5 ms·

A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at

by wlkr 10y ago

A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at various apps, JustEat, Domino's and the like. Domino's were written off instantly when we discovered we couldn't use a third party service like PayPal. If major tech companies can't manage their security properly I have little faith in Fast Food outlets investing in getting it right. I know they don't think they have been breached, and this may well be the case, but do they really need to be storing sensitive data at all? Edit: turns out you can use PayPal (see below), ignore me I'm wrong!

Tomdarkness 10y ago
You've been able to pay for Dominos in the UK via PayPal for years now.
- jackvalentine 10y ago
  Ditto Australia.
- wlkr 10y ago
  Hmm, thanks! I'm not sure why we couldn't figure that out. I can't remember if we were using the app or the website, I just know we were using mobiles.
  - kryptonic 10y ago
    Hm, I can't remember exactly what the condition is, but I know there is a situation in which they won't except PayPal because it's happened to me before. I think that might be if your order is under £10, or if you're collecting or something like that.
Natsu 10y ago
That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.
- jrockway 10y ago
  Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.
  - pbhjpbhj 10y ago
    Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
  - Natsu 10y ago
    Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.
wyager 10y ago
Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable. Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two. The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.
- mulmen 10y ago
  This happens to me at least once a year but I still consider it a huge inconvenience. Two days is an eternity, especially to be without my primary card. I don't wait that long for socks from Amazon. One day is generally my expectation at this point and for a lot of things it's same day. I'd really like to see banks/card companies step up their game in getting new cards out to people.
  - lucaspiller 10y ago
    Talking about the time it takes to get something, passports in the U.K. are ridiculous. I had mine stolen a few years ago while abroad, and had to get a replacement from my embassy. They gave me a one-time-use 'emergency passport', which looks basically the same as a normal passport except it's smaller and I guess doesn't have biometric features - inside it looks the same. It took them a total of 1 hour to make it. When I came home I needed a new one as I was supposed to be moving abroad a couple of weeks later. The earliest appointment (which is supposedly faster than doing it by post) they could give me was after 1 month, and after that I still had to wait a week for it to arrive. My wife is from Lithuania (EU country) and when we got married she went to the passport office (just walk in and wait) and got a new passport the next day.
- wlkr 10y ago
  None of us (students) had credit cards and we frequently used PayPal to cover the scenarios you mentioned. As a group it just became easy to all use the one app for requesting/sending smaller amounts of money. You can do it through a phone number which makes it quite simple even if it's not the best way.
rudedogg 10y ago
I think just like a year or two ago PayPal wouldn't let me use a good generated password due to it being too long. Edit: Just checked and the limit is still 20 characters :\

by wlkr 10y ago

Tomdarkness 10y ago

You've been able to pay for Dominos in the UK via PayPal for years now.

jackvalentine 10y ago
Ditto Australia.
wlkr 10y ago
Hmm, thanks! I'm not sure why we couldn't figure that out. I can't remember if we were using the app or the website, I just know we were using mobiles.
- kryptonic 10y ago
  Hm, I can't remember exactly what the condition is, but I know there is a situation in which they won't except PayPal because it's happened to me before. I think that might be if your order is under £10, or if you're collecting or something like that.

Natsu 10y ago

That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.

jrockway 10y ago
Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.
- pbhjpbhj 10y ago
  Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
- Natsu 10y ago
  Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.

wyager 10y ago

Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable. Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two. The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.

mulmen 10y ago
This happens to me at least once a year but I still consider it a huge inconvenience. Two days is an eternity, especially to be without my primary card. I don't wait that long for socks from Amazon. One day is generally my expectation at this point and for a lot of things it's same day. I'd really like to see banks/card companies step up their game in getting new cards out to people.
- lucaspiller 10y ago
  Talking about the time it takes to get something, passports in the U.K. are ridiculous. I had mine stolen a few years ago while abroad, and had to get a replacement from my embassy. They gave me a one-time-use 'emergency passport', which looks basically the same as a normal passport except it's smaller and I guess doesn't have biometric features - inside it looks the same. It took them a total of 1 hour to make it. When I came home I needed a new one as I was supposed to be moving abroad a couple of weeks later. The earliest appointment (which is supposedly faster than doing it by post) they could give me was after 1 month, and after that I still had to wait a week for it to arrive. My wife is from Lithuania (EU country) and when we got married she went to the passport office (just walk in and wait) and got a new passport the next day.
wlkr 10y ago
None of us (students) had credit cards and we frequently used PayPal to cover the scenarios you mentioned. As a group it just became easy to all use the one app for requesting/sending smaller amounts of money. You can do it through a phone number which makes it quite simple even if it's not the best way.

rudedogg 10y ago

I think just like a year or two ago PayPal wouldn't let me use a good generated password due to it being too long. Edit: Just checked and the limit is still 20 characters :\