3 ms·
Why would just reading a CC number and expiration date not bother you? (on lots of cards they are just plain-text for anyone who asks)
by tjoff 8y ago
Why would just reading a CC number and expiration date not bother you? (on lots of cards they are just plain-text for anyone who asks)
- rocqua 8y agoBecause I use a (Dutch) debit card. This is not a Credit Card, so it does not have a real card number (it has a 4-digit number to identify it among potential other cards issued for my account). I just checked, and was surprised to see it had an expiration date, because that does not play any role in authentication. Note that I am coming at this from the perspective "Is payment in my country done well". So I only care about attacks against my card, and the cards of people I know. It does seem stupid to me to have a CC number and expiration date available in plain text. But honestly, I am more amazed by that information being sufficient to authorize payment. That said, it amazes that 'upgrades' both neglect to fix the underlying issue, and fail to take it into account in their implementation. Besides this entire story, there is an interesting issue of PIN-less tap-and-pay, which scares me more (from the dutch perspective) than plaintext data on my NFC card. It doesn't scare me enough to disable it though.
- tjoff 8y agoHow do you purchase something on international sites? I totally agree that the requirements to authorize a transaction is laughable. Even more so that the information is printed on the card itself, insane.
- rocqua 8y agoI use paypal when possible. Otherwise, I have a separate, rarely used, credit card. The card has no NFC. Notably, every time I've used it on-line, it forwarded me to my banks website, where I needed to do a 2 factor thing. I'd guess that is vendor-dependent though. I can't imagine US webshops are setup for that. (Most of my usage is amazon.de)