Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Credit cards are vulnerable to brute force kind attacks

metin.nextc.org

Post reply on HN
Print view View original

51–60 of 201 posts

Re: Credit cards are vulnerable to brute force kind attacks

#51

Post by kodbraker »

julienchastang wrote: post #31

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new e…

For my case, it was almost certain. As it happened single day, the card i use was a virtual card only used in couple big ecommerce websites etc.

If it was leaked somewhere else, i think they wouldn't bother logging in some unrelated account of mine in an ecommerce website.

Re: Credit cards are vulnerable to brute force kind attacks

#52

Post by spankalee »

evan_a_a wrote: post #39

>As a consumer, I thought I was safe; when saving my credit card to a billion dollar valued european merchant, or when i purchase something from supermarket and ignore the receipt, but the reality is slightly different from that. >I got the money back via chargeback in short time. So as evidenced, you are protected by the fraud infrastructure. The bank ate the loss for the fraud and you were made whole. In the end, t…

> The bank ate the loss for the fraud and you were made whole

_If_ you notice the fraudulent charge.

Re: Credit cards are vulnerable to brute force kind attacks

#53

Post by skeeter2020 »

tptacek wrote: post #29
yladiz wrote: post #10

Earlier quoted context omitted.

Why do you think they’re pointless?

For most of my adult life I haven't been able to get a credit card --- even after we sold Matasano Security, with the proceeds of that acquisition sitting in a money market checking account at the giant bank I use, that bank would still only issue me a secured card. I pay my bills and all, but at some point when I was like 19 I bought a shirt at Nordstroms and they signed me up for a card and I didn't pay enough atte…

>> I think most people would be much better off just using debit cards, and operating with the funds they actually have.

Totally agree, but - and this is another example where the rich(er) benefit - if you actually have the money and good financial discipline you're better to put everything on your CC and pay it off in full monthly. Let the merchants finance for free for 3 weeks, plus maybe get perks like purchase protection and extended warranty.

Re: Credit cards are vulnerable to brute force kind attacks

#54

Post by cj »

julienchastang wrote: post #31

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new e…

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies.

Blog post from Stripe:

https://stripe.com/resources/more/what-is-a-card-account-upd...

Re: Credit cards are vulnerable to brute force kind attacks

#55

Post by gnopgnip »

jonathanlydall wrote: post #50

If 3D secure was mandatory everywhere that would help a lot, but if I understand correctly, it’s not really used in the US and with them being so big, card issuers are largely forced to allow non 3D secure requests or their clients will be unable to use their cards for too many things. So an enormously good anti-fraud mechanism is severely handicapped. It’s really frustrating for most of the rest of the world. I don’…

How much is lost to fraud that would be prevented by 3d secure, 0.1%?

Re: Credit cards are vulnerable to brute force kind attacks

#56

Post by epcoa »

tptacek wrote: post #47
epcoa wrote: post #43

Earlier quoted context omitted.

In addition to nominal fraud prevention (and how is any debit card better) there’s nothing better to claw back transaction fees, so what the fuck am I supposed to do?

I'm not saying debit cards are better at fraud prevention and response; I'm saying they're roughly equivalent. The downsides of credit cards are self-evident.

So maybe I’m wrong but the belief is that debit card protections are worse than a credit card in the US. I really don’t have the personal time to test this, but I do know that when I dispute on a credit card it is initially removed until proven valid.

Again maybe I’m wrong but I don’t agree they are equivalent. It sure fucking feels that way, the money isn’t threatened from my account.

Re: Credit cards are vulnerable to brute force kind attacks

#57

Post by fckgw »

jonathanlydall wrote: post #50

If 3D secure was mandatory everywhere that would help a lot, but if I understand correctly, it’s not really used in the US and with them being so big, card issuers are largely forced to allow non 3D secure requests or their clients will be unable to use their cards for too many things. So an enormously good anti-fraud mechanism is severely handicapped. It’s really frustrating for most of the rest of the world. I don’…

> I don’t get it, do US citizens prefer being defrauded over what is perceived as a slight inconvenience?

Do you think we are requesting to have less secure payment methods or something?

No, we don't "prefer to get defrauded", but things like this are a matter of negotiation between the card issuers and the merchants.

Re: Credit cards are vulnerable to brute force kind attacks

#58

Post by evan_a_a »

spankalee wrote: post #52
evan_a_a wrote: post #39

>As a consumer, I thought I was safe; when saving my credit card to a billion dollar valued european merchant, or when i purchase something from supermarket and ignore the receipt, but the reality is slightly different from that. >I got the money back via chargeback in short time. So as evidenced, you are protected by the fraud infrastructure. The bank ate the loss for the fraud and you were made whole. In the end, t…

> The bank ate the loss for the fraud and you were made whole _If_ you notice the fraudulent charge.

[dead]

Re: Credit cards are vulnerable to brute force kind attacks

#59

Post by jabroni_salad »

tptacek wrote: post #9
janalsncm wrote: post #6

At least with a credit card you have some fraud protection. Report it and the charge should be reversed. And chargebacks are possible. With a debit card you’re playing with your own money.

That has not been my experience with debit cards in the US at major banks, at all , over decades. (I'm pathologically avoidant of credit cards, which I think are mostly pointless.)

When my bank account got drained, I could not pay rent or any bills. I had enough cash for about a week of food. It took 4 weeks for the bank to decide I could be made whole. Ever since then I have never even put a debit card in my wallet. I know what the laws say. I have read endless "well banks usually[...]" type messages. and yet all the same I one day awoke to find myself transformed into a giant cockroach.

Re: Credit cards are vulnerable to brute force kind attacks

#60

Post by tety »

julienchastang wrote: post #31

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new e…

Digital wallets as in Apple/Google Pay? I had a similar thing happen and I am wondering what did you make of this double charge, what did the attackers do in your opinion?
Post reply on HN