4 ms·

Wow, I would have thought they would have at least made a motion to apologize. Instead they've basically said "hey, this isn't a big deal, stop complaining".

by icey 17y ago

scdlbx 17y ago
"While we take this very seriously and it is a headache for those involved (to whom we apologize and are contacting)"
- icey 17y ago
  They changed their post. I specifically searched for the words "sorry" and "apologize" / "apol" before commenting.
nathanb 17y ago
Seems like they apologized to the four users involved. I don't know that they owe the public in general an apology. They basically explained why this is less scary than the headlines (including the one here on HN) makes it look and said that they were committed to keeping this from happening again, including giving examples of steps they were going to take. What would you have liked to see from them? Prostrating themselves before you for revealing someone else's credit card data?
- whiskeyjack 17y ago
  I would have liked to have seen "a lot less bad that it looks" replaces with "one would have been too many" and "we will work very hard to regain your trust". It's okay... but the public is their target audience! Simple phrases, big impact.
- jmathai 17y ago
  Leaking 4 of thousands of credit card number IS a huge deal. It's a disservice to their users (even the ones who weren't affected) for them to downplay it.
  - bh3 17y ago
    I'm personally getting the feeling that downplaying it was more of a trip up on their part. They wake up, find they are suddenly being viewed as the devil, and for some strange reason want people to believe that things are not as bad as they look. The problem, though, is they should never have said that directly. They should have given us every reason to believe that things are not as bad as they look and have us come to that conclusion for ourselves. They should also get some PR people on pay; they probably need them more than the added security.
  - jacquesm 17y ago
    But technically speaking it really isn't a big deal, if you take any one of your own credit cards, extract the 'bin' and generate the rest of the numbers to be valid (http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm) you can make credit card numbers until you drop, with a high probability that they are currently in service (if your number is active, so are a lot of other numbers in your bin). But those numbers alone will not allow you to do anything.
axod 17y ago
* Someone finds a small isolated mistake, assumes the absolute worst * Rumor, misunderstanding, exaggeration, sensationalism * Opinion, how could they be so stupid, it's *so* simple! * Over-reactionary moralistic boycots start "Well I for one won't stand for this, who's with me!" * One-upmanship starts "Well I for one want the CEO to apologise" "I think the only decent thing is for them to cease trading". "Lets start an anti-<company> website!". This is war. * Sheep all join in and circlejerk for a while. * News that the original premise was in fact wildly exaggerated or just plain incorrect, gets lost in all the noise. Sadly it's the way of the internet... Just look at most posts on Reddit these days... Just a shame it seems to have come to HN.
- icey 17y ago
  Really??? I'm not really sure what you're referring to. I haven't assumed anything, publishing credit card numbers is about the worst thing you can do when dealing with people's financial credentials. Maybe you don't think it's a big deal, but I'm sure you're not one of the people who's card information was being plastered on the internet. Additionally, I don't think I was being sensationalist - when this posting first went up there was no apology, just a long explanation of why this wasn't a big deal. I wasn't being moralistic, made no demands, nor did I exaggerate anything. I've been here just as long as you have (longer, actually; but who's counting, right?) so you can save the reddit comments.
  - axod 17y ago
    Did you read their response? They published the "DESCRIPTION". They did not know that sometimes banks put full credit card numbers in that field. Personally, I'd be angry at the banks for doing something so stupid. Do you think your bank should ever give out your credit card number in such a stupid way? >> "publishing credit card numbers is about the worst thing you can do when dealing with people's financial credentials." True enough. But that's not the full story of what happened. They published the transactions description as given to them by the bank. FWIW, I have never used their service, and have no ulterior motive to defend them. I just hate over-reactionary mob mentality at work.

Wow, I would have thought they would have at least made a motion to apologize. Instead they've basically said "hey, this isn't a big deal, stop complaining".

by icey 17y ago

Wow, I would have thought they would have at least made a motion to apologize. Instead they've basically said "hey, this isn't a big deal, stop complaining".

scdlbx 17y ago

"While we take this very seriously and it is a headache for those involved (to whom we apologize and are contacting)"

icey 17y ago
They changed their post. I specifically searched for the words "sorry" and "apologize" / "apol" before commenting.

nathanb 17y ago

Seems like they apologized to the four users involved. I don't know that they owe the public in general an apology. They basically explained why this is less scary than the headlines (including the one here on HN) makes it look and said that they were committed to keeping this from happening again, including giving examples of steps they were going to take. What would you have liked to see from them? Prostrating themselves before you for revealing someone else's credit card data?

whiskeyjack 17y ago
I would have liked to have seen "a lot less bad that it looks" replaces with "one would have been too many" and "we will work very hard to regain your trust". It's okay... but the public is their target audience! Simple phrases, big impact.
jmathai 17y ago
Leaking 4 of thousands of credit card number IS a huge deal. It's a disservice to their users (even the ones who weren't affected) for them to downplay it.
- bh3 17y ago
  I'm personally getting the feeling that downplaying it was more of a trip up on their part. They wake up, find they are suddenly being viewed as the devil, and for some strange reason want people to believe that things are not as bad as they look. The problem, though, is they should never have said that directly. They should have given us every reason to believe that things are not as bad as they look and have us come to that conclusion for ourselves. They should also get some PR people on pay; they probably need them more than the added security.
- jacquesm 17y ago
  But technically speaking it really isn't a big deal, if you take any one of your own credit cards, extract the 'bin' and generate the rest of the numbers to be valid (http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm) you can make credit card numbers until you drop, with a high probability that they are currently in service (if your number is active, so are a lot of other numbers in your bin). But those numbers alone will not allow you to do anything.

axod 17y ago

* Someone finds a small isolated mistake, assumes the absolute worst * Rumor, misunderstanding, exaggeration, sensationalism * Opinion, how could they be so stupid, it's *so* simple! * Over-reactionary moralistic boycots start "Well I for one won't stand for this, who's with me!" * One-upmanship starts "Well I for one want the CEO to apologise" "I think the only decent thing is for them to cease trading". "Lets start an anti-<company> website!". This is war. * Sheep all join in and circlejerk for a while. * News that the original premise was in fact wildly exaggerated or just plain incorrect, gets lost in all the noise. Sadly it's the way of the internet... Just look at most posts on Reddit these days... Just a shame it seems to have come to HN.

icey 17y ago
Really??? I'm not really sure what you're referring to. I haven't assumed anything, publishing credit card numbers is about the worst thing you can do when dealing with people's financial credentials. Maybe you don't think it's a big deal, but I'm sure you're not one of the people who's card information was being plastered on the internet. Additionally, I don't think I was being sensationalist - when this posting first went up there was no apology, just a long explanation of why this wasn't a big deal. I wasn't being moralistic, made no demands, nor did I exaggerate anything. I've been here just as long as you have (longer, actually; but who's counting, right?) so you can save the reddit comments.
- axod 17y ago
  Did you read their response? They published the "DESCRIPTION". They did not know that sometimes banks put full credit card numbers in that field. Personally, I'd be angry at the banks for doing something so stupid. Do you think your bank should ever give out your credit card number in such a stupid way? >> "publishing credit card numbers is about the worst thing you can do when dealing with people's financial credentials." True enough. But that's not the full story of what happened. They published the transactions description as given to them by the bank. FWIW, I have never used their service, and have no ulterior motive to defend them. I just hate over-reactionary mob mentality at work.