10 ms·
Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards
- mrb 9y agoEdit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become? Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach. ¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.
- QAPereo 9y agoIf someone else uses my cc, I’m not paying it. If someone steals my bitcoins, they’re fucking GONE.
- deleted 9y ago[deleted]
- mrb 9y agoWrong. In the US you may be liable for the full amount stolen if you fail to notice the theft in 30 days. Even if you report the theft promptly, the law allows your issuer to make you liable for the first $50. Also you completely ignored my point about hardware wallets making theft a non-problem.
- QAPereo 9y agoSure, so don’t ignore your finances for a month.
- mrb 9y agoYou will still be liable for $50. And you again ignored my point about hardware wallets making theft a non-problem.
- deleted 9y ago[deleted]
- QAPereo 9y agoActually it can still be stolen, but like an impenetrable safe full of money, of no use to the thief. You’d still be screwed though!
- mrb 9y agoNot screwed, because a hw wallet can easily be backed up by writing down the 12/24-word seed in a safe/hidden spot. Our discussion thread demonstrates that more education is needed around hardware wallets, as most people have no idea how they work or even that they exist.
- dungle6 9y agoI know how they work and that they exist. However, I use cash as little as possible, and really don't need a cash substitute. The few times I use cash it is for small consumable purchases and things paid with a few quarters. No need for the waiting for a bitcoin transaction to clear. There are people that prefer cash. Of those people, a large portion of them are old or luddites/anti-tech (I actually don't mean this pejoratively as I sympathize with this view), but these people probably won't be too keen on Bitcoin as a replacement. The other portion are those seemingly like yourself that are all embracing of alternative payment methods or basically e-gold. That's great, but you are a niche bunch and I assume a pretty self-selected group. The mainstream wants convenient credit with decent consumer protections for the many advantages it brings to their boring, mainstream life. This is not ignorance. My credit cards give me extended warranties, travel protection. I just got a courtesy credit for a purchase well outside the return window, and I just was reimbursed a few hundred bucks for a computer that failed out of warranty. Meanwhile, I have had to call the credit card company once in 5 years for an unauthorized $200 charge. And no, I was not liable for a penny of it. I don't know where you keep getting off on this $50 stuff, but it's complete nonsense. No one ever pays $50 in practice. And most cards the window is 90 days for a dispute.
- 9y ago
- simlevesque 9y agoCan't you steal a hardware wallet ?
- mrb 9y agoThey are typically PIN-protected. And you can back them up by writing the 12/24-word seed in a safe/hidden spot.
- castis 9y ago> the law allows your issuer to make you liable for the first $50 This has never happened to me, and ive had a CC compromised a few times. If someone steals your hardware wallet, what do you consider that?
- mrb 9y agoPhysically stealing a hardware wallet is typically not usefull because they are PIN-protected. And you can back them up by writing the 12/24-word seed in a safe/hidden spot.
- dungle6 9y agoHardware wallets Do not prevent you from voluntarily giving up your money to thiefs. Social engineering doesn't go away. There are still plenty of ways to steal money from someone, whatever the form. I could always just rubberhose your wallet, is it immune to that? This is a problem with credit cards, but there is a great recourse for it. 2) No credit card I use today (and I use lots for rewards) has any term less than 90 days for dispute. Also all 3 major credit card companies offer $0 liability as part of their terms.
- craftyguy 9y agoPretty much this. Bitcoins are like carrying around cash. Most folks will not argue that you own it, since it's in your pocket, but if someone picks your pocket in a crown then there's no way you're getting it back.
- koiz 9y agoNo they aren't. When did cash get 2 factor auth?
- craftyguy 9y ago2FA is not inherently part of bitcoin's design. It's something that can be enabled, but not all implement it.
- koiz 9y agoSo I ask again... Where's Cash's 2 factor auth. All of the major wallets/traders use 2FA and all the hardware wallets have it too. It's like saying... Well there's safes and banks for cash but its something that not everyone "enables" but you and I both know they use it.
- losteric 9y agoWhen has 2fa stop a bullet or knife? Very little cash is stolen by pick-pockets or home burglars. People open their wallets because they fear pain, it doesn't matter how many locks are on the wallet. relevant xkcd: https://xkcd.com/538/ https://xkcd.com/538/
- koiz 9y agoIf someone steals my wallet with my cash, its GONE.
- deleted 9y ago[deleted]
- topleveldomain 9y agoBut if someone steals your credit card and buys $10,000 worth of stuff, you're probably getting that money back.
- TallGuyShort 9y agoSounds more like an argument against cash, than an argument for Bitcoin...
- koiz 9y agoCredit Cards can co-exist with bitcoin, while btc solves some CC issues its target replacement is still cash.
- drzaiusapelord 9y agoSo does using a chip reader. Assuming its up to current standards the card's information is cryptographically locked to Sonic's vendor ID and any stolen stored CC info could only be used at other Sonics. Chip + Pin solves it even better by forcing the attacker to learn the pin for the card. We're not there yet in the US but once everyone has modern chip readers, adding pins will be trivial. Also as a customer I'm not liable for these issues. The vendor is. With cryptocurrency, if there's a hack against me and my coins are gone, well, they're gone forever. Sure beats giving up on cc's entirely for cryptocurrency, which comes with its own headaches and problems, especially Bitcoin which as a network wouldnt be able to cover 1 hour of credit transactions in the states.
- peterwwillis 9y agoThe US will not be getting PINs for cards. It would put liability on the bank rather than the merchant. And it only affects cloned card fraud, it doesn't affect online transactions. As far as banks are concerned, the chip itself provides enough protection, and they have no interest in helping reduce merchant losses.
- amenghra 9y ago> cryptographically locked to Sonic's vendor ID and any stolen stored CC info could only be used at other Sonics. That's not how chip cards work.
- losteric 9y agoBitcoin is more analogous to gold bricks or cash, not credit cards. Credit cards are built on underlying currencies, offering easy short-term debt and a simpler payment process (compared to check/cash)... I expect that bitcoin credit cards are another prerequisite for consumer adoption.
- cm2187 9y agoYeah, if I keep my credit card in a safe and never use it, no fraud is going to happen. If I use it to pay for things multiple times a day, this happens. It's not like if there hasn't been bitcoins stolen in the past.
- mrb 9y ago100% of the bitcoin thefts up to this day could have been avoided if people had used hardware wallets. I'm serious when I said hw wallets make theft a non-problem.
- ryebit 9y agoBitcoins can only be transferred if you approve it with your private key; which the other party never sees. You can go lock the bitcoin private key up again, and not worry someone is going take more coins while you're sleeping. All that you have to trust is that the device storing your private key (hardware wallet, phone, whatever) isn't compromised. This also roughly applies to chip-and-pin systems, where the chip holds the private key. They're both like cash in a wallet -- giving someone cash from your wallet doesn't give them the ability to magically disappear more money while your wallet's sitting beside your bed later that night. Whereas with a (non-chip) credit card, once another party has your information just once, a theft can happen anytime from then until years later when the CC expires.
- viraptor 9y agoIt sure can happen: breach at the bank, predictable patterns used, intercepted mail. I'm sure there are more situations I haven't thought of.
- chrisco255 9y agoAgreed. Credit card nums, social security, etc all suffer from the lack of private keys and signed transactions.
- jff 9y agoYou're getting downvoted because everyone hates when Bitcoin idiots force it into every damn conversation.
- mrb 9y agoI would have never guessed I was downvoted because "Bitcoin is mentioned too often"… I need to point out that your comment ("idiots") is against HN guidelines ("be civil"): https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dungle6 9y agoTo your edit: Saying bitcoin solves credit card theft for good is like saying gold bars or even just cash solves credit card theft for good. News flash buddy, bitcoin is not a credit system. So it really doesn't solve shit. HN has become a shit show thanks to poorly thought out comments like yours and then the subsequent whinging. Even forgetting the whole, how do I pay with credit issue. Your post is not terribly insightful, and the facts are thin. It removes particular problems with credit cards and replaces them with others. It doesn't solve theft where you end up (through trickery or otherwise) effectively voluntarily sending your money to a thief, because Bitcoin does not give you any way to reverse charges. It just changes the small details of theft attacks on consumer spending, it doesn't fix a god damn thing. How does bitcoin solve credit? Last I checked, bitcoin isn't a credit platform.. So even if you want to use bitcoin... you still need a credit card. In the US, I am basically not fully liable for any credit payment I make for 90 days. I can dispute any charge for that time and it is on the onus of the bank to do something about it or not get their money. The incentives in this case are very pro-consumer.
- abalone 9y agoYour digital wallet gives up consumer protections such as chargebacks which is a regression in consumer benefits. It is also accepted approximately nowhere, with very little incentive for merchants to add support. Apple Pay and related solutions offer "tamper proof isolation of private keys" while still offering all of the consumer protections of cards, plus broad and growing acceptance via compatibility with standard contactless card terminals and POS systems.
- mrb 9y ago«gives up consumer protections such as chargebacks» True. On the flip side, most merchants are honest so chargebacks are rarely needed. It's a different tradeoff: credit cards open you to ID theft, which is a lot more prevalent than the need for a chargeback, so personally I prefer Bitcoin. «accepted approximately nowhere» Any new technology, such as Bitcoin or Apple Pay, has to start from zero. So it is an irrelevant argument anyway. Today Bitcoin is in fact accepted at about 160,000 merchants. «very little incentive for merchants to add support» Not true. The biggest, and arguably most important, incentive for merchants to accept Bitcoin is that it allows them to avoid chargeback fraud (payments are irreversible.) Apple Pay & similar technologies are a huge step up from plain credit/debit cards. Really, it's important to recognize this. But they still have multiple drawbacks. For example, (1) it has transaction limits, (2) it isn't usable for person-to-person payments (eg. paying back lunch money to a coworker), (3) purchases are still subject to authorization so in a way you don't have 100% control of your own money (eg. the system could accidentally flag the transaction as fraudulent and prevent you from buying something.)
- stordoff 9y ago> On the flip side, most merchants are honest so chargebacks are rarely needed. You also lose the convenience factor of that I don't need to care if a merchant is honest. If it's a merchant I haven't heard of it, I can just make the order without worrying too much (providing there are no obvious red flags) as there's very little risk. On the other hand, Bitcoin's irreversibly would mean I'd have to look into the company before ordering, and I'd probably avoid smaller merchants as a result. > it allows them to avoid chargeback fraud (payments are irreversible.) How big of an issue is this in practice? My gut reaction is most customers are honest so it's not big enough incentive to add another payment flow, but I've got no idea if that is accurate or not.
- deleted 9y ago[deleted]
- tzs 9y ago> Say what you want about Bitcoin, but it does solve credit card theft for good Bitcoin is very similar to cash in many respects, especially when compared to credit cards. I doubt anyone would say this: > Say what you want about cash, but it does solve credit card theft for good. If I could use my cash wallet to pay Sonic, I wouldn't be affected by this security breach It's obviously true, but it's also trivial and pointless. Saying Bitcoin instead of cash doesn't change any of that.
- b3lvedere 9y agoYou can't have 'free money' in Bitcoin in the same way a lot of people (ab)use their credit cards.
- TheGRS 9y agoMaybe I'm a little ignorant on how/why companies store this sort of info. Someone at work informed me that Target storing CC numbers at least made sense when you needed to make a return. But at a Sonic Drive-In? I'm not returning my burger+shake combo. What is possessing Sonic to keep the number any longer than the period it takes to receive money from the CC company? And why is this period any longer than the 20 or so seconds it takes to process the card at a machine? Are all of these magnetic-only or do they store CC numbers with chip cards as well?
- peterwwillis 9y ago> What is possessing Sonic to keep the number They don't. From the article: "Malicious hackers typically steal credit card data from organizations that accept cards by hacking into point-of-sale systems remotely and seeding those systems with malicious software that can copy account data stored on a card’s magnetic stripe. Thieves can use that data to clone the cards and then use the counterfeits to buy high-priced merchandise from electronics stores and big box retailers." "The last known major card breach involving a large nationwide fast-food chain impacted more than a thousand Wendy’s locations and persisted for almost nine months after it was first disclosed here. The Wendy’s breach was extremely costly for card-issuing banks and credit unions, which were forced to continuously re-issue customer cards that kept getting re-compromised every time their customers went back to eat at another Wendy’s." That provides an interesting lesson for vendors doing CC transactions: card compromise does not impact repeat business, so don't worry about breaches.
- wavefunction 9y agoThat's assuming the consumers were informed about the source of the compromise.
- bagels 9y agoTo this point, my bank replaced my card due to a breach that they refused to disclose to me. I'd like to know the source so I can avoid shopping there, but cannot.
- DarkTree 9y agoSo I'm pretty ignorant to the history of personal identity/credit breaches, but for those who aren't, is this only getting to get worse? More and more companies are holding more and more data, to the point that these breaches seem to affect so many people. I entered the credit card game pretty recently, and almost immediately I'm affected by the Equifax breach. As a young person, this doesn't make the future of privacy/security seem so promising.
- cm2187 9y agoSomeone should plot them to get an idea of how worse things are getting but it feels like we had one major data breach nearly every week for about 3 years now.
- joe_the_user 9y agoAs it says in the article, this should get better once chips become standard. At that point, the chip will be doing something like an encrypted transaction with the bank, so listening in on any stage of the transaction shouldn't matter (not that I have any details on the process).
- losteric 9y agoThe news looks bad, but reality is worse. Remember that huge trove of NSA hacking tools and exploits that dumped last year? And the numerous follow-up dumps? There are LOTS of new weapons in the hands of everyone from everyday script kiddies to organized crime to enemy nations. It's possible Equifax was the only credit agency with enough information to require public disclosure... if Transunion doesn't have the right logs or monitors, they may never find out they've been breached, and nor will we. At this point, I assume everything on a computer can become public.
- noir_lord 9y agoI've operated under the assumption that anything that leaves my computer will eventually become public since the 90's. One of the few times I don't enjoy been right, I'm fortunate in that I'm vanilla, FSM help people under repressive regimes or who hold opinions that worry those in authority wherever they are. We managed to combine a panopticon with a Skinner box somehow and people like it because it's shiny.
- abalone 9y agoI'm surprised Krebs end up plugging chip-and-PIN instead of the current leapfrog technology exemplified by Apple Pay. I feel there is not enough awareness of just how much more secure this is. A huge advantage of Apply Pay is that you get the security of a PIN without the hassle of entering a PIN -- or the risk of it being stolen during PIN entry. You just authenticate with your fingerprint or, soon, your face. (Please no comments speculating that this is less secure than a fingerprint. It's premature to say and unless you know something Apple doesn't, you're probably wrong.) Another less understood advantage is that Apple Pay takes the strongest approach to tokenization, which makes it effectively immune to merchant hardware compromises. Even chip cards rely on the card readers at points of sale to handle tokenization, so a hacked reader could in theory leak PANs. On top of that, lots of merchants/processors don't even bother with tokenization, so it's a crap shoot with every merchant. Apple Pay tokenizes when you enroll your card, so the PAN (primary account number) never passes through any merchant systems anywhere ever. This means the tokenized numbers that hackers could steal from merchants are useless outside of two-factor-secured Apple Pay.
- Steko 9y ago> without the hassle of entering a PIN You're right except when your bank is a bunch of consumer hostile idiots that still make you enter the PIN.
- xur17 9y agoWhich bank is that?
- knz 9y ago> A huge advantage of Apply Pay is ... without the hassle of entering a PIN You are forgetting that tools like Apple Pay are not hassle free for most people, especially those outside of IT circles. Millions of people struggle to use anything beyond basic technology (American banks have even decided that PIN's are too confusing! A four digit number that has been common in the rest of the world for decades!). Combine that with other factors like fears of being caught with a flat battery or businesses that are reluctant to spend money on new POS devices - it's unlikely that plastic cards are going away anytime soon. Also, I'm not sure entering a PIN is really any more hassle than using a phone as a payment device (I use Android Pay whenever I can due to the added security features but the POS readers are often incredibly slow).
- perseusprime11 9y agoCan we all now move to Bitcoin? We have enough evidence with all the breaches so far. This is not going to stop anytime soon.
- stordoff 9y agoDoes that actually help all that much? I doubt most people know how to, or want to, keep their keys secure enough, so you'd likely end up with them being managed by central services anyway.
- perseusprime11 9y agoI sense an opportunity here for someone to figure out better UX when it comes to managing keys. A lot of folks do dabble and use 1password or lastpass, etc.
- nsxwolf 9y agoMillions of people eat at Sonic?!