7 ms·
Couldn't a card number be tokenized in some way so as to allow for tracking?
by Forbo 8y ago
Couldn't a card number be tokenized in some way so as to allow for tracking?
- Znafon 8y agoI dont think so, this would probably go against PCI DSS.
- leesalminen 8y agoI've seen several deterministic tokenizers for payment cards.
- Znafon 8y agoWhere there done by the payment processor like Artemis2 or in house? I'm asking because I saw a lot of in-house tokenizer with hashes or deterministic encryption that could get reversed in a few seconds by brute force since the space to cover is so small.
- unethical_ban 8y agoThe whole point of tokenizing is to get rid of PCI problems on CC analysis and testing, as I understand it.
- Znafon 8y agoIs there credit card tokenization services from which you can get a token identifying permanently a card without the possibility to make a payment?
- nothrabannosir 8y agoYes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints). https://stripe.com/docs/api/tokens/create_card https://stripe.com/docs/api/tokens/create_card (notice the request has no charge, but the response contains a fingerprint). To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.
- Artemis2 8y agoMost payment gateways offer a card fingerprinting feature. Here’s Stripe’s: https://stripe.com/docs/api/cards/object#card_object-fingerprint https://stripe.com/docs/api/cards/object#card_object-fingerp.... It’s fine with PCI DSS as long as it is not reversible.
- 1stcity3rdcoast 8y agoStripe and Square both identify consumers by their unique CC numbers. If I swipe my card on a square reader, it recognizes me and asks if I want a receipt sent to my phone or email, even if I’ve never purchased from that vendor before.
- paulie_a 8y agoNot really. I work with payment processing, I've got the partially obscured credit card number, usually the name and the location. Plus a bunch of other info.
- delinka 8y agoTokenized? One-way digest: SHA-512 the card number, iterate SHA-512 on the results 100 times, store that as your tracking code.
- beokop 8y agoNo. With 10^12 possible account numbers and a hash rate of ~10^10 H/s using off the shelf hardware [1] it would only take 100*(10^12/10^10) = 10000 seconds to deanonymise the token. [1] https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
- anamexis 8y agoWith 10^12 possible account numbers, it should be relatively easy to build a rainbow table for tokens of any practical complexity.