Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For your security, please email your credit card and driver’s license

troyhunt.com

Post reply on HN
Print view View original

31–40 of 70 posts

Re: For your security, please email your credit card and driver’s license

#31

Post by josefresco »

johnmurch wrote: post #18

HostGator pulled this exact crap with me. I said forget it and moved onto a different host for a client. I am just SHOCKED as it was "policy" for them to have a copy of drivers license/passport and a credit card on file!!!!

HG is generally pretty good, I've been a customer for over 5 years. It sounds like your transaction was flagged which is why they needed more information. I do find it funny/ironic that their "fraud protection" system for billing then raised another issue of ... fraud protection for you as a customer.

Re: For your security, please email your credit card and driver’s license

#32

Post by lotsofcows »

JimmaDaRustla wrote: post #3
brohee wrote: post #2

"Fines will be levied in all cases where merchants are the subject of a security breach and upon investigation are found to be non-compliant. The average fines levied for a small merchant total around £15,000 which is payable on top of any forensic investigation and remediation costs." This is mitigated quite a bit by the extreme difficulty to report PCI-DSS violation before they lead to outright fraud.

I believe there is a PCI requirement that a company's system must be evaluated once every three months by a PCI approved vendor to ensure that data is being kept secure. To me, it seems kind of contradictory because if a company is being approved by said vendors, then how could they be found non-compliant in a breach? Maybe the quarterly vendor assessment isn't mandatory. digs through documents EDIT: This quarterly s…

My PCIDSS provider runs nessus once a quarter. It's found a few bugs but it's not an evaluation of anything other than my web facing server.

Re: For your security, please email your credit card and driver’s license

#33

Post by r0h1n »

Terretta wrote: post #4

What is with content that can't be seen unless you enable social media plugins? In this case, I'm not sure its intentional (looks related to how Disqus is embedded), but this is one of several such cases in the last couple weeks.

I face that all the time as a user of NoScript+Ghostery+Adblock. I have to go through a process of whitelisting trial and error with new websites I come across everyday.

I wish there were a whitelist I could subscribe to that would only enable only those domains that are critical to loading content & comments for websites I visit.

Re: For your security, please email your credit card and driver’s license

#34

Post by jdbernard »

dalore wrote: post #30
jerf wrote: post #16

Earlier quoted context omitted.

The credit card is designed for the use case of reading it out over the phone. Part of the reason they aren't free is that credit card usage includes insurance fees against fraud and such. By design, the credit card is designed to be used in an only "mostly secure" manner. This goes back to the fact that security is not about building impenetrable walls around the thing being secured, and if there's the slightest bre…

If it can be read over the phone, or written on the outside of mail order catalogs. Why is it not ok to send it via email? Reading it over the phone people around you can hear it, and say you have children who then go on to use it, are you going to call that fraud (and potentially have something brought against your children)?

Because the physical distance your voice can be heard is a much, much smaller pool of people, and it is safe to assume that it generally excludes credit card fraudsters. edit to add: This is also why it is suggested that you wait until you are off the subway to make a purchase over the phone, for example. Who knows who's listening.

Email is available world-wide. Email is not generally secure, and the message is not protected as it is sent on the wire. It is not very difficult for a determined attacker to harvest your email and scan it for common structured data like credit card details. The potential audience here is much, much bigger and is made up of many sharks.

If your kids use your card it is easy to control, you can probably return the purchases and clear up the matter yourself. If a mob in Russia gets your details and starts making fraudulent charges chances either Visa or your bank are going to have to just give you the money to cover the fraud with no realistic recourse of recovering it themselves.

Re: For your security, please email your credit card and driver’s license

#35

Post by arjie »

johnmurch wrote: post #18

HostGator pulled this exact crap with me. I said forget it and moved onto a different host for a client. I am just SHOCKED as it was "policy" for them to have a copy of drivers license/passport and a credit card on file!!!!

Hetzner required passport and some other stuff. I caved.

Re: For your security, please email your credit card and driver’s license

#37

Post by seiji »

r0h1n wrote: post #33
Terretta wrote: post #4

What is with content that can't be seen unless you enable social media plugins? In this case, I'm not sure its intentional (looks related to how Disqus is embedded), but this is one of several such cases in the last couple weeks.

I face that all the time as a user of NoScript+Ghostery+Adblock. I have to go through a process of whitelisting trial and error with new websites I come across everyday. I wish there were a whitelist I could subscribe to that would only enable only those domains that are critical to loading content & comments for websites I visit.

Run Disconnect instead of Ghostery. Ghostery had a big fad following a while ago, but it's not actually good for you. Disconnect is much better.

(and stop running NoScript (nobody is designing sites to work for you), just run with Click to Plugin enabled, Disconnect, and ABP)

I've seen a lot of these "I can't see the article until I disable my 40 extensions" complaints recently, but they all work fine with my combination of Disconnect and ABP.

Re: For your security, please email your credit card and driver’s license

#39

Post by res0nat0r »

dalore wrote: post #7
BillyMaize wrote: post #6

Earlier quoted context omitted.

I always go directly to the companies website to give information like this. You can't fall for the dancing bunny if you never ever respond through email.

That would require them to have an e-commerce presence. I was wondering how one would give it to a brick and mortar store (meaning one without facilities to accept them online securely).

Telephone call in a secure location.

Re: For your security, please email your credit card and driver’s license

#40

Post by kamjam »

danielbarla wrote: post #24
kamjam wrote: post #19

It's scary that this kind of thing ever comes up, you would think this kind of thing is blindingly obvious. Having said said, I seem to recall even Paypal asking me to send them copies of the my passport/ID and various other info when there was an issue on my account. I can't recall whether it was by email or uploaded through their site though... Question: Before writing these articles* does Troy Hunt go through a re…

Having recently changed my password with PayPal, I somehow doubt they are serious about security. They enforce a maximum length limit, disallow spaces and other "non-printable" characters (!), etc.

The amount of sites that disallow "special characters" is annoying me, esp when they "encourage" tough passwords... it would also be nice, before sending me a password reminder, if you reminded me of your rules of your password policy - that is often enough to trigger me to remember my password!
Post reply on HN