3 ms·

It said some records also included encrypted payment card information, but it could not rule out the possibility that the encryption keys had also been

by TekMol 8y ago

It said some records also included encrypted payment card information, but it could not rule out the possibility that the encryption keys had also been stolen. Why did the world end up with a pull-system for payments? Why do I have to give out my credit card number and enable the other side to pull arbitrary amounts as often as they like? This is one of several things crypto currencies got right. You pay by pushing money to the other side.

ryanlol 8y ago
Why do you care if your credit card number is compromised?
- TekMol 8y ago
  Because last time that happened it was a big hassle. I had to: * Do a phone call * Fill out paperwork * Wait for a new card to arrive * Go through all services I use the card for and change it
  - 706f6f70 8y ago
    To whom shall I address the invoice for my time though?
  - maccard 8y ago
    Have to say, last time my card was replaced for fraud, it was easy. Bank noticed it and called me, cancelled my card, sent a new one (had it 2 days later), and I had to update the payment information on a handful of websites/services (amazon, google pay, paypal covered most of my bases). It had the nice side effect of emailing me telling me that pyament for X service had been declined, and made me think twice about renewing it (netflix)
    - TekMol 8y ago
      Sounds we have had similar experiences. But different definitions of 'easy'. Also, what if you had currently been somewhere else around the globe. How would you gotten the new card?
      - airstrike 8y ago
        Amex fedex'd my new card to a different address of my choosing. I would imagine they ship it anywhere you want.
      - maccard 8y ago
        > Also, what if you had currently been somewhere else around the globe. How would you gotten the new card? I guess that may have been a concern, but it wasn't for me. We could come up with any number of scenarios I'm sure, but in reality travelling with a second card covers 99% of the eventualities.
    - 52-6F-62 8y ago
      I had a similarly simple experience. Someone had fraudulently purchased a 23andMe kit on my card (weird, right?) and I only caught it because my account was abnormally low (~250 CAD). I phoned the bank right away and they cancelled the card number, put my account on watch, reversed the charges and I was able to go into the bank and get a new card on the spot. (VISA Debit, not a CC)
    - rconti 8y ago
      * spend the next 6 months updating autopay stuff that for some reason keeps working for 5 months after the card number changes, but then fails in month 6.
  - ryanlol 8y ago
    >* Fill out paperwork Why would you need to fill out paperwork? This seems to strictly be a problem with your financial institution and not with fraud. >* Wait for a new card to arrive I had my card replaced today because of fraud, my current card will work until I activate the new card which was overnighted (internationally, even) and should arrive monday. I don't think that's a big issue. > * Go through all services I use the card for and change it All the services which I have subscriptions with seem to automatically update when I get a new card. If the process of replacing your card is a hassle, your financial institution is fucking you over. It has nothing to do with fraud.
    - mikestew 8y ago
      Why would you need to fill out paperwork? People are answering your trick question, and now you’re being argumentative. Your point has been (poorly) made, time to let it go.
      - ryanlol 8y ago
        I guess we've established that the problem isn't really fraud, but financial institutions deliberately making it difficult for consumers to deal with fraud in an effort to shift blame away from their own insecure payment systems?
  - dudul 8y ago
    That's interesting, I wonder which bank you use that would require a phone call and paperwork when a card is compromised. It happened to my CC a year or so ago, and my wife just went through that with her debit card 2 weeks ago actually. In both cases, the bank actually alerted us about weird transactions, immediately canceled them and asked us to review online. We indicated that they weren't ours, the bank canceled our cards and sent replacements. Now, updating services is indeed a pain. I have a policy of never saving CC information on websites (even though it would make "my shopping more convenient next time" as they say). I do that for safety reason, even though I have close to no illusion that they probably still keep it in their DB even when I decline. So for me it didn't really disturb my workflow when paying bills and all.
- 14 8y ago
  I don't understand your question are you serious? Even if my money is completely protected from fraud, if I have to spend one second dealing with some the problems from such fraud and the stress it could cause I would never want my credit card numbers compromised.
- mikestew 8y ago
  Why are you asking what you think are rhetorical questions? Because the fix is not trouble-free on my end. I assume that you’ve never had the experience if you’re asking.
  - ryanlol 8y ago
    I just had my card replaced today, it took 30 seconds on my part.
    - mikestew 8y ago
      30 seconds? Damn, I guess they finally got teleportation working. Replacing the card and waiting a week wasn’t what I was referring to, and I suspect you know that. But when you have a narrative to double-down on...
      - ryanlol 8y ago
        What's the trouble you were referring to then? Why would you need to wait a week? I've always had my cards shipped overnight with fedex international first or equivalent.
    - jjnoakes 8y ago
      I had mine replaced two months ago. Most of my bills are automatically paid on the card, so I had to update my payment information on ~20 sites. At 2-3 minutes per site (optimistic really), plus the fact that one site requires I fax in the request, means it easily took me over an hour.
Waterluvian 8y ago
I don't think crypto currencies really deserve much credit for this. It kind of already exists. I have authorized bank withdrawals for paying some bills. This is the "pull" and I don't really feel all that comfortable with it. I once had an irritating issue where an no-longer-authorized withdrawal didn't stop properly. But I also have scheduled payments, the "push" method, where my bank account will routinely send a configured amount of money to a configured account/company at a configured interval. I like this because of the control and responsibility it gives me. Something I wish Canadian banks had was a better API for allowing me to say, "instead of paying $x each month, query the bill and pay the exact sum as long as it doesn't exceed $y".
- TekMol 8y ago
  I did not say it was invented by crypto currencies. Banks have not managed to implement a payment process for exommerce yet. You have to log in, fill out a form, do some kind of verification, wait for a day or more... yuck! That's fine for big transfers that only occur rarely. For a quick online payment it sucks. That's why nobody is using it for this use case.
  - Waterluvian 8y ago
    Thanks for clarifying. Sorry about that!
  - Symbiote 8y ago
    Most European countries have near-immediate transfers of "low" amounts (e.g. up to £25,000 for my British account). Several European countries have an easy online payment process built on top of this. Sweden has Swish, Denmark has MobilePay, the UK has created PayM (but with little use so far), Finland and Norway have similar systems. These are mobile apps commonly used for transferring money between friends/colleagues, or paying for things from very small businesses or casual transactions. They can also be used online. There's an example flow with screenshots in the API documentation [1 PDF] for Swish on page 7. After selecting Swish at checkout, a message is sent to the phone app; the user opens it to authorize the transaction. (And to the GP post: the automatic payments systems in Europe come with strong guarantees. The UK one: "If an error is made in the payment of your Direct Debit, by the organisation or your bank or building society, you are entitled to a full and immediate refund of the amount paid from your bank or building society" and "You can cancel a Direct Debit at any time by simply contacting your bank or building society." — the latter is implemented with a "Cancel" button against each authorized company in my online banking.) [1] https://developer.getswish.se/content/uploads/2017/09/Guide-Swish-API-170324-utan-a%CC%88ndringsmarkering.pdf https://developer.getswish.se/content/uploads/2017/09/Guide-...
pjc50 8y ago
The short answer is that credit cards were invented over 40 years ago, to operate in an offline and indeed paper-based system (hence the embossed digits for use in mechanical duplicators). For a more modern system look at contactless. FWIW I think the "one shot push" model of cryptocurrencies has some serious limitations which I think should be addressed by an "invoice" system - e.g. you can easily pay the wrong person, or even an address which doesn't exist and is owned by nobody! Not to mention dumb errors such as swapping the payment and tip fields. It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X", and the payer was simply generating an approval of that.
- TekMol 8y ago
  It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X" Are you talking about offline? Because on a website I would expect the payer to simply copy&paste the address. I would also expect a link type to evolve that browsers understand. Something like "payto:1fs8e...?amount=0.01&coin=btc" to pay 0.01 bitcoin to 1fs8e... Similar to the "mailto:user@host?subject=...&body=..." link type. An when we talk about offline (paying for a restaurant or something) - isn't there a visual link type already? I am not a user of crypto. But I think I have seen barcodes or something used for this.
  - yesbabyyes 8y ago
    Something like the `bitcoin:` URI scheme? bitcoin:1fs8e...?amount=0.01 https://github.com/bitcoin/bips/blob/master/bip-0021.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0021.mediawi...
- r1ch 8y ago
  For Bitcoin, BIP 70 was proposed (and quite widely implemented) to take care of a lot of these issues. I assume many other cash-style cryptocurrencies have something similar these days. https://github.com/bitcoin/bips/blob/master/bip-0070.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0070.mediawi...
- drexlspivey 8y ago

by TekMol 8y ago

ryanlol 8y ago

Why do you care if your credit card number is compromised?

TekMol 8y ago
Because last time that happened it was a big hassle. I had to: * Do a phone call * Fill out paperwork * Wait for a new card to arrive * Go through all services I use the card for and change it
- 706f6f70 8y ago
  To whom shall I address the invoice for my time though?
- maccard 8y ago
  Have to say, last time my card was replaced for fraud, it was easy. Bank noticed it and called me, cancelled my card, sent a new one (had it 2 days later), and I had to update the payment information on a handful of websites/services (amazon, google pay, paypal covered most of my bases). It had the nice side effect of emailing me telling me that pyament for X service had been declined, and made me think twice about renewing it (netflix)
  - TekMol 8y ago
    Sounds we have had similar experiences. But different definitions of 'easy'. Also, what if you had currently been somewhere else around the globe. How would you gotten the new card?
    - airstrike 8y ago
      Amex fedex'd my new card to a different address of my choosing. I would imagine they ship it anywhere you want.
    - maccard 8y ago
      > Also, what if you had currently been somewhere else around the globe. How would you gotten the new card? I guess that may have been a concern, but it wasn't for me. We could come up with any number of scenarios I'm sure, but in reality travelling with a second card covers 99% of the eventualities.
  - 52-6F-62 8y ago
    I had a similarly simple experience. Someone had fraudulently purchased a 23andMe kit on my card (weird, right?) and I only caught it because my account was abnormally low (~250 CAD). I phoned the bank right away and they cancelled the card number, put my account on watch, reversed the charges and I was able to go into the bank and get a new card on the spot. (VISA Debit, not a CC)
  - rconti 8y ago
    * spend the next 6 months updating autopay stuff that for some reason keeps working for 5 months after the card number changes, but then fails in month 6.
- ryanlol 8y ago
  >* Fill out paperwork Why would you need to fill out paperwork? This seems to strictly be a problem with your financial institution and not with fraud. >* Wait for a new card to arrive I had my card replaced today because of fraud, my current card will work until I activate the new card which was overnighted (internationally, even) and should arrive monday. I don't think that's a big issue. > * Go through all services I use the card for and change it All the services which I have subscriptions with seem to automatically update when I get a new card. If the process of replacing your card is a hassle, your financial institution is fucking you over. It has nothing to do with fraud.
  - mikestew 8y ago
    Why would you need to fill out paperwork? People are answering your trick question, and now you’re being argumentative. Your point has been (poorly) made, time to let it go.
    - ryanlol 8y ago
      I guess we've established that the problem isn't really fraud, but financial institutions deliberately making it difficult for consumers to deal with fraud in an effort to shift blame away from their own insecure payment systems?
- dudul 8y ago
  That's interesting, I wonder which bank you use that would require a phone call and paperwork when a card is compromised. It happened to my CC a year or so ago, and my wife just went through that with her debit card 2 weeks ago actually. In both cases, the bank actually alerted us about weird transactions, immediately canceled them and asked us to review online. We indicated that they weren't ours, the bank canceled our cards and sent replacements. Now, updating services is indeed a pain. I have a policy of never saving CC information on websites (even though it would make "my shopping more convenient next time" as they say). I do that for safety reason, even though I have close to no illusion that they probably still keep it in their DB even when I decline. So for me it didn't really disturb my workflow when paying bills and all.
14 8y ago
I don't understand your question are you serious? Even if my money is completely protected from fraud, if I have to spend one second dealing with some the problems from such fraud and the stress it could cause I would never want my credit card numbers compromised.
mikestew 8y ago
Why are you asking what you think are rhetorical questions? Because the fix is not trouble-free on my end. I assume that you’ve never had the experience if you’re asking.
- ryanlol 8y ago
  I just had my card replaced today, it took 30 seconds on my part.
  - mikestew 8y ago
    30 seconds? Damn, I guess they finally got teleportation working. Replacing the card and waiting a week wasn’t what I was referring to, and I suspect you know that. But when you have a narrative to double-down on...
    - ryanlol 8y ago
      What's the trouble you were referring to then? Why would you need to wait a week? I've always had my cards shipped overnight with fedex international first or equivalent.
  - jjnoakes 8y ago
    I had mine replaced two months ago. Most of my bills are automatically paid on the card, so I had to update my payment information on ~20 sites. At 2-3 minutes per site (optimistic really), plus the fact that one site requires I fax in the request, means it easily took me over an hour.

Waterluvian 8y ago

I don't think crypto currencies really deserve much credit for this. It kind of already exists. I have authorized bank withdrawals for paying some bills. This is the "pull" and I don't really feel all that comfortable with it. I once had an irritating issue where an no-longer-authorized withdrawal didn't stop properly. But I also have scheduled payments, the "push" method, where my bank account will routinely send a configured amount of money to a configured account/company at a configured interval. I like this because of the control and responsibility it gives me. Something I wish Canadian banks had was a better API for allowing me to say, "instead of paying $x each month, query the bill and pay the exact sum as long as it doesn't exceed $y".

TekMol 8y ago
I did not say it was invented by crypto currencies. Banks have not managed to implement a payment process for exommerce yet. You have to log in, fill out a form, do some kind of verification, wait for a day or more... yuck! That's fine for big transfers that only occur rarely. For a quick online payment it sucks. That's why nobody is using it for this use case.
- Waterluvian 8y ago
  Thanks for clarifying. Sorry about that!
- Symbiote 8y ago
  Most European countries have near-immediate transfers of "low" amounts (e.g. up to £25,000 for my British account). Several European countries have an easy online payment process built on top of this. Sweden has Swish, Denmark has MobilePay, the UK has created PayM (but with little use so far), Finland and Norway have similar systems. These are mobile apps commonly used for transferring money between friends/colleagues, or paying for things from very small businesses or casual transactions. They can also be used online. There's an example flow with screenshots in the API documentation [1 PDF] for Swish on page 7. After selecting Swish at checkout, a message is sent to the phone app; the user opens it to authorize the transaction. (And to the GP post: the automatic payments systems in Europe come with strong guarantees. The UK one: "If an error is made in the payment of your Direct Debit, by the organisation or your bank or building society, you are entitled to a full and immediate refund of the amount paid from your bank or building society" and "You can cancel a Direct Debit at any time by simply contacting your bank or building society." — the latter is implemented with a "Cancel" button against each authorized company in my online banking.) [1] https://developer.getswish.se/content/uploads/2017/09/Guide-Swish-API-170324-utan-a%CC%88ndringsmarkering.pdf https://developer.getswish.se/content/uploads/2017/09/Guide-...

pjc50 8y ago

The short answer is that credit cards were invented over 40 years ago, to operate in an offline and indeed paper-based system (hence the embossed digits for use in mechanical duplicators). For a more modern system look at contactless. FWIW I think the "one shot push" model of cryptocurrencies has some serious limitations which I think should be addressed by an "invoice" system - e.g. you can easily pay the wrong person, or even an address which doesn't exist and is owned by nobody! Not to mention dumb errors such as swapping the payment and tip fields. It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X", and the payer was simply generating an approval of that.

TekMol 8y ago
It would be better if the payee crafted a cryptogram for "please pay me (authenticated address) the sum of X" Are you talking about offline? Because on a website I would expect the payer to simply copy&paste the address. I would also expect a link type to evolve that browsers understand. Something like "payto:1fs8e...?amount=0.01&coin=btc" to pay 0.01 bitcoin to 1fs8e... Similar to the "mailto:user@host?subject=...&body=..." link type. An when we talk about offline (paying for a restaurant or something) - isn't there a visual link type already? I am not a user of crypto. But I think I have seen barcodes or something used for this.
- yesbabyyes 8y ago
  Something like the `bitcoin:` URI scheme? bitcoin:1fs8e...?amount=0.01 https://github.com/bitcoin/bips/blob/master/bip-0021.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0021.mediawi...
r1ch 8y ago
For Bitcoin, BIP 70 was proposed (and quite widely implemented) to take care of a lot of these issues. I assume many other cash-style cryptocurrencies have something similar these days. https://github.com/bitcoin/bips/blob/master/bip-0070.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0070.mediawi...
drexlspivey 8y ago