Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
I get "System Error" when I submit my card number
Visa Advertising Solutions (VAS) Opt Out
31–40 of 253 posts
Re: Visa Advertising Solutions (VAS) Opt Out
#32So all I need to do is provide my full credit card number in this random page and then it'll opt me out? And this was somehow brought to the front page of Hacker News? This is a very low effort scam. At least put in some effort beyond your dozen shadow accounts on HN.
Domain and cert are visa. So at least you know you are talking to Visa so it’s not really entirely random.
Certs and signing keys have been stolen before, ie sutnex.
Re: Visa Advertising Solutions (VAS) Opt Out
#33Earlier quoted context omitted.
I'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.
You would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :)
> You would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :)
I used to work at a big bank in the US and the parent's description sounds exactly like how it would work.
Re: Visa Advertising Solutions (VAS) Opt Out
#34What processing companies are available to use that don't sell your transaction data by default?
> What processing companies are available to use that don't sell your transaction data by default?
Thankfully merchants are generally opaque in terms of the metadata provided to the payment processors. I for one am thankful my card statements have "Amazon purchase" instead of the specific item purchased, for instance.
Re: Visa Advertising Solutions (VAS) Opt Out
#35The form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
Also, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
Checked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa.
For Visa it was 835ms for valid, 762ms for dummy, prefix and check digit appears to be checked client side.
Re: Visa Advertising Solutions (VAS) Opt Out
#36My favorite visa data to sell/buy is airfares. Visa gets the airport code of your departure and arrival, so you can group people into like “visiting Florida during the first week of June”. Or “flys to the Bahamas very often”.
Good stuff.
Re: Visa Advertising Solutions (VAS) Opt Out
#37I wonder what is their policy in EU. Do they automatically process your data without any opt-out?
It doesn’t exist. VAS is a US product offered by Visa US, supporting US cardholders only.
Re: Visa Advertising Solutions (VAS) Opt Out
#38Earlier quoted context omitted.
Domain and cert are visa. So at least you know you are talking to Visa so it’s not really entirely random.
Technically to someone who has demonstrated control on visa.com at the time the cert was issued. It doesn't necessarily mean its actually visa.com. Although I didn't check to see if they're using OV or EV certs.
The cert appears to be DV, and is issued to and by Cloudflare.
Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3
Subject: C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=marketingreportoptout.visa.com
Re: Visa Advertising Solutions (VAS) Opt Out
#39Here's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/c...
Perfect. I was wondering if it was the same site because the are the same company, or aren’t, IDK.
Re: Visa Advertising Solutions (VAS) Opt Out
#40Any way to verify that this is legitimate and not a phishing page for active card numbers?