4 ms·

That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a

by Natsu 10y ago

That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.

jrockway 10y ago
Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.
- pbhjpbhj 10y ago
  Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
- Natsu 10y ago
  Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.

by Natsu 10y ago

jrockway 10y ago

Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.

pbhjpbhj 10y ago
Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money. They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone. tl;dr that probably hides a big financial risk [for the poor].
Natsu 10y ago
Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.