13 ms·
Blippy Publishes User Credit Card Numbers
- ig1 17y agoLooks like Amazon were right to ban them over privacy concerns...
- billclerico 17y agoit seems like this is old test data in the google cache, not current data
- fnid2 17y agoeven if it is test data, we must wonder, why did anyone ever build the system such that credit card numbers were visible to google? Why did someone include the credit card number in the select clause, add it to the html template, and put it on a public server that could be crawled by Google?
- axod 17y agoFrom their response, as far as I understand it, Some line items 'comments' field had credit card details included in them, which they didn't bank on.
- gte910h 17y agoHonestly looks like a credit card processor is being strange and publishing the card number in the wrong field. Only a couple people using the service had this error (not caused by them). This has been fixed long ago, just this was a cached paged caught from beta.
- there 17y agoi'm sure there wasn't a "credit card number" field that this information came from. when downloading OFX transaction data, some banks include the full credit card number in the transaction description, and some only include the last 4 digits.
- adamtmca 17y agoOh my god..
- dmose 17y agowtf?
- eli 17y agoThat does not seem PCI compliant
- dangrossman 17y agoPCI compliance is something mandated through merchant agreements upon credit card processors. Blippy is not processing payments on those cards, and PCIDSS is not a law.
- Freebytes 17y agoPCIDSS is as good as law for a credit card processing company, though. If they are not authorized by the credit card companies, they cannot process the cards. If they cannot process the cards, they are out of business.
- fnid2 17y agoThere are lots of alternatives to accepting credit cards for payment by the way. Lots of restaurants take cash only and online, there are many third parties like Paypal to move to.
- jasonlotito 17y agoBut you won't see anyone fining CitiBank for putting credit card numbers where they don't belong. Banks are, in my experience, one of the weakest links in the CC security chain.
- TotlolRon 17y ago"A fool and his credit card number are soon parted" -- blippy, 2010
- makmanalp 17y agoThis is one case where telling them first might have caused less damage. Very terrible situation though ...
- jgrahamc 17y agoAll the card numbers start 5424 (Citibank MasterCard) and there are actually only a small number of different card numbers. I wonder if this is something to do with test data.
- jgilliam 17y ago5424 is a MasterCard test number. http://www.topbits.com/test-credit-card-numbers.html http://www.topbits.com/test-credit-card-numbers.html edit: I was wrong, it's the full number that's a test number. 5424 0000 0000 0015
- joshu 17y agoI'm reasonably sure that's not true. Perhaps the whole 16 digit sequences listed there is a test number.
- jgilliam 17y agoYou are right, I was wrong. It's the full number that's a test number. 5424 0000 0000 0015
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- AndrewHampton 17y agoThere are the only 4 numbers in the results. Although I do see a few in this format XXXXXXXXXXXX2376. (Edited to remove actual numbers in case they're not test numbers)
- BobbyH 17y agoMy actual MasterCard # starts with 5424.
- iamelgringo 17y ago
- jgilliam 17y agoAny theories on how it happened, technically?
- jonursenbach 17y agoEasy, they don't encode their credit card numbers and are not PCI-compliant.
- rmaccloy 17y agohttp://twitter.com/freerobby/status/12711147469 http://twitter.com/freerobby/status/12711147469 claims it's a Citi API fail. (Obviously Blippy should be filtering out this sort of stuff, but dubious on Citi's part, too.)
- abronte 17y agoOuch. I guess I'm glad I didn't get around to trying out Blippy.
- waterlesscloud 17y agoWell, there goes that valuation.
- bigsassy 17y agoDoes anybody else find it strange that all the visible credit card numbers start with 5424? According to Wikipedia, Citibank has that issuer code (http://en.wikipedia.org/wiki/List_of_Bank_Identification_Numbers http://en.wikipedia.org/wiki/List_of_Bank_Identification_Num...). Why would only Citibank cards show up?
- thehodge 17y agoonly seems to be a few users, is it a certain card make or something?
- eelco 17y agoWhile incredibly stupid, is this enough information to do actual harm? Don't you also need the CVS code?
- tortilla 17y agoCredit card numbers by themselves are no big deal, but this will haunt Blippy forever. I don't know how you can recover from a PR disaster like this.
- axod 17y agoSlightly melodramatic. No one will care tomorrow. We'll all be on to being outraged by something else.
- sbov 17y agoNot all online credit card processors require a CVS code. I don't know if you can try enough different expiration dates before it gets shutdown for fraud.
- lanstein 17y agoBeing pedantic, it's often called a CVV code, or a number of different acronyms, but none of them are CVS afaik.
- tghw 17y agoIn the US, it depends entirely on the merchant. They tell the CC processor how secure they want it to be. A lot of them only need the CC number and any expiration date in the future.
- jxcole 17y agoIn general, having the wrong CVV code will decrease the chance of the purchase going through, not stop the transaction completely. If you have, for example, the wrong CVV but the correct address and name, there is a good change the transaction will go through any way.
- bengebre 17y agoLooks like mashable broke the story: http://mashable.com/2010/04/23/blippy-credit-card-numbers http://mashable.com/2010/04/23/blippy-credit-card-numbers
- pg 17y agoNo, Venturebeat I think: http://twitter.com/owenthomas/statuses/12705151399 http://twitter.com/owenthomas/statuses/12705151399
- iamelgringo 17y agoAnd this, the day after they raised $11 million in a series A. I really don't understand that investment at all. Could someone explain it to me? ref: http://www.crunchbase.com/company/blippy http://www.crunchbase.com/company/blippy
- cracell 17y agoMaybe they somehow convinced investors they were going to be the new "twitter".
- eplanit 17y agoWow. That is a 100 lb. sack of FAIL! More fodder for my PCI slides to show clients. Thanks Blippy, you've replaced CardSystems for me (their story was getting old).
- eplanit 17y agoYou all are offended by calling out a fail? Touchy today, eh?
- eplanit 17y agoLet's see how far this can go.
- pg 17y agoI would not recommend that. http://news.ycombinator.com/item?id=1287503 http://news.ycombinator.com/item?id=1287503
- icey 17y agoThe first rule of being in a hole: Stop digging.
- eplanit 17y agoIf I cared about 'Karma', I'd heed that post. But, I don't.
- TheBranca18 17y agoWhat's the point of participating in a community when you don't care what others think? Seems pretty pointless to me.
- eplanit 17y agoCommunity? I know nobody here. Everyone, like me, is hiding behind a screen name. People get to 'downvote' anonymously, which to me is absurd. Yesterday, I make a near meaningless remark about Apple fan-boys, and got 7 points. Today, I make a more meaningful remark about how this really is a noteworthy failure -- and I'm losing Karma right and left. To me, this is comical. Community? How do you define that word?
- eande 17y agoBlibby policy says "Our Services are primarily designed to help you share information about your purchases with others. This information will be public by default, but you may make it more private by editing your account settings. You should be careful about all information that will be made public by Blippy." I do not see lots of reason to sign up for this service in the first place. With the social media interconnecting all the data even on a passive way which the F8 from FB hinted it we are heading into a direction were someone has to be more careful with personal information.
- run4yourlives 17y agoCan I ask a question? Why do they (or any other startup) even know what actual credit card numbers are? How many of you operate in the same way? Why? Are you PCI compliant?
- smokinn 17y agoBecause when you rebill a client you have to give the number again. You can use a 3rd party gateway that acts as an intermediary between you and the bank that issued your merchant account and the 3rd party gateway will offer services such as scheduled rebilling. The gateway has to store the number though because the APIs at the highest level have no clue how to deal with internet and subscription type billing. They're still stuck in a very brick-and-mortar mindset. In this case it's the 3rd party gateway that has to deal with PCI compliance, not you. If your transaction volume is high enough to justify it you can save a lot by cutting out another middleman and writing your own gateway. In this case though you generally have to be PCI compliant and have regular security audits to stay compliant. PCI compliance only makes sense when you store CC numbers since PCI is a set of requirements on how to store them. Saying you don't store CC numbers and are PCI compliant makes no sense. EDIT: As andrewf points out below I'm wrong about this paragraph.
- run4yourlives 17y agoSaying you don't store CC numbers and are PCI compliant makes no sense. Yes I know, that's why I didn't say that. I'm wondering why you would ever (as a startup) choose to write your own gateway and not outsource this to a company that can be PCI compliant (i.e. the Gateway)
- smokinn 17y agoI wasn't implying that you were, I was just trying to be clear. Why is simple. It's the economics. If you're a startup that does lots of micro-transactions you're paying a good chunk of overhead in gateway processing fees. If you feel it's worth the continual development effort (because don't kid yourself, writing a secure internal gateway takes a long time and essentially never ends) then you do it. In Blippy's case they probably had to write their own because I don't know of any 3rd party gateway that has an API to return a list of user purchases when you give them a credit card number. I'm actually surprised the banks even support that kind of request.
- jfarmer 17y agoI use a Citibank MasterCard. :( Is there any way to report this to Citibank?
- gyardley 17y agoIt looks like the credit card numbers are included in the Blippy section starting with "The purchase appears on your statement as:", followed by the actual text of the line entry from the statement. From that, I'm guessing that Blippy lets users automatically import their credit card statements, but they didn't anticipate that the entries in those credit card statements would occasionally include full credit card numbers. Embarrassing but a corner case.
- waxman 17y agoAnd you thought the new Facebook API was intrusive...
- brown9-2 17y agoI don't mean this to sound snarky but I'm having a hard time understanding the basic utility of blippys service. Why would you want to automatically share information about every purchase you make with your credit/debit card with the world? It just sounds like a recipe for disaster with very little upside. Can anyone who uses this service (if any HN members do) explain the usefulness of it to me? I might just be misunderstanding the purpose.
- johnrob 17y agoI don't use the service, but I see it as a blog like tool. If you have one, you only use it in scenarios you'd like to tell everyone about. If you're at a baseball game, you use it to buy beers and they automatically post something like "John Doe bought 4 beers at the Giants game".
- leftnode 17y agoI was wondering the same thing, it just seems like a service where they'll be able to sell your data to companies down the road, or advertise you stuff you might be interested in. Even if this turns out to be test data, it's still pretty shocking and will tarnish the service forever.
- fnid2 17y agoIt's definitely an example of what can happen to your financial info if a website you give it to makes a mistake or gets greedy. It's why I'd never use a service like that or mint, et al...
- smokinn 17y agoIt's only for the most exhibitionist type of people. Think of sci-fi books with people being "life actors" or some such where people can tune in to them 24/7 and see what they're doing. It's basically just a stepping stone to that. I don't see this ever becoming even close to mainstream.
- bsergean 17y ago
- ivenkys 17y agoAs an experiment i followed up 5424xxxxxx number to check if its a test number. I could track down the card's owner and a little judicious googling gave away the owner's home address as well. Doesn't look like a test number.
- Oompa 17y agoI'm glad I never trusted them enough to give them my information.
- dalton 17y agoI hope someone writes a technical post-mortem/case-study on this.
- dsplittgerber 17y agoYou have got to be fuck*ng kidding me, Venturebeat: "VentureBeat reporters deduced that all are Citibank-issued MasterCard numbers. We’re reluctant to publish further details yet." http://venturebeat.com/2010/04/23/blippy-credit-card-citibank/ http://venturebeat.com/2010/04/23/blippy-credit-card-citiban... Yet they're showing a screenshot with the exact Google search term to get all the data.
- gojomo 17y agoThat's not too unreasonable of an approach for an online news source: avoid republishing info that could be wrong, but allow readers to observe the same primary sources, unless/until Blippy and Google change things.
- dsplittgerber 17y agoWell, they just could have refrained from publishing the exact "hack" at all. Which would have been the right thing to do, making it at least a little bit harder for people to find out which CC #s exactly are compromised. They could have stuck with reporting about it, not sharing in spreading it all over the internet.
- count 17y agoSo, after reading, it appears this is more of a Citibank failure than a Blippy failure. It makes Blippy look horrible though (even if it is unfairly). Is this just an accepted danger of using 3rd party APIs for information, or can they (Blippy) do something that doesn't look like they're just trying to shift the blame? I wonder what other awesome bugs are lying in wait in Citi's API...
- crescendo 17y agoBlippy's response: http://blippy.posterous.com/blippy-and-credit-card-numbers http://blippy.posterous.com/blippy-and-credit-card-numbers
- paulsmith 17y agoI think Google has some responsibility here. Credit card numbers can be validated with a simple checksum[1]. I don't see why Google can't detect them in their index and obscure them. It's not like they haven't gone to that kind of privacy effort for faces and license plate numbers in Street View. [1] http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm
- snprbob86 17y agoAnd what happens when there is a false positive? I think Google has every right to claim carrier protections (or whatever the law is) and just turn a blind eye to this problem.
- paulsmith 17y agoI suspect that a combination of the Luhn checksum and contextual information would give you a fairly high confidence level of it being a valid credit card number, and not some other innocent string of digits. They could clearly mark the stricken text as having been done to potentially protect privacy and provide a contact mechanism to un-obscure false positives. I think the harm of a few false positives -- remember, we're talking about obscuring a 16-digit string that has a particular valid checksum, not a very common occurrence -- is greatly outweighed by the harm of having someone's financial identity stolen from a Google search.
- apgwoz 17y agoI'm hard pressed to think of a 16 digit number that I'd want to search for, but I suppose there could be one. Barcodes, ISBNs, etc. But, for the summaries of search results, I see no reason why scrubbing the numbers would be a bad thing. I can't imagine complaining about seeing XXXX XXXX XXXX XXXX in a result summary instead of 5424 0000 0000 0015
- yellowbkpk 17y agoThey only hid faces and license plate numbers after a huge uproar from the public. I imagine they would do the same sort of "cleansing" of their results if a similar uproar occurred. Until then, why do it?
- axod 17y agoObviously this is bad, but are you able to make a purchase anywhere with only a CC number? Don't you need the expiry date and CSV and full name?
- kevintwohy 17y agoThey've responded here: http://blippy.posterous.com/ http://blippy.posterous.com/ Not as apologetic as one might expect.
- axod 17y agoI think it's a pretty solid response. The question is, why would banks put your credit card number on the description of transactions in the first place? I've never seen that done before. I think they're perhaps not as apologetic as you'd like because the premise (Blippy publishes credit card numbers) is incorrect. They made a mistake in a beta period which they fixed.
- kevintwohy 17y agoYeah - all the relevant details are in there, and he's technically right about the CC# liability bit, but the last way you want to come off in a situation like this is "it's not all that bad..."
- axod 17y agoWell, it does at least show that the title of this news story is sensationalist link bait. Some times people mess up. But there's a difference between "oh oops in the beta period we didn't realize that banks put credit card numbers in descriptions :/ and we didn't realize Google would index that. 4 people were affected and we're sorting it" and "We routinely share credit card numbers!!!" Personally I'd give them a break about it. They're probably feeling pretty crappy about it all already without people blowing things out of all proportion. (This is one of the worst things about the internet IMHO - blowing tiny things up into mammoth proportions through rumor, misunderstanding and incorrect assumptions. And always assuming everyone is evil).
- deleted 17y ago[deleted]
- tdmackey 17y ago
- zavulon 17y agoBlippy is claiming it only published CC numbers of 4 users, and it's from beta test. http://blippy.posterous.com/blippy-and-credit-card-numbers http://blippy.posterous.com/blippy-and-credit-card-numbers There's also this: "While we take this very seriously and it is a headache for those involved, it's important to remember that you're never responsible if someone uses your credit card without your permission. That's why it's okay to hand your credit card over to waiters, store clerks, and hundreds of other people who all have access to your credit card numbers. " That's true, but how does this diminish their security breach, is beyond me.
- deleted 17y ago[deleted]
- samratjp 17y agoAnd looks like NYTimes has a take on Blippy and T.M.I online: http://www.nytimes.com/2010/04/23/technology/23share.html http://www.nytimes.com/2010/04/23/technology/23share.html
- iamdave 17y agoTurns out Google indexed some of this HTML, even though it wasn't visible on the Blippy website. Okay, so my question then, after getting the response that Blippy could do a better job processing their data, is why Google is indexing data that isn't being displayed? What I mean is, I understand crawlers go through pages to gather data for search results. Why is it gathering data that isn't going to be rendered to the user, performing search queries, since that is empirically the most relevant data users need to see in search results?
- faramarz 17y agoI want to hear what they have to say and offer to the four users. This is a HUGE trust issue and you can somewhat foreshadow the companies future by how they handle the crises especially with these 4 users.
- invisible 17y agoIt looks like Google deleted the card numbers from these. Even if this affected 4 people TOTAL (assuming they are not test numbers), this is not an epidemic - banks expose more than this a week I'd bet. I find it difficult for me to swallow the title of the article and makes me want to flag it.
- codemechanic 17y agohttp://blippy.com/business/+1310-6645810epoc-04-02-card-7096-purchase-55180390092511503005577-+1310-6645810-ca http://blippy.com/business/+1310-6645810epoc-04-02-card-7096...
- jawngee 17y agoA dumb idea does dumb shit, film at 11.
- arihant 17y agoBlippy doesn't look bad at all from what I perceive from the homepage. They can do better by removing the TIME's quote -"Made me want to spend more". Any idea which just makes you sit and think about what more can we do is a great idea. I think Blippy is one of them, kinda gets you excited. I think girls would just love this service.
- ig1 17y agoHaving thought about it for a few days I've realized Blippy has a much more fundamental security hole. Banks consider this data to be private. In the past when I've forgotten my password and phoned my bank to get a new one, typically they ask for a shared secret (like mothers maiden name, first school, etc.) but if you say "I don't remember" they then ask you to verify your address and your recent transaction history. Blippy makes that last bit public and so probably creates a backdoor in the manual security protocols of a lot of banks.