8 ms·
Domino's: Pizza and Payments
- tdaltonc 11y agoMy interest is certainly peaked about the 10% off coupons.
- vemy 11y agoThe word you are looking for is piqued.
- farnsworth 11y agohttps://news.ycombinator.com/item?id=11462886 https://news.ycombinator.com/item?id=11462886
- mattmanser 11y agoIn an experiment involving 80 Americans So, worthless.
- smoyer 11y agoExcept that this is not a grammar error ... (s)he chose the wrong homophone.
- Normal_gaussian 11y agoHere in the UK there is always a 50% off or better deal for mediums and larges. If you can't find one on the page or from a quick Google ringing the store will get it (only ever had to do this at a friend's in Liverpool)
- sdwisely 11y agoIn Australia users have created userscripts that will track and share voucher codes and their expiry. https://openuserjs.org/scripts/jehan/Dominos_Pizza_Voucher_Codes https://openuserjs.org/scripts/jehan/Dominos_Pizza_Voucher_C...
- megablast 11y agoMight be because pizzas are incredibly overpriced in the UK. Most places they are cheap student food, for $5 you can get a meal. Not in the UK.
- keeperofdakeys 11y agoFor these discount pizza chains, there is usually plenty of coupons floating around - they even accept 'competitor' coupons. You can probably find some if you search for them on the internet. But as old adage goes, you get what you pay for.
- jon-wood 11y agoI'm not sure the adage applies here. When using a coupon you get up to 100% more than you paid for, assuming you're using the not at all rare buy one get one free ones.
- Symbiote 11y ago> But as old adage goes, you get what you pay for. Fancy cheese on toast?
- TheOtherHobbes 11y agoExpensive fancy cheese on toast. Not that I don't love pizza. But even with 50% off, those prices...
- joshmn 11y agoAlways 25% off with PapaJohns! Use coupon code 25OFF — it's even valid until December 31, 2017. Unless you mean how they're generated.
- bertil 11y agoJust like pizza tastes better when you made it yourself, it is sweeter when you were able to code your own working coupon generator.
- dexterdog 11y agoIf pizza tastes better when you make it yourself you don't live in a place that has good pizza.
- pkroll 11y agoNothing prevents you from using good ingredients and practicing till you can generate a really good pizza. The one tool you would have trouble replicating, a really high-temp oven, only counts as important for a limited set of pizzas. And you can take steps to get a high-temp oven, if you want to go all-out.
- sk5t 11y agoI've read that the real discounts are in calling the location directly and asking about "walk-in specials." The franchisee doesn't have to yield as much revenue to the mothership when you avoid centralized ordering and thus can extend more price flexibility.
- srtjstjsj 11y agoclient-side payments is totally normal, when done right, unlike dominos's's buggy version -- what usually happens is that the vendor sends you to a payment processor, and you pay them, and the payment processor sends a verification token to the vendor, and the vendor delivers your product to you. Domino's skipped one critical step.
- dperfect 11y ago> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the payment associated with the token matches what the vendor expects.
- mintplant 11y agoWhy not have the payment processor notify the vendor's server directly? I believe PayPal does this.
- takno 11y agoImplementing IPN on Paypal is a pain. It is really only required because the normal flow for Paypal is to take the user off your site to theirs and only redirect back to you when the user clicks a link or waits quite a long time. This results in loads of users not making it back, or clicking out of the flow. More modern client-based payments processing tends to happen in-page via javascript or an app. The Stripe/Braintree-style flow is nicest in many ways - they post the card details off to the payment processor, who generate a unique retailer-specific token for the card and send that back to the page. The retailer then uses that to process the payment server-side just like they would have done if they had collected the card number, only without the PCI-compliance issues.
- jdavis703 11y agoThat's how it works most of the time, at least in my experience. Card details are sent to the processor, a token comes back. You then send the token along with any data relevant to the transaction (which items were purchased, tax zones, coupon codes etc), you then verify on the server that inventory exists etc, and then you send the token (which is only a short-lived represention of the credit card number) and then verify the payment went through, and then you go through the bussines process for delivering your product(s). Then, and only then do you give back a response saying the order has processed, so the UI can alert the user.
- deleted 11y ago[deleted]
- bitmapbrother 11y agoWhy doesn't Google do more to prevent Android apps from being decompiled, inspected and recompiled into modified apps? Yes, there's source code obfuscation, but that only slows down the amateurs.
- joshmn 11y agoPackets, man. It's about the packets. And a failure to pin your certificate.
- DannyBee 11y agoBecause it's not an arms race that can be won? And in most cases, it's a complete waste of time to try?
- colejohnson66 11y agoWhat about this? > Why doesn't Microsoft do more to prevent C# apps from being decompiled, inspected and recompiled into modified apps? There's not much you can do when you have a very simple interpreted language (or JITed). Take C for example. Sure, you can take the outputted assembly and turn it into something readable, but because it's been optimized, it's not easy to figure out what it means. C# and Java OTOH compile down to a very simple set of assembly instructions. AFAIK, "stack variables" aren't reused as each variable is referenced by its index. If you were to take the JITed output from CIL or Java bytecode, making something readable would be hard.
- rms_returns 11y agoThat depends on how well the obfuscator works and scrambles your code. Does it rename ALL classes, variables, methods and constants to gobbledygook? Does it add redundant code every now and then to add more confusion? If you do all that, then it becomes very difficult to crack even for advanced hackers. But ultimately it should be possible as obfuscation is based on a human logic (though executed by machines) - but it will certainly increase the needed difficulty and dedication to a considerable degree.
- PretzelFisch 11y agoIt's still not a problem if the client and server write secure code. because you can still man in the middle the packets, or own the emulator where you have direct access to the applications memory to manipulate it. A server cannot trust a client.
- Natsu 11y agoI'm waiting for Pizza Hut to show up next. I refuse to let them save my CC number because their password policy basically ensures that you can't choose a reasonable password. And if the obvious, public part of the site is like that, I can only wonder what hackers would find probing deeper.
- junto 11y agoWhich pizzahut country are you referring to out of interest? Is this US?
- Natsu 11y agoThe USA, specifically pizzahut.com prevents you from using any special characters in your password. You can see the message here: http://imgur.com/T8R6Fnr http://imgur.com/T8R6Fnr I thought they used to also have limits on the maximum length, but thankfully that doesn't seem to be there when I tested it just now.
- ihsw 11y agoI often wonder what hackers would do if they made it past the front door. Google had to learn this the hard way -- now all links between their data centers are encrypted, previously they thought they were fine. The NSA and the Chinese famously took advantage of this.
- lowtto 11y agoIt's not that processing payment client-side is wrong, it's that the Dominos app implement it wrongly, or DataCash simply doesn't provide any security feature for protecting against http request data tampering, which I believe the latter is not the case. Most payment gateway have a security mechanism to ensure the response from payment server have its integrity remain intact. Most of the time by hashing some combination of responses value and shared secret key between merchant and the payment server, and comparing if both marchant calculated value and payment server hash matches. If it doesn't match, then it is safe to to throw an error and prompt appropriate message to said attacker. When implemented as such, the system are expected to immune to such attack as described by the author. The article is a perfect case study to showcase the consequences when the developer decided to skip the security part. (yes it's entirely up to the web master if they want this or not, the payment server won't care).
- aj_n 11y ago> Most payment gateway have a security mechanism to ensure the response from payment server have its integrity remain intact. I've definitely seen SSL pinning used to this effect. The simple solution to Dominos' problems seems like a server-verifiable transaction token that coming from DataCash (or whatever gateway service). I agree that client-side payment processing isn't wrong -- in fact, it makes more sense than attempting PCI compliance on their middleman server.
- nolok 11y agoFrom what I've seen, most developers understand "the client's sent data cannot be trusted", but they fail to understand how much it entails. It's not merely the forms they send, it's all of it, cookies, user agents, internal tokens that pass through Javascript, whatever. If the client touched it, it's compromised!
- lifeisstillgood 11y agoDid the author get a bug bounty? If not, is it that companies who understand tech the least also don't understand the value of such things?
- franciscop 11y agoFrom the tone of it, it seems he is graceful that he didn't get into any legal trouble. So I'd bet no, he didn't get any bounty.
- iolothebard 11y ago£26 for Domino's. Sounds like he got bent over pretty hard. I can't imagine spending ~$37 on fantastic pizza, much less Domino's.
- shakesbeard 11y agoHow was he able to see the raw responses from the payment gateway? Do they use HTTP instead of HTTPS to make these requests?
- geocar 11y agoBecause the messages were clear at some point on a machine he controlled. This is what the article means by the payment processing being done on the client: Some client-side code (JavaScript? A mobile app?) would receive the message from the payment gateway, and send the success code to Dominos. He may have used a debugger[1] to breakpoint the application where the application has a cleartext version of the traffic, however he might have also taken advantage of the fact that even if using HTTPS, if the programmer uses a certificate store the user has access to (which they usually do), they can install a custom root certificate and then use something like mitmproxy[1] or charles[2] to decode the traffic. What's needed to make this secure is to have a token provided by the payment processing API that the server can verify but that the client cannot produce (or tamper with)[4]. [1]: https://securitycafe.ro/2015/01/28/intercepting-functions-from-statically-linked-libraries/ https://securitycafe.ro/2015/01/28/intercepting-functions-fr... [2]: https://mitmproxy.org/ https://mitmproxy.org/ [3]: https://www.charlesproxy.com/ https://www.charlesproxy.com/ [4]: https://en.wikipedia.org/wiki/Hash-based_message_authentication_code https://en.wikipedia.org/wiki/Hash-based_message_authenticat...
- maqr 11y agoUseful little tool: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch
- nstj 11y agoDon't rely on client side data. Pin certificates in mobile apps.
- Spivak 11y agoYou're still trusting client side data. What's stopping a more advanced user from replacing your pinned cert with theirs. Don't do any payment processing client side. Your app should be a pretty interface to the actual service running on your servers.
- swalsh 11y agoOne of the things I love about stripe is it allows you to give them the raw credit card details directly (never hits my servers/logs), and they give me back a token. So I can still keep things server side, but I don't have raw credit card information in my server logs/database.
- jon-wood 11y agoThat's exactly what Domino's provider (and anyone else worth using) allows, they just didn't bother verifying the yoken.