4 ms·
Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card proce
by coldcode 10y ago
Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.
- Zyst 10y agoThat frankly sounds like a strong security argument to use MasterCard over Visa. But more research on how MasterCard would handle a similar attack might be necessary.
- Freestyler_3 10y agoI remember seeing the VISA security centre, where they monitor threats etc. It was a huge high tech facility. I would think that they flag if a card is attempted a lot of times in short time span.
- tyingq 10y agoApparently, VISA does not do this. The actual research paper is online: http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC-BDB3-73C22D6E1FDB.pdf http://eprint.ncl.ac.uk/file_store/production/230123/1918024... It says this: "Whereas MasterCard’s centralised network detects the guessing attack after fewer than 10 attempts (even when those attempts were distributed across multiple websites), Visa’s payment ecosystem does not prevent the attack"
- digler999 10y agoAs another poster said, you don't run one card 1000 times. You run 100 cards 10 times and achieve almost the same probability of guessing one without burning the card. On another note, I wish they'd get rid of the number + exp + cvv. Quit concatenating more codes and just go to an alpha numeric model. You could have fewer digits and a bigger probability space. Even when you remove certain letters that sound alike.