Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting any Facebook user's friend list and partial payment card details

josipfranjkovic.com

Post reply on HN
Print view View original

41–50 of 95 posts

Re: Getting any Facebook user's friend list and partial payment card details

#41

Post by jpollock »

pinkythepig wrote: post #25
jpollock wrote: post #3

Earlier quoted context omitted.

That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.

First 6 is shared across the cards a particular bank issues. Its not a secret as you can google the first 6 to find the bank or even the reverse google the bank to see what BINs they use. Last 4 is intended to be human visible so people can identify the card in use. When you factor in the check digit ruling out 90% of the remaining combinations, there are still 10,000 valid cc combinations plus an expiration date you…

They were publishing the expiry date too.

Re: Getting any Facebook user's friend list and partial payment card details

#42

Post by sib »

kevindqc wrote: post #35
packetized wrote: post #4

Earlier quoted context omitted.

First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...

How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|

They are registering the fact that you knew it and used it to ship to a specific address in a previous transaction in order to reduce fraud risk. They aren't submitting it with every transaction. (Assuming they are following the rules...)

Re: Getting any Facebook user's friend list and partial payment card details

#43

Post by mkagenius »

user5994461 wrote: post #28
cheeze wrote: post #11

Earlier quoted context omitted.

Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

> If the parameter is invalid, return nothing, rather than return all the credit cards

I don’t think that’s the bug here, bug here is the authorization check not being there.

That parameter is trivial to obtain using other ways even now.

Re: Getting any Facebook user's friend list and partial payment card details

#45

Post by [deleted] »

compiler-guy wrote: post #39
user5994461 wrote: post #38

Earlier quoted context omitted.

The deployment and the validation should be trivial if the fix is trivial. The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.

[deleted]

Re: Getting any Facebook user's friend list and partial payment card details

#47

Post by stochastic_monk »

praneshp wrote: post #44
murukesh_s wrote: post #33

Earlier quoted context omitted.

Already there - whatsapp, instagram oops...

Hacker news....

This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.

Re: Getting any Facebook user's friend list and partial payment card details

#48

Post by chirau »

yashap wrote: post #29
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

Agreed! Security bugs are going to happen in any sufficiently large piece of software (that wasn’t written by djb). The important thing is to work hard towards minimizing them, and fixing them quickly once found - seems to me Facebook does a good job on both of these points.

Who is djb?

Re: Getting any Facebook user's friend list and partial payment card details

#49

Post by grzm »

chirau wrote: post #48
yashap wrote: post #29

Earlier quoted context omitted.

Agreed! Security bugs are going to happen in any sufficiently large piece of software (that wasn’t written by djb). The important thing is to work hard towards minimizing them, and fixing them quickly once found - seems to me Facebook does a good job on both of these points.

Who is djb?

Daniel J Bernstein

https://en.wikipedia.org/wiki/Daniel_J._Bernstein

Post reply on HN