5 ms·

> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how

> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?

cm2187 10y ago
Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.
- chrisseaton 10y ago
  > the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
  - pbhjpbhj 10y ago
    In the UK the numbers are printed on the receipt - part obfuscated on the customers copy, fully shown on retailer copy. So whilst the retailer may not touch the card they still get everything except the magic 3 digits. Where I work you need the 3 digit security code and some address numbers (which you can make up) to properly process a transaction without the card.
    - chrisseaton 10y ago
      Yes that's what I said - they don't see both sets of numbers.
  - tzs 10y ago
    Chip and PIN cards can support tokenization, which prevents the merchant (or anyone who has hacked the merchant) from seeing the card number, but they are not required to do so. I haven't seen any numbers on what fraction of cards use tokenization. Something to keep in mind is that when chip and PIN was developed to combat credit card fraud it was card present fraud that was the big problem, either by someone using the stolen card itself at a brick and mortar merchant or making a counterfeit cart by writing the stolen number onto a blank card and using that at a brick and mortar merchant. Card not present fraud, where the number is used but not a card such as at an online merchant or a mail order merchant or telephone order merchant, was much less common. Chip and pin made card present fraud much harder because it was much harder to obtain blank chip cards and the equipment to write a stolen number to them, and it made using an actual stolen card harder because of the PIN.
  - cm2187 10y ago
    Chip and pin is not for online transactions, but in-store transactions. The merchant can see your credit card and would often manipulate it themselves.
- stfnfhrmnn 10y ago
  I also use a Unique-per-service email address with Paypal, and I noticed that Paypal actually passes on that email address to the retailer when I pay with Paypal. I receive order confirmation emails (from those retailers) and quite a few unwanted newsletters to my unique paypal address now. I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separate email address with the retailer anyway, and because of this scheme, those two of course never match.
  - syshum 10y ago
    >>>I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. For years the Paypal API sucked, and even today their are many companies that do not have full integration with paypal, so this is a way to match payment records as for 99% of shoppers the email address for the order/account will match the paypal email address.
  - throwanem 10y ago
    Paypal is great at that kind of unintentional disclosure. Six or eight years back, because I liked what she had to say, I used it to donate to someone who was then speaking under a pseudonym as a result of some fairly credible threats. Imagine my surprise when, in the process of transferring funds, Paypal showed me her full legal name and domicile address in the UI! Of course I let her know about it, and I seem to recall her saying she'd addressed it successfully, but if she described how, I no longer remember. It quite astonished me that this was even a thing that could happen, though. One hopes it no longer does.
    - ramblerman 10y ago
      This sounds like she just set up her full name and address with paypal. It's like her giving out her email address and it being firstname.lastname@gmail.com I'm not sure the fault lies with the service.
      - throwanem 10y ago

> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?

cm2187 10y ago

Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.

chrisseaton 10y ago
> the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
- pbhjpbhj 10y ago
  In the UK the numbers are printed on the receipt - part obfuscated on the customers copy, fully shown on retailer copy. So whilst the retailer may not touch the card they still get everything except the magic 3 digits. Where I work you need the 3 digit security code and some address numbers (which you can make up) to properly process a transaction without the card.
  - chrisseaton 10y ago
    Yes that's what I said - they don't see both sets of numbers.
- tzs 10y ago
  Chip and PIN cards can support tokenization, which prevents the merchant (or anyone who has hacked the merchant) from seeing the card number, but they are not required to do so. I haven't seen any numbers on what fraction of cards use tokenization. Something to keep in mind is that when chip and PIN was developed to combat credit card fraud it was card present fraud that was the big problem, either by someone using the stolen card itself at a brick and mortar merchant or making a counterfeit cart by writing the stolen number onto a blank card and using that at a brick and mortar merchant. Card not present fraud, where the number is used but not a card such as at an online merchant or a mail order merchant or telephone order merchant, was much less common. Chip and pin made card present fraud much harder because it was much harder to obtain blank chip cards and the equipment to write a stolen number to them, and it made using an actual stolen card harder because of the PIN.
- cm2187 10y ago
  Chip and pin is not for online transactions, but in-store transactions. The merchant can see your credit card and would often manipulate it themselves.
stfnfhrmnn 10y ago
I also use a Unique-per-service email address with Paypal, and I noticed that Paypal actually passes on that email address to the retailer when I pay with Paypal. I receive order confirmation emails (from those retailers) and quite a few unwanted newsletters to my unique paypal address now. I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separate email address with the retailer anyway, and because of this scheme, those two of course never match.
- syshum 10y ago
  >>>I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. For years the Paypal API sucked, and even today their are many companies that do not have full integration with paypal, so this is a way to match payment records as for 99% of shoppers the email address for the order/account will match the paypal email address.
- throwanem 10y ago
  Paypal is great at that kind of unintentional disclosure. Six or eight years back, because I liked what she had to say, I used it to donate to someone who was then speaking under a pseudonym as a result of some fairly credible threats. Imagine my surprise when, in the process of transferring funds, Paypal showed me her full legal name and domicile address in the UI! Of course I let her know about it, and I seem to recall her saying she'd addressed it successfully, but if she described how, I no longer remember. It quite astonished me that this was even a thing that could happen, though. One hopes it no longer does.
  - ramblerman 10y ago
    This sounds like she just set up her full name and address with paypal. It's like her giving out her email address and it being firstname.lastname@gmail.com I'm not sure the fault lies with the service.
    - throwanem 10y ago