3 ms·

I have so many questions. How exactly does this tokenization of the cards work? If the token is equivalent to the card, then it doesn't really provide any sec

I have so many questions. How exactly does this tokenization of the cards work? If the token is equivalent to the card, then it doesn't really provide any security since theft of the token would still allow the thief to buy things. Does McDonald's do any fingerprinting of the user device? It seems like the token should be encrypted using the device fingerprint to ensure that the token can only be used from the device itself. What encryption does the McD's app use to talk to their servers? Is someone snooping tokens, device fingerprints and user credentials to pull this off? How has a card network not put a boot to McDonald's ass yet? I know McDonalds is big, but so are the card networks and the card networks are very serious about PCI data. How does the refund process work around this app? It seems hard to believe that one person is eating all the food that's being ordered. So either the thief is a very fat man, is a Robin Hood figure who distributes McD's to the poor, or has figured out a flaw in the McDonalds process that lets him refund transactions in such a way that he can recover the cash value, or cash equivalent, of the order. The last seems most likely to me.

aeternus 7y ago
Tokens are equivalent to your card, but only at a specific merchant. This can still be a problem for large merchants but is much less of a problem compared to a thief being able to use your account # anywhere. The most likely cause here is just a guessed password. Tokens are typically stored server-side, it is possible but unlikely that the McD app is doing something like passing that un-encrypted. With the number of password lists online, it is very easy for thieves to try a leaked password you've used on another site. Especially if the app does not have proper login rate-limiting.

3 ms·

I have so many questions. How exactly does this tokenization of the cards work? If the token is equivalent to the card, then it doesn't really provide any sec

by tynpeddler 7y ago

aeternus 7y ago
Tokens are equivalent to your card, but only at a specific merchant. This can still be a problem for large merchants but is much less of a problem compared to a thief being able to use your account # anywhere. The most likely cause here is just a guessed password. Tokens are typically stored server-side, it is possible but unlikely that the McD app is doing something like passing that un-encrypted. With the number of password lists online, it is very easy for thieves to try a leaked password you've used on another site. Especially if the app does not have proper login rate-limiting.