3 ms·

http://time.com/5230288/delta-sears-data-breach-credit-cards/ http://time.com/5230288/delta-sears-data-breach-credit-cards... "Hackers may have accessed names,

http://time.com/5230288/delta-sears-data-breach-credit-cards/ http://time.com/5230288/delta-sears-data-breach-credit-cards... "Hackers may have accessed names, addresses, credit card numbers, CVV numbers and expiration dates for “several hundred thousand” customers during that time, according to the airline." You're 100% not allowed to save CVVs. I really hope this is just bad reporting and not true. In fact, I think you're even supposed to scrub CVVs from call center recordings!

dx034 9y ago
I recently had to give my CVV to a call centre and they paused recording for that part. Probably more reliable than trying to scrub it afterwards.
jimktrains2 9y ago
Edit: It appears it might be an issue with 3rd party JS on their website, not being stored.
craftyguy 9y ago
Why are CVVs, a 3 digit number that would be trivial to brute force, the key to unlocking access to a user's credit? Why don't we start with that problem first?
- mrguyorama 9y ago
  AFAIU, you cannot check whether a CVV is correct without pinging the company that manages the card, and attempting to ping them on average 500 times per card with different CVVs is not normal activity and should be blocked/shut down. This is CC fraud prevention 101
  - craftyguy 9y ago
    Ok, how about the fact that it's incredibly visible to begin with? It's being used like a PIN, a PIN that's literally printed right on the card. Who writes their debit card PIN on the back of their card?
    - dragonwriter 9y ago
      It supposed to be used as proof that you have physical control of the card, which is why it is on the card and not supposed to be stored. It's not used “like a PIN” as a second factor with the physical card as the first factor, it is used to make online and certain other uses of a card equivalent to card-present transactions with no substantive second factor.

dx034 9y ago

I recently had to give my CVV to a call centre and they paused recording for that part. Probably more reliable than trying to scrub it afterwards.

jimktrains2 9y ago

Edit: It appears it might be an issue with 3rd party JS on their website, not being stored.

craftyguy 9y ago

Why are CVVs, a 3 digit number that would be trivial to brute force, the key to unlocking access to a user's credit? Why don't we start with that problem first?

mrguyorama 9y ago
AFAIU, you cannot check whether a CVV is correct without pinging the company that manages the card, and attempting to ping them on average 500 times per card with different CVVs is not normal activity and should be blocked/shut down. This is CC fraud prevention 101
- craftyguy 9y ago
  Ok, how about the fact that it's incredibly visible to begin with? It's being used like a PIN, a PIN that's literally printed right on the card. Who writes their debit card PIN on the back of their card?
  - dragonwriter 9y ago
    It supposed to be used as proof that you have physical control of the card, which is why it is on the card and not supposed to be stored. It's not used “like a PIN” as a second factor with the physical card as the first factor, it is used to make online and certain other uses of a card equivalent to card-present transactions with no substantive second factor.