is an oil company. The final digit is a checksum. Two things about this baffle me: 1) that websites feel the need to have a dropdown to identify what sort of card you have instead of just figuring it out and 2) why they need to ping it off the issuer's…

Back when I was doing payment code, I built several sites which didn't prompt for the card type, since (a) the first digit identifies the association [1] and (b) the processor doesn't usually care anyway, i.e., you don't need to submit a card type value along with the rest of the transaction data. Most of the clients for whom I built these sites complained about the lack of a dropdown, and were not terribly receptive to my explanations on points (a) and (b) above; their line of thinking on the matter was that people expect to see a card type dropdown, and will complain in its absence. I rather doubt that's true, but I have also never considered it really my place to argue too strenuously against a client who refuses to let me save them money, so more often not I ended up adding the dropdown anyway.

[1] 3 = AmEx; 4 = Visa; 5 = Mastercard; 6 = Discover.

Re: How I Lost My $50,000 Twitter Username

#294

Post by aestra »

chavesn wrote: post #162

Why would a company ever ever ever accept 6 digits of a credit card number as a way to authenticate an identity?? Credit card numbers are not secure. Therefore, they should not ever be accepted as authentication. Especially only 6 digits of it! This is by far the most shocking part of this story. As if I needed another reason to despise GoDaddy. [Edited to add] I would sure love to see a scarlet letter list of compan…

Does Go Daddy require recurring payments or can you pay for a couple years up front? If so you could have generated a one time card number OR had been issued a new card since you paid you you might not even know your card number. How would this even work for everyone?

https://www.namecheap.com/ accepts bitcoin as payment to avoid this situation.

Re: How I Lost My $50,000 Twitter Username

#295

Post by pc86 »

dunk010 wrote: post #251
aptwebapps wrote: post #230

Earlier quoted context omitted.

Might piss off the attacker pretty bad, though. Not saying that's wrong, just that resulting shenanigans might be a little asymmetric.

"that resulting shenanigans might be a little asymmetric. " - What does this statement even mean? You should think before you just throw a load of cliches into a sentence.

That is a perfectly reasonable comment and it makes total sense. You are being needlessly rude and obtuse.

Re: How I Lost My $50,000 Twitter Username

#297

Post by aestra »

aaronem wrote: post #293
gaius wrote: post #227

Earlier quoted context omitted.

The first digit of a credit card number identifies the type of company the issuer is, e.g. 1 is an airline, 3 is a travel agency, 4 and 5 are credit card companies, 7 is an oil company. The final digit is a checksum. Two things about this baffle me: 1) that websites feel the need to have a dropdown to identify what sort of card you have instead of just figuring it out and 2) why they need to ping it off the issuer's…

Back when I was doing payment code, I built several sites which didn't prompt for the card type, since (a) the first digit identifies the association [1] and (b) the processor doesn't usually care anyway, i.e., you don't need to submit a card type value along with the rest of the transaction data. Most of the clients for whom I built these sites complained about the lack of a dropdown, and were not terribly receptive…

You should have given them an read only box with javascript that automatically populates it and REALLY knocked their socks off.

Re: How I Lost My $50,000 Twitter Username

#298

Post by blueskin_ »

Achshar wrote: post #272
blueskin_ wrote: post #228

Earlier quoted context omitted.

well, http://plaintextoffenders.com exists - someone should make creditcardoffenders.com .

Kind of off topic but that site also shows sites that email users their password when they create the account. That does not necessarily mean they store it plain text. Though the kind of devs that would send the password in email are likely to store it in plain text, but it's not necessary.

Email is rarely secure though.

A password reset link that emails a temporary password is OK in my opinion (not ideal, but a tradeoff for password resets, and perfectly fine if the site actually forces a change on logging in with it), but "Thanks for registering, your password is foo" is not, as then the user has to change it (and some exceptionally bad sites may then email them that password as well).

Re: How I Lost My $50,000 Twitter Username

#300

Post by EA »

Up until late 2013, it was very easy to social engineer your way past Customer Sales Rep call screens to gain access to an AT&T account once you put together a few pieces of personal data (which was even easier to obtain) of the account owner. You didn't need to know the account password to gain access if you had other pieces of information. Those bits of information leak out through other service providers and are sometimes available through State and Federal Government systems.

That meant that anyone using SMS via AT&T for two-factor auth was vulnerable.

The extra layer of security is only enabled if you call AT&T and ask them to further protect your account from future changes.

Post reply on HN