3 ms·

This is... the opposite of my impression, well, sortof. There aren't penalties for the business your credit card is stolen from (and I believe your credit card

by lsc 9y ago

This is... the opposite of my impression, well, sortof. There aren't penalties for the business your credit card is stolen from (and I believe your credit card is usually stolen from a business you legitimately did business with.) However, the thief? once they get that credit card? they use it with a merchant to buy a thing. For example, last time my card was stolen, I saw a charge for some expensive jewelry from a Florida jeweler on my account. I called my credit card company and they refunded the money to my account... so who is left holding the bag? that jewler in Florda. When I had a merchant account (selling VPSs) I had a few customers like that; the credit card company simply takes the money back, and it's up to you, the merchant, to try to get back what you just sold to the customer... something that is usually impossible.

x0x0 9y ago
I meant there's very little penalty to the business that allowed the theft to occur, so I can't see what we disagree about? Oh, nm, you meant that businesses that unknowingly accept stolen cards get screwed. They certainly do. But imagine a business had to write a $50 check to each and every cardholder whose card they leaked. I bet there would be a miracle, and systems would become securable.
- lsc 9y ago
  I agree that if there were more consequences for compromised businesses, there would be fewer compromises... but it would also massively raise the barrier to getting a merchant account. Essentially, you'd live in a world where everyone used paypal or something like it. (I think apple pay would be in the running, too, but I think this might end up being natural-monopoly-ish) The best way to solve the problem, I think, is to quit using shared secrets across minimally trusted parties. Public key cryptography is... I'm not going to say unbreakable, but it's pretty good. it's fairly secure. We need to enforce that on all physical card readers, which will make 'skimming' rather a lot more difficult, and then after that we need to figure out a card reader users can use on their computers and cellphones. The technology is mostly there; most of my cellphones support some kind of secure wireless public key stuff, and most of my phones do too. We need to make this ecosystem work well, solve the software problems, and then make it so that your credit card number is just an identifier, not an authentication token.
  - x0x0 9y ago
    That sounds pretty much like apple pay, no? If visa, mastercard, and the merchant banks can't be bothered to make it, then maybe apple deserves their cut.
    - lsc 9y ago
      Yes, apple pay, I think, occupies a similar place to paypal I have run a business that recieved payments through paypal; I have not run a business that recieved payments through apple pay, but my impression is that they both do the same thing... they let a business accept payments without knowing the user's credit card number, which would be essential to businesses if there was significant liability associated with credit card breaches.

by lsc 9y ago

x0x0 9y ago

I meant there's very little penalty to the business that allowed the theft to occur, so I can't see what we disagree about? Oh, nm, you meant that businesses that unknowingly accept stolen cards get screwed. They certainly do. But imagine a business had to write a $50 check to each and every cardholder whose card they leaked. I bet there would be a miracle, and systems would become securable.

lsc 9y ago
I agree that if there were more consequences for compromised businesses, there would be fewer compromises... but it would also massively raise the barrier to getting a merchant account. Essentially, you'd live in a world where everyone used paypal or something like it. (I think apple pay would be in the running, too, but I think this might end up being natural-monopoly-ish) The best way to solve the problem, I think, is to quit using shared secrets across minimally trusted parties. Public key cryptography is... I'm not going to say unbreakable, but it's pretty good. it's fairly secure. We need to enforce that on all physical card readers, which will make 'skimming' rather a lot more difficult, and then after that we need to figure out a card reader users can use on their computers and cellphones. The technology is mostly there; most of my cellphones support some kind of secure wireless public key stuff, and most of my phones do too. We need to make this ecosystem work well, solve the software problems, and then make it so that your credit card number is just an identifier, not an authentication token.
- x0x0 9y ago
  That sounds pretty much like apple pay, no? If visa, mastercard, and the merchant banks can't be bothered to make it, then maybe apple deserves their cut.
  - lsc 9y ago
    Yes, apple pay, I think, occupies a similar place to paypal I have run a business that recieved payments through paypal; I have not run a business that recieved payments through apple pay, but my impression is that they both do the same thing... they let a business accept payments without knowing the user's credit card number, which would be essential to businesses if there was significant liability associated with credit card breaches.