4 ms·

Your completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites usi

by tazard 8y ago

Your completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites using https could possibly be a worse thing.

gregmac 8y ago
Lots of people still have the mindset that http is the default and https signals a high level of trustworthiness. What we're shifting towards (and maybe already are there) is https is default, and an http-only site is an amateur setup, on the same level as hosting your site via IP (no domain name at all) or with a url like http://myisp.net/~mycompany/default.htm http://myisp.net/~mycompany/default.htm. Like it or not, browsers are treating sites like this now, and you don't see many "Secured by TrustworthyCo SSL" golden padlock badge images anymore.
3pt14159 8y ago
Yeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire. Root certs by hostiles. Near-trivial PDAs. Termination at network edge. OS installed certs. Even when it "works" 95% of the packets are on shitty, broken ciphers with no forward secrecy. And that last 5% is built on PKI which we know quantum is breaking pretty fucking soon. Almost nobody rotates access tokens. Almost nobody layers encryption. Almost nobody safeguards certs by locking down permissions. Almost nobody pins them. Almost nobody uses HSTS. Everything is shabby and shitty and breakable. Let's Encrypt is the wrong solution. It helps irrelevant hobby websites and increases risk for medium sized companies that tried to do the right thing.
- Latteland 8y ago
  how does let's encrypt increase the risk for anyone?
  - 3pt14159 8y ago
    Because it makes it a little easier to script forging an HTTPS cert. People here think that is easy, but it isn't. It involves real humans and real bullshit interfaces. If you get nailed with using a fake credit card its easy for any government to figure out that you also pwnd a website, but people here think in all-or-nothing terms for almost everything. I've worked on multiple projects with credit card fraud. I've helped the Canadian government with both cybercrime and machine learning. When I say 98% of criminals are dumb, I really fucking mean it. Not everyone is USG. Most governments are worse-resourced than your run-of-the-mill startup. But people don't want to hear that scriptable HTTPS has downsides and people that are in positions that come with social cache rarely listen. They end up becoming the next generation of people with blinders on. I helped with projects that threw over a dozen people in jail. We got them on two things: IP addresses and financial transactions. Let's Encrypt takes away one possible way we could have gotten them. But people on HN are so deluded about what actual crime looks like. You know how the vast majority of programmers are these dumb PHP coders that cobble together a Wordpress site? Crime is the same thing only worse. They have no fucking clue what they're doing. They bruteforce passwords and use exploits that target long-out-of-day vulns.
- tptacek 8y ago
  Criminals who hijack websites do in fact whip up credit cards "like it's nothing". A huge chunk of abuse attempts on websites that process transactions with credit cards is performed simply to bulk-verify stolen cards. Not even to buy things with the cards; just as a sort of scammer mapreduce to see which of their zillion cards work. The idea that credit card forms are a form of defense in depth is lunacy.
  - zozbot123 8y ago
    Interesting. Could the credit card industry take advantage of this by setting up honeypots - sites that look easily exploitable to the average crook, but that would actually provide card issuers with a list of stolen cards?
    - Crosseye_Jack 8y ago
      They would have to change the honeypots often. Scammers are fully aware that banks will also use the data to find other stolen cards. You get reports that 100 people what their details breached. You look though their transactions. The one thing they all used was momandpopsidebusiness.com for small transactions. These were prob test transactions so now you start looking for other customers whose cards fall under the same pattern and let the other banks know of your findings. So scammers will use many “test sites” so if one get found it doesn’t it doesn’t knock out their whole batch. And word would also quickly spread that cctesterrorscammers.com is a honeypot used by the banks and card processors. You could look at it like they don’t need the honeypots at all as they just need a few customers to report activity on their accounts and then they can start looking at the data they already have on file.
  - 3pt14159 8y ago
    I had a large response typed up to this, but I'm sick of this. I've worked on too many projects where I saw which countermeasures worked. Involving the financial system brings in their detection methods. It's not perfect, but it keeps out low level grifters and it increases friction. Most criminals are dumb opportunists.
JeanMarcS 8y ago
It’s even worse now that a lot of online services record your card so it will be easier for valid user to pay a service. If your credentials are compromised, even a paying certificate is easy to get. On a small company, the payment might be noticed. On big companies the odds are low.

by tazard 8y ago

gregmac 8y ago

Lots of people still have the mindset that http is the default and https signals a high level of trustworthiness. What we're shifting towards (and maybe already are there) is https is default, and an http-only site is an amateur setup, on the same level as hosting your site via IP (no domain name at all) or with a url like http://myisp.net/~mycompany/default.htm http://myisp.net/~mycompany/default.htm. Like it or not, browsers are treating sites like this now, and you don't see many "Secured by TrustworthyCo SSL" golden padlock badge images anymore.

3pt14159 8y ago

Yeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire. Root certs by hostiles. Near-trivial PDAs. Termination at network edge. OS installed certs. Even when it "works" 95% of the packets are on shitty, broken ciphers with no forward secrecy. And that last 5% is built on PKI which we know quantum is breaking pretty fucking soon. Almost nobody rotates access tokens. Almost nobody layers encryption. Almost nobody safeguards certs by locking down permissions. Almost nobody pins them. Almost nobody uses HSTS. Everything is shabby and shitty and breakable. Let's Encrypt is the wrong solution. It helps irrelevant hobby websites and increases risk for medium sized companies that tried to do the right thing.

Latteland 8y ago
how does let's encrypt increase the risk for anyone?
- 3pt14159 8y ago
  Because it makes it a little easier to script forging an HTTPS cert. People here think that is easy, but it isn't. It involves real humans and real bullshit interfaces. If you get nailed with using a fake credit card its easy for any government to figure out that you also pwnd a website, but people here think in all-or-nothing terms for almost everything. I've worked on multiple projects with credit card fraud. I've helped the Canadian government with both cybercrime and machine learning. When I say 98% of criminals are dumb, I really fucking mean it. Not everyone is USG. Most governments are worse-resourced than your run-of-the-mill startup. But people don't want to hear that scriptable HTTPS has downsides and people that are in positions that come with social cache rarely listen. They end up becoming the next generation of people with blinders on. I helped with projects that threw over a dozen people in jail. We got them on two things: IP addresses and financial transactions. Let's Encrypt takes away one possible way we could have gotten them. But people on HN are so deluded about what actual crime looks like. You know how the vast majority of programmers are these dumb PHP coders that cobble together a Wordpress site? Crime is the same thing only worse. They have no fucking clue what they're doing. They bruteforce passwords and use exploits that target long-out-of-day vulns.
tptacek 8y ago
Criminals who hijack websites do in fact whip up credit cards "like it's nothing". A huge chunk of abuse attempts on websites that process transactions with credit cards is performed simply to bulk-verify stolen cards. Not even to buy things with the cards; just as a sort of scammer mapreduce to see which of their zillion cards work. The idea that credit card forms are a form of defense in depth is lunacy.
- zozbot123 8y ago
  Interesting. Could the credit card industry take advantage of this by setting up honeypots - sites that look easily exploitable to the average crook, but that would actually provide card issuers with a list of stolen cards?
  - Crosseye_Jack 8y ago
    They would have to change the honeypots often. Scammers are fully aware that banks will also use the data to find other stolen cards. You get reports that 100 people what their details breached. You look though their transactions. The one thing they all used was momandpopsidebusiness.com for small transactions. These were prob test transactions so now you start looking for other customers whose cards fall under the same pattern and let the other banks know of your findings. So scammers will use many “test sites” so if one get found it doesn’t it doesn’t knock out their whole batch. And word would also quickly spread that cctesterrorscammers.com is a honeypot used by the banks and card processors. You could look at it like they don’t need the honeypots at all as they just need a few customers to report activity on their accounts and then they can start looking at the data they already have on file.
- 3pt14159 8y ago
  I had a large response typed up to this, but I'm sick of this. I've worked on too many projects where I saw which countermeasures worked. Involving the financial system brings in their detection methods. It's not perfect, but it keeps out low level grifters and it increases friction. Most criminals are dumb opportunists.

JeanMarcS 8y ago

It’s even worse now that a lot of online services record your card so it will be easier for valid user to pay a service. If your credentials are compromised, even a paying certificate is easy to get. On a small company, the payment might be noticed. On big companies the odds are low.