15 ms·
Visa Advertising Solutions (VAS) Opt Out
- throwaway894345 6y agoThe form doesn't require any sort of authentication, so I imagine someone could write a script to submit all (or a large portion of) the set of card numbers to this API. Might need to work around rate limiting and so on, but seems feasible?
- bitexploder 6y agoAlso, if there is any sort of timing difference on valid/invalid card numbers. Boom... timing attack / CC oracle :)
- ev1 6y agoThere's already Luhn and a list of valid starting digits...
- kelnos 6y agoI think the parent meant "card number that actually is in use and works" when saying "valid", not "follows the rules of card numbers".
- sgjohnson 6y agoYes, which aids the spamming. The first 6 digits of a card number is called the BIN code. That leaves just 9 digits that have to be spammed. The fact that BIN lists are publicly available is reducing the space significantly.
- Nextgrid 6y agoI'd expect any submissions to this are just appended to a database without any actual validation beyond the trivial Luhn checksum and then there's a batch process once a day (maybe the same one that actually generates whatever marketing "insights" they claim to provide) that reads from there and ignores any card numbers from the opt-out DB.
- bitexploder 6y agoYou would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :)
- vageli 6y ago> You would hope that. I’ve been in infosec doing application security as a consultant a long time. Developers have often destroyed my hopes :) I used to work at a big bank in the US and the parent's description sounds exactly like how it would work.
- earthboundkid 6y agoGovernment and banks have been continuously using computers since the 60s, so as a result there’s a lot of “fancy web API to collect data… that gets batch processed by an ETL on a mainframe overnight.” Much more of it than I realized as a young dev at least.
- bitexploder 6y agoYou could be right but I have found almost this exact bug in production systems (credit card oracle sitting on the public Internet of a big card processor with no rate limiting and a really obvious timing delta). Both scenarios (batch or live processing) are pretty likely IMO. Just depends on what mess of APIs you happen to end up on.
- netsharc 6y agoHuh... create script to fill DB with all possible Visa numbers, tomorrow's "marketing insight" will suddenly be an empty file because everything will be excluded. Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database. Of course, no one should do this...
- overscore 6y ago> Bonus, if they can't separate which exclusions were from legitimate requests and which came from this script, they can't just delete those entries from the database. I think they would probably just declare them all invalid, and roll back to yesterday.
- morpheuskafka 6y agoChecked and the Mastercard one someone posted below doesn't seem to be vulnerable to this. My real card number and a dummy mastercard number with valid prefix and check digit both returned a 200 OK in around 1.01s. A random 16digit number without valid check digit returned 400 Bad Request in about 800ms. Decided to check that one since they have a completely useless machine-readable catchpa. For Visa it was 835ms for valid, 762ms for dummy, prefix and check digit appears to be checked client side.
- bitexploder 6y ago100ms is /massive/ for a timing delta but you really need a lot of samples. I have exploited timing deltas that were not much more than a handful of machine code instructions in terms of execution time. But you really do need a lot of samples to confirm small deltas. It starts getting impractical for many APIs (someone will notice, hopefully).
- texasbigdata 6y agoThis comment is why I love hackernews
- bitexploder 6y agoSee: https://rdist.root.org/2010/07/19/exploiting-remote-timing-attacks/ https://rdist.root.org/2010/07/19/exploiting-remote-timing-a... and Crosby 2007. I got into infosec around 06 and tptacek, Nate Lawson and some others were my heroes. Now I run my own consulting firm with a bunch of cool people :) Also in infosec: what is old is new. We still find shitty comparison routines (timing attacks) and SQL injection... some day :)
- dmix 6y ago> someone will notice, hopefully Or more likely "someone will notice, eventually"
- animex 6y agoI just found a use-case for the sleep( rand(1000) ) function :-)
- TylerE 6y agoCard number alone doesn't get you anywhere. An expiration date will get you a bit farther, but you really need the CVV also.
- notretarded 6y agoWhich would give you worthless information
- dzikimarian 6y agoComing from the industry - MC & Visa typically don't know if exact card is valid or not. They admit range of numbers to an issuer (bank, revolut-type, whatever), and issuers system is queried for each transaction - card can be created at any time without notifying card schemes. There's some exceptions (tokens etc.), but not relevant to this use case.
- WaxProlix 6y agoThere's an unspoken assumption here and elsewhere that the captcha doesn't present any kind of difficulty at all; is that true? If so, why?
- xzel 6y agoMost open source text captchas have ML/DL or OpenCV OCR solutions and more advanced captchas like gcaptcha/hcaptcha you can send to a solver farm like 2captcha. The cost for the farm solutions is pretty cheap.
- WaxProlix 6y agoI'd only seen relatively pricey solver farm solutions, hence the question. What constitutes "cheap" here? For a baseline, .05USD/captcha seems not cheap to me.
- hshshs2 6y agofor a server farm you could purchase as a normal citizen, but what do governments pay?
- adanto6840 6y agoCan be had much cheaper, especially if OK with a non-zero failure rate (and/or bit more latency). Note that my hands-on experience with this stuff is now relatively dated, from a "prior career" -- coming up on 10 years now, even. If anything though, then I'd guess that it's become cheaper over time, not more expensive.
- BeefySwain 6y agoLook again, that is per thousand captchas. Still pretty expensive if you wanted to do every single Valid CC #, though.
- xzel 6y ago2captcha is about 0.0005/solve, give or take do to their failure rate. There are other services as well and pre-paid bulk purchases lead to lower pricing. I wouldn't want to ballot stuff the crazy number that is the combination of all Visa credit cards but for much smaller problem spaces 2captcha and others are very reasonably priced.
- asdfasgasdgasdg 6y agoHaven't people been sent to jail for doing this much or less? I recall something happening to a guy who probed AT&T's phone number registry or something?
- texasbigdata 6y agoHow is this illegal? You make a form that says “XYZ” and buy a domain “abc.com” and if someone enters a random submission they go to jail for it? Maybe I’m misunderstanding.
- asdfasgasdgasdg 6y agoAs the other person linked, it did happen, although perhaps it would not happen again. On the other hand, I would not risk it, especially since any competent database admin would have your edits rolled back quickly. What would it accomplish? They'll undo the edits then make it harder to remove yourself from the list in the future. Who does that serve?
- cle 6y agoIf something is sufficiently scary to the lay person, you have a good chance of going to jail. I wouldn't make the mistake of thinking that laws are interpreted and applied fairly.
- alexchamberlain 6y ago
- justinzollars 6y agoplease opt me out
- deleted 6y ago[deleted]
- harikb 6y agoBut then you are giving VISA a perfect reason to throw out all optouts and start fresh. Stuff like this happened during FTC net neutrality debate
- cabaalis 6y agoWhy would you want to make an option intended to give some semblance of privacy useless? The net result of submitting all card numbers will not be "oh, well, I guess all card numbers are private now.." it will instead be "clear that table and start over."
- zelly 6y agoThey'll just throw out all the ones spammed from your IP. If you become obnoxious they will call the FBI because this would be a CFAA violation.
- boston_clone 6y agoNot a lawyer - would it really be a violation of the CFAA? I'd also be surprised if Visa involved the FBI for someone excessively hitting their API...
- eximius 6y agoCFAA is draconian, the courts are behind the times, and even if you win, it'd be in court where you don't want to be in the first place.
- tatersolid 6y agoI didn’t check, but the terms of service surely state that you must only enter your own active card numbers for which you are the authorized account holder. Doing otherwise -> access in excess of authority -> CFAA violation Just because you can easily walk through an unlocked door doesn’t mean doing so is always legal.
- hansvm 6y agoIt looks like with just a billion calls to that endpoint you can opt out every card for a given visa issuer.
- olyjohn 6y agoWonder what would happen if someone managed to opt out every single Visa card. Would Visa have to honor that, or would that be grounds to allow them to opt everybody back in? Or would they just create a "different" marketing campaign, and just opt everybody into that one?
- bavell 6y agoOnly one way to find out! What are the possible legal risks to an innocent researcher testing this worthy hypothesis? Asking for a friend of course ;)
- Miner49er 6y agoIn the US? Jail, probably. The CFAA is given very broad reach, especially when you mess with corporations. IANAL, though.
- strombofulous 6y agoProbably the same thing that happened ~10 years ago in a very similar situation https://www.eff.org/cases/us-v-auernheimer https://www.eff.org/cases/us-v-auernheimer
- lucb1e 6y agoThey would have a legitimate reason to doubt that all cards individually opted out and so they'd probably send people a letter or post a notice somewhere (updated ToS, idk) that there is now a new form that makes it more annoying for you to opt out (have to enter other details, send a letter, whatever) and that opt-outs after date X (when the mass additions started happening) have not been processed. Or you do it like the EU and make excessive data processing opt-in. (Where by "excessive" I mean something that doesn't fall within recital 47 of GDPR: "legitimate [e.g. marketing] interests of [the company] may provide a legal basis for processing, provided that [users' rights] are not overriding, taking into consideration the reasonable expectations of [users]". It's a grey area where this line is exactly, but Visa can't simply do whatever they want. They have to tell you what data they process, but nobody reads that, and for unexpected (arguably excessive) things they'd have to ask you to opt in.) But I guess that's a little beyond the scope of this comment thread.
- deleted 6y ago[deleted]
- sneak 6y agoWhat processing companies are available to use that don't sell your transaction data by default?
- throwaway2048 6y agoNone, because basicly every credit card transaction passes through Mastercard, Visa, and American Express, and they log and datamine it.
- xyst 6y agoby using physical cash
- sneak 6y agoI use physical cash at every opportunity already. How do you buy airline tickets that way? How do you purchase things online for delivery during a pandemic?
- zelly 6y agoyou can go to an airport, which has never closed, and buy a ticket in cash you can purchase things in cash at Walmart, Target, etc. which has never closed during the pandemic
- sneak 6y ago> you can go to an airport, which has never closed, and buy a ticket in cash This has not been true for some time. Ticket counters require payment cards. I asked about purchasing things online because it's not safe to shop in person at the moment.
- zelly 6y agoInteresting, I remember being able to pay cash a couple years ago, but now I see most airlines stopped accepting cash, ex: https://www.dallasnews.com/business/airlines/2020/07/07/southwest-airlines-will-no-longer-accept-cash-in-the-us/ https://www.dallasnews.com/business/airlines/2020/07/07/sout... Even Amtrak is now not accepting cash anymore: https://www.amtrak.com/purchase-train-tickets https://www.amtrak.com/purchase-train-tickets Looks like the only option left is drive a car and fill up at gas stations which accept cash (for the time being). I'm not super familiar with EV charging stations but I don't think I've seen one that accepts cash, if that's any hint as to where we are headed. Dark times
- say_it_as_it_is 6y agoSo all I need to do is provide my full credit card number in this random page and then it'll opt me out? And this was somehow brought to the front page of Hacker News? This is a very low effort scam. At least put in some effort beyond your dozen shadow accounts on HN.
- flatiron 6y agoDomain and cert are visa. So at least you know you are talking to Visa so it’s not really entirely random.
- aaomidi 6y agoTechnically to someone who has demonstrated control on visa.com at the time the cert was issued. It doesn't necessarily mean its actually visa.com. Although I didn't check to see if they're using OV or EV certs.
- quesera 6y agoThe cert appears to be DV, and is issued to and by Cloudflare. Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 Subject: C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=marketingreportoptout.visa.com The cert for visa.com is similar.
- tialaramex 6y agoThis certificate is actually OV. It has a Certificate Policy OID inside it, which is 2.23.140.1.2.2 for OV This is set side in section 7.1.6.1 "Reserved Certificate Policy Identifiers" of the Baseline Requirements, although you could just Google it because OIDs are unique. Cloudflare, as issuer, have confirmed that Cloudflare, the certificate subscriber, are really Cloudflare, because they're the same entity. That's actually an allowed shortcut, and, I'd argue, one of the most secure possibilities for such validation of business entities. If you were wondering if this is really Visa that doesn't help you at all. For that you'd best rely on the fact that visa.com is the domain you care about and so logically Visa must have authorised Cloudflare to serve this name. The predecessor of this site, back in summer, was not on Cloudflare, that too had an OV certificate, but for "Visa International Service Association" in Foster City. I guess somebody decided that letting Cloudflare handle this was cheaper/ easier. Edited to add: Predecessor's certificate https://crt.sh/?id=3134907318 https://crt.sh/?id=3134907318
- csunbird 6y agoI wonder what is their policy in EU. Do they automatically process your data without any opt-out?
- jahewson 6y agoIt doesn’t exist. VAS is a US product offered by Visa US, supporting US cardholders only.
- wolco2 6y agoDoes it include Canada?
- algesten 6y ago"supporting" as a european I'm totally ok without this support.
- iamacyborg 6y agoThey still aggregate and sell insights from their collected data. https://www.markiteconomics.com/Public/Home/PressRelease/d1801332f2564d839d89af0f685b962b https://www.markiteconomics.com/Public/Home/PressRelease/d18...
- thetanil 6y agoIn EU opt-out schemes are illegal if it has anything to do with personal information. a person has to opt-in to share personal info.
- exhilaration 6y agoWhat about Amex and Mastercard, do they have similar marketing opt-out forms?
- oriettaxx 6y agoapparently yes, but it does not work https://news.ycombinator.com/item?id=25570690 https://news.ycombinator.com/item?id=25570690
- jackson1442 6y agoHere's an equivalent form for MasterCard: https://www.mastercard.us/en-us/vision/corp-responsibility/commitment-to-privacy/privacy/data-analytics-opt-out.html https://www.mastercard.us/en-us/vision/corp-responsibility/c...
- cwt137 6y agoI get "System Error" when I submit my card number
- alpb 6y agoSame here. I have a suspicion like they designed it for 5 queries/day and we just blew it.
- alpb 6y agoSo I tried it again after 24 hours on two different cards. First one worked right off the bat. Second one gave "System error" three times one row and worked on the fourth try. I think we’re looking at some real "enterprise-grade" software on MasterCard side.
- johnjungles 6y agoSame here, “System error”
- bbarnett 6y agoIf this is about the MC form, I found that if I pasted my CC number (such as from a pass manager), it would bork unless: - I entered the number - Then moved to the front of the input field - Deleted a char, and re-entered it, because - an end-of-field char change removes the whole number Wait a sec, even two seconds, and the number will auto-obscure. Then it works.
- agentdrtran 6y agoI got this in Chrome, it worked in Edge
- 6y ago
- aaomidi 6y agoJesus Christ no accessibility on the CAPTCHA and even I failed it 8 times.
- mcswell 6y agoI failed it 3 times before getting it right.
- soared 6y agoMy favorite visa data to sell/buy is airfares. Visa gets the airport code of your departure and arrival, so you can group people into like “visiting Florida during the first week of June”. Or “flys to the Bahamas very often”. Good stuff.
- ciabattabread 6y agoWhat kind of individual data is in that set of “flys to the Bahamas very often”? Zip codes? Closest city?
- netsharc 6y agoI guess if it's anonymized they just want to find patterns. So if 70% of men aged 40-65 who "flies to the Bahamas often" also like to eat at the local 5-star restaurant there, they can go to that restaurant and tell them to either join the Visa Perks experience to reach the other 30%, or maybe tell them to put out ads at the airport. You can even tell them which months these visitors like to come, so you can time those ads...
- soared 6y agoNot sure what you meant, but you buy data like that based on airport codes, dates, frequency, and tier (like top 10% of spenders). I’ve only used visa data for targeted advertising. Like tourism destinations target people who are flying to their destination in the near future.
- cbsks 6y agoWhat data do you get on each person who matches the query?
- Reebz 6y agoOften you get the data in aggregate, bought and sold as an “audience”. It’s a Boolean flag if a person in the audience. Basically an array of IDs for people in the audience (true). Almost always the data seller masks the ID of people in the audience to the buyer. This then creates opportunity for third party “matching services” or “identity resolution” who can de-anonymize, link, and re-anonymize. Link audiences together, e.g. flies to Bahamas often AND lives in the US North East AND has a mortgage. Facebook and Google’s success relies heavily on simplifying huge amounts of the programmatic advertising backend, but the audience selling is still a huge part of the industry, like Acxiom et al. Much of this buying and selling of data within the paid advertising industry hides in plain sight because it goes by so many names - contextual targeting, relevancy data, media enrichment, lead enhancement, blah blah blah...
- tolbish 6y agoAny way to verify that this is legitimate and not a phishing page for active card numbers?
- traek 6y agoYes, by checking the SSL cert.
- tolbish 6y agoThanks, SSL is an area I'm not very knowledgeable in.
- oarsinsync 6y agoThe certificate used on this website says it’s owned by Cloudflare. That doesn’t help in this instance. Especially since this means anything you submit will be decrypted by Cloudflare. It may then be transmitted in the clear to whoever runs the backend sever that Cloudflare is proxying for.
- neckardt 6y agoIt's coming from visa.com, somebody would have had to hijack their domain first to set up a phishing scam like this.
- mikehollinger 6y agoSo where do I go to see my profile and data? I got a kick out of requesting my lexis nexis profiles - which eventually resulted in two very large packets of paper (several hundred pages) arriving in the mail.
- cj 6y agoI highly recommend requesting your data from Verizon (if you’re a vzw customer). A 10mb spreadsheet, very enlightening. Not too difficult to request but took 2-3 weeks to arrive. What is the process requesting from lexis nexis?
- meowster 6y agoI did that about 10 years ago. The packet didn't make much sense to me then. I wonder if I still have it somewhere. It would be interesting to request it again and see what changed.
- jhart99 6y agoIf you want a real trip, I'd suggest getting your data from DT Client Services via CCPA request if you are in California. That was really shocking.
- inakarmacoma 6y agoWhat process did you follow? Were there costs associated with printing, delivery, etc?
- jhart99 6y agoI sent them an email with my request. The email address can be found on the CA Attorney General's webpage here https://oag.ca.gov/data-brokers?combine=dt+client https://oag.ca.gov/data-brokers?combine=dt+client I used the form from Epic which is on this page https://epic.org/ccpa/ https://epic.org/ccpa/ There are no costs associated with this and they are required to provide the information to you up to two times in a year. Not every business must comply.
- deleted 6y ago
- koolba 6y agoHow much does it does it cost to buy this data and what level of detail can you get?
- eyeareque 6y agoTo verify that this is a legit site: Go to: https://usa.visa.com/legal/global-privacy-notice/additional-privacy-information.html https://usa.visa.com/legal/global-privacy-notice/additional-... Then click on: “Visa Products & Services: How does Visa use personal information to benefit consumers and businesses?” Then scroll to the bottom of that section and you’ll see the VAS link: ”U.S. cardholders can opt out of Visa using their card transaction data for VAS.” where you can opt out. iPhones will auto capitalize text in the capatcha box, so make sure the text is all lowercase.
- iamtedd 6y agoThe site is already marketingreportoptout.visa.com. How would your random link add anything?
- wpietri 6y agoThe "random link" is on a domain that the Wayback machine has back to 2001. Whereas the marketingreportoptout subdomain doesn't appear to be there at all. I could certainly imagine a compromise where somebody who doesn't have access to the main sites still manages to sneak in a plausible-sounding subdomain.
- ianlevesque 6y agoThat's not how any of this works.
- wpietri 6y agoOh? https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://www.hackerone.com/blog/Guide-Subdomain-Takeovers
- foepys 6y agoPlus the site uses a certificate that is not only issued by but also owned by Cloudflare according to its metadata. It's undistinguishable from a free tier Cloudflare cert unless you know what exactly you need to look for.
- 3gg 6y agoWhat would be better is if the US had (does it?) a nation-wide law requiring explicit opt-in, as opposed to having to opt out of surveillance. Small steps forward. Also, does this form really amount to anything other than "we promise we won't spy you that much?" Are banks audited in this regard, or are they subject to the same non-existent regulations as the Sillycon Valley surveillance?
- alpb 6y ago“Better” for who? The corporations or the people? United States usually favors one over the other by design.
- earthboundkid 6y agoI will take what I can get, but the obviously correct thing is for user targeting and sale of third party information to be illegal, never-mind opt in.
- 3gg 6y agoYou're ten steps ahead :)
- forgotmypw17 6y agoLike the fox offering an opt-out list to the chickens...
- sedatk 6y agoIt's probably a service mandated by regulation, not out of the goodness of VISA.
- oblio 6y agoAnd it's probably running on the slowest and cheapest hardware they can buy, without any monitoring.
- wtallis 6y agoI doubt it. They state "Because your issuing bank may change your card number, your opt out will be honored for five years. After five years, you will need to resubmit your card number." This strikes me as the kind of bullshit that would not be permitted if the opt-out was legally mandated. I suspect this opt-out may instead be an attempt to avoid regulation, by trying to appear to be doing the right thing even without regulation.
- sedatk 6y agoAll legally mandated electronic opt-out requirements have time limits AFAIK. Credit score companies (5 years): https://www.optoutprescreen.com/ https://www.optoutprescreen.com/ Spam mail (10 years): https://www.dmachoice.org/ https://www.dmachoice.org/
- wtallis 6y agoThe government's page about this tells a different story: https://www.consumer.ftc.gov/articles/0262-stopping-unsolicited-mail-phone-calls-and-email https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... > To opt out permanently: You may begin the permanent Opt-Out process online at www.optoutprescreen.com. To complete your request, you must return the signed Permanent Opt-Out Election form, which will be provided after you initiate your online request. > Telemarketing [...] Telephone numbers on the registry will only be removed when they are disconnected and reassigned, or when you choose to remove a number from the registry. Meanwhile, the DMAchoice site says: > It is not a tool to effectuate rights under any specific law including the California Consumer Privacy Act (CCPA). So I'm not buying that legally mandated opt-outs come with the annoying expiration dates.
- 1-6 6y agoSometimes I wonder how certain deals show up as website advertisements and recommendations. Certain blog posts or forum posts appear magically in my search result knowing what I was planning for. Deals and YouTube recommendations also seemed coincidental. Now I know that my debit card has been also leaking my purchase patterns and location. I better add more hosts to my Raspberry Pi-Hole.
- 3gg 6y agoAre you suggesting to just block the ads? What I find more annoying is the fact that the data is collected in the first place, as well as the opt-out vs opt-in by default. Your pi-hole won't protect you from that, since the moment you swipe that baby, Visa knows.
- 1-6 6y agoI try to opt-out whenever I can but I’m pretty sure there are several other blind-spots I haven’t blocked. Pi-hole does that for both the US and worldwide. I just need to figure out how to proxy my phone web requests home through VPN or WireGuard.
- Marsymars 6y agoI've found it easier to use NextDNS rather than maintaining a Pi-hole and routing everything through my home connection.
- lucasverra 6y agoI can vouch for this also, they are a partner of Firefox DOH feature so good enough for me
- soared 6y agoYour credit card mostly on gets merchant name and total purchase value, so the uses are fairly niche. It’s more likely merchants themselves indirectly selling your purchase data. You can sometimes click the small blue triangle in the corner of an ad (called adchoices) to see how it was targeted.
- exabrial 6y agoDoes this effect things like Mint or other useful data sharing services?
- ddevault 6y agoIt should be illegal for this to use an opt-out approach rather than opt-in. If it's my data, you should be legally required to pay me to use it, at the price I demand, or not use it at all. Only with my consent, and not at the threat of not receiving service should I decline.
- godisnotreal 6y agoI'm sorry you're getting downvoted, often downvotes equals flagging and not displaying a comment on HN like this at all. Unfortunately I've found much of the HN community to be on the darkside of tech, or at least the side that will create 1000+ accounts to submit, like, etc to manipulate the discourse in whatever way benefits them most.
- olliej 6y agoThis is the most dodgy looking “enter your CC info” site to ever exist. I can’t imagine why /s
- hedora 6y agoThis needs to end. Surveillance capitalism should be opt in (or just plain illegal).
- oblio 6y agoHalf the people on this forum are being paid by it. The other half are thinking of ways to improve it, to make more money :-)
- tgsovlerkhgsel 6y agoA great showcase why GDPR is a good thing.
- pdevr 6y agoPet peeve: Why do they use subdomains (marketingreportoptout.visa.com), thus making it a bit easier for the scammers to register similar domains? marketingreportoptout-visa.com is still available for any scammer to register. It costs Visa (or anyone) less than $200 to register it for 10 years. Can't they at least register these very obvious domains? How difficult is it to use URLs like this? visa.com/marketingoptout visa.com/links
- paxys 6y agoFrom a technical standpoint, it is possible to configure separate DNS records for subdomains, so something.visa.com can be set up completely independently from their main website. And it won't have to share cookies either, making it more secure. For visa.com/something, you would need to add a routing rule at the application level in whatever server is hosting visa.com.
- dal 6y agoNo, this can be done in the loadbalancer before any application. You can load balance on L7. This would be a trivial thing.
- w3ll_w3ll_w3ll 6y agoA trivial thing that would became a mess really fast on a complex website. A new subdomain for every different "website" is the clean solution in my opinion.
- paxys 6y agoNothing is trivial for a decades-old website.
- david-cako 6y agohow do you opt out of the Visa Advertising Solutions Opt Out list?
- disown 6y agoIs it just opt out once forever or do you have to "opt out" each time they update and send you a new card holder agreement? Who has the discipline to read each packet Visa sends you every few months and re-opt out each and every time? Out of pure attrition, I'm guessing 99% of their customers will eventually be "opt-in". Besides, considering that Visa, Mastercard, etc are all headed toward "data and AI" model, it's not going to matter ultimately. The entire business world is going towards collecting data and selling your data. Isn't data the "new oil"?
- mcswell 6y agoAccording to this: https://bb.visa.com/legal/privacy-policy-opt-out.html https://bb.visa.com/legal/privacy-policy-opt-out.html you'll have to opt out if your card number changes, and every five years even if it doesn't.
- deleted 6y ago[deleted]
- yumraj 6y agoWhy does the cert say Cloudflare and not Visa? It says "Verified by: Cloudflare, Inc." AND Organization is also Cloudflare, Inc. Shouldn't the Organization be Visa? How do I know that this is Visa? Genuinely curious since I've not seen certs like this..
- Santosh83 6y agoI believe it is the standard free level, "Universal SSL" cert that Cloudflare will provide sites on free tier, if they opt for proxying through Cloudflare.
- cbsks 6y agoSo all credit card numbers submitted by the form are viewable by Cloudflare? That does not inspire confidence
- r1ch 6y agoYes, and you also have no guarantee that Cloudflare is sending them back to the origin over a secure connection. 3 of the 4 SSL options they give customers would be considered insecure by browser standards.
- tialaramex 6y agoBut since you are trusting Visa and it is trusting Cloudflare in this arrangement (and it's not very different from if you used a bulk hosted site and technically the bulk host could be eavesdropping) actually only one of those 4 options makes a practical difference. The case where the backend is plaintext HTTP is different because a third party between Cloudflare and Visa could eavesdrop that silently (split fibre can make this utterly seamless for normal network technology) with no permission from either of them. But in the other three cases either Visa, or Cloudflare, or both would have to agree to let somebody else snoop, which agreement they could make even if this was on-premises at Visa's own facility. That's not a technical problem, that's Visa betrayed you for whatever reason. Arguably one of the options that would be "considered insecure by browser standards" is actually safer for Cloudflare sites, because you can't attack it from the Web PKI. Cloudflare Origin CA isolates you from such an attack, bad guys would need to attack Cloudflare to get a valid certificate from them, certificates from another CA would not work if it's locked down to Cloudflare Origin CA.
- nielsbot 6y agoIs this secure at all?
- alkonaut 6y agoAre Visa/MC really able to store and use data for that purpose wrt to e.g the GDPR? Advertising/marketing certainly isn’t necessary for what they are doing so it would be requiring specific consent?
- fullstackwife 6y agoWhy we are opted-in by default?
- thih9 6y ago> your opt out will be honored for five years. After five years, you will need to resubmit your card number. This requirement seems very easy to abuse. Annoying and inconveniencing users into submission already works wonders, people accept all kinds of EULAs, cookie conditions and privacy policies. I wouldn't want expiring user choices to become another tool in this arsenal.
- thetanil 6y agothe fact that you were at any time automatically opted in means they already scraped your whole history anyway. They will do it again in the future anyway since you will be automatically opted in in the future too. Get Zuckerd
- Havoc 6y ago>U.S cardholders may opt out of Visa So is the rest of the world not covered by this data collection effort or are they just denied the opportunity to opt out at all?
- miki123211 6y agoThis website doesn't seem to be ADA compliant. There's a CAPTCHA, but no audio option. I guess blind people have to stay in that database, whether they want to or not.