Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting any Facebook user's friend list and partial payment card details

josipfranjkovic.com

Post reply on HN
Print view View original

61–70 of 95 posts

Re: Getting any Facebook user's friend list and partial payment card details

#61

Post by cjbos »

kyrra wrote: post #34
packetized wrote: post #4

Earlier quoted context omitted.

First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...

While it complies with PCI standards, knowing first6+last4, plus contact information, you can be much more successful at phishing against the target. First6 will give you ability to know the issuing bank of the card (so an email can be crafted to look like those banks emails). Plus last4 tends to be used by banks as a "hey, we know who you are!" when they send emails.

You might need them to reverse or refund the transaction with some payment gateways. Or if you are going to settle the funds at a time after authorization when shipping

Re: Getting any Facebook user's friend list and partial payment card details

#62

Post by neotek »

wolco wrote: post #20
cheeze wrote: post #11

Earlier quoted context omitted.

Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours

Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.

Re: Getting any Facebook user's friend list and partial payment card details

#63

Post by philipodonnell »

jpollock wrote: post #3
tannerc wrote: post #2

Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."

That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.

Random question I've never found a place to ask before. Is there a formal language or method for specifying information like this, where I could map out different pieces of data and reason about how the pieces of data flow through a system, to prove mathematically that two (or n) pieces of data are never available in the same place?

Re: Getting any Facebook user's friend list and partial payment card details

#64

Post by ratsz »

kevindqc wrote: post #35
packetized wrote: post #4

Earlier quoted context omitted.

First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...

How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|

A secure token is provided by the credit card processor that the vendor can safely store and reuse after the first successful transaction.

https://en.wikipedia.org/wiki/Tokenization_(data_security)

Re: Getting any Facebook user's friend list and partial payment card details

#65

Post by FractalLP »

praneshp wrote: post #44
murukesh_s wrote: post #33

Earlier quoted context omitted.

Already there - whatsapp, instagram oops...

Hacker news....

Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat videos.

Re: Getting any Facebook user's friend list and partial payment card details

#66

Post by IIAOPSW »

FractalLP wrote: post #65
praneshp wrote: post #44

Earlier quoted context omitted.

Hacker news....

Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat…

Its cause of the people. The more popular something is the worse it gets until eventually its all cats and outrage-culture "fake news". The medium is irrelevant.

Media sucks because you* suck.

*The collective societal you, not the particular individual you.

Re: Getting any Facebook user's friend list and partial payment card details

#67

Post by chromelyke »

neotek wrote: post #62
wolco wrote: post #20

Earlier quoted context omitted.

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours

Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.

https://code.facebook.com/posts/270314900139291/rapid-releas...

Re: Getting any Facebook user's friend list and partial payment card details

#68

Post by davidgh »

joering2 wrote: post #60
kevindqc wrote: post #35

Earlier quoted context omitted.

How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|

Most MSP (merchant service provider) gives you control over the details you personally want to capture to verify someone. The minimum and most insecure is simply approving card based on valid number! (Not even expiration date). Then you can enable EXP, CVV and AV (address verification). Fun tip about AV: your adres doesnt matter. There is so many spellings of "oak harbour drive apartment 2" that industry pretty much…

Address line 1 in AVS is still used, however, only the numeric portion of the address is checked. The AVS results will generally tell you the individual match results for the address line and the postal code, so you can have a full match or a partial match. Most merchants will allow you through with a partial match.

Re: Getting any Facebook user's friend list and partial payment card details

#69

Post by orastor »

neotek wrote: post #62
wolco wrote: post #20

Earlier quoted context omitted.

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours

Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.

They also use bittorrent:

https://arstechnica.com/information-technology/2012/04/exclu...

Re: Getting any Facebook user's friend list and partial payment card details

#70

Post by waterhouse »

IIAOPSW wrote: post #66
FractalLP wrote: post #65

Earlier quoted context omitted.

Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat…

Its cause of the people. The more popular something is the worse it gets until eventually its all cats and outrage-culture "fake news". The medium is irrelevant. Media sucks because you* suck. *The collective societal you, not the particular individual you.

I think some studies have shown that the same set of people (or, let's say, people randomly assigned to one group or the other) can have very different behavior depending on the situation they're in. It seems at least possible that a forum could maintain its rules and norms while people join... though received wisdom says that if too many join at once, then the norms can be broken.
Post reply on HN