Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Went to update payment info, showed me some random person’s credit card info

reddit.com

Post reply on HN
Print view View original

1–10 of 15 posts

Re: Went to update payment info, showed me some random person’s credit card info

#3

Post by rambojazz »

newguy1234 wrote: post #2

Credit cards are never secure by default. It is best to assume that the number will be stolen eventually.

I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.

Re: Went to update payment info, showed me some random person’s credit card info

#4

Post by elygre »

rambojazz wrote: post #3
newguy1234 wrote: post #2

Credit cards are never secure by default. It is best to assume that the number will be stolen eventually.

I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.

If it’s prepaid, is it then a credit card anymore?

I believe this is relevant with respect to much of the protection you have from using a credit card (chargebacks etc)

Re: Went to update payment info, showed me some random person’s credit card info

#5

Post by dessant »

rambojazz wrote: post #3
newguy1234 wrote: post #2

Credit cards are never secure by default. It is best to assume that the number will be stolen eventually.

I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.

Confirming online debit and credit card payments with a one-time password has become a standard practice in the EU. These solutions are also available in the US, are they not being adopted by banks there?

https://usa.visa.com/pay-with-visa/featured-technologies/ver...

https://www.mastercard.us/en-us/consumers/payment-technologi...

Re: Went to update payment info, showed me some random person’s credit card info

#6

Post by Cu3PO42 »

rambojazz wrote: post #3
newguy1234 wrote: post #2

Credit cards are never secure by default. It is best to assume that the number will be stolen eventually.

I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.

They do in Europe. Since 9/13 it is mandatory for online transactions with some exceptions. The implementation is up to the bank, so can take different forms.

In my case my bank has an app which will show the transaction and I can then accept/reject. My mom's bank's implementation looks very much like TOTP though I haven't investigated if it is.

Transactions at a POS use a PIN.

Re: Went to update payment info, showed me some random person’s credit card info

#7

Post by skissane »

I saw something very similar to this happen once in a system (many moons ago, before my current role). Hopelessly incompetent software developers put the session cookie in a static field of one of the Java classes responsible for the login process, and if two users logged in at the exact same moment (and their requests happened to be served by the same node of the app server cluster), one of them would be given the other's session cookie. So A and B would both log in at the same time, and there was a chance that B would get logged into A's account details instead of their own.

Somehow, all through QA testing, nobody noticed it (or if they did, they didn't report it). At just about the last possible minute before go-live, somebody observed it happen. Then there was a mad rush to patch the bug in the middle of the go-live weekend so the go-live stayed on schedule.

Re: Went to update payment info, showed me some random person’s credit card info

#9

Post by 19ylram49 »

Yikes.

This is part of the reason why I prefer to never let any services/apps/etc. save my bank/card details. If there’s not an option to save the card details that I can uncheck, 9x out of 10, I reconsider the transaction.

The assumption here though is that the services/apps/etc. that do provide the option actually respect it; in other words, unless you use fake/virtual card details (not entirely reliable, in my experience), you can’t be 100% sure that you’re safe either way, which sucks.

Post reply on HN