6 ms·

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the

by neya 5y ago

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit card number in PLAIN TEXT!. Not just credit cards, even their users' passwords. This also explains why many of them got and still get hacked from time to time. Even credit card processors got hacked due to this. Lot of shitty ones in the Indian market actually. The root cause of this, not to cause language flame wars here, but is most of the shops use script kiddos with just basic PHP knowledge. Bare minimum, they're recent fresh college grads who just know how to consume data from a form using PHP using GET and POST, that's it. Most of the code I've worked with just consumes this directly instead of stripping/processing it and end up introducing SQL injection attacks. Atleast, if they used a framework, this would be provided by default for free, but many of the developers hardly know about even MVC. (As an aside) - As a personal mission, I started touring around the country teaching college kids for free about basics of web development, security, etc. But, still, I have a long way to go. Well folks, that's it for today's note on why this was a good move. Have a nice day! Edit: Some of the recent hacks that were not made public widescale like they should've been: 1. Domino's Pizza India (Yes, the international pizza chain) 2. BigBasket (Largest online grocery ordering App) 3. PayTm (One of the largest, if not the largest digital payments app in India)

paxys 5y ago
That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. India is also the top 7-8 e-commerce market in the world. Large local apps in the space have valuations in the tens of billions of dollars, and all major global players like Amazon and Walmart are involved in the country as well. These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry.
- deathtrader666 5y ago
  Yes, but large valuations don't correlate with better security practices.. Obviously the person above isn't talking about Amazon or Walmart when referring to "script kiddies". Of the nearly 45-50 contract jobs I've seen, a lot of them use pirated WP or Magento plugins, and plain text storage of sensitive content.
  - sidm83 5y ago
    Again, generalization. What you're talking about mostly refers to small time sites with maybe not more than few dozen orders a day. Typical ecommerce businesses (usually the kind with at least 100s or 1000s of orders a day) write their own code rather than using WP plugins. As far as PCI DSS goes, there are multiple levels. Even at the tier 2 Indian ecom company I used to work at, we did not store any card info, it was just submitted in an iframe rendered by the payment gateway. And even then we were subjected to annual/semi-annual security audits (this was in addition to quarterly external security audits we ordered ourselves apart from typical OWASP top 10 checks performed by QAs in weekly sprints).
- yjftsjthsd-h 5y ago
  > That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies. > These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry. Those are less connected than you think; loads of companies run obscenely large monetary transactions and essential business processes with horrifying hacked-up systems (50k LoC files, 20-year-old Perl scripts that nobody understands, Solaris 2.x desktop in the maintenance closet...); utility and good code are less correlated than we wish.
  - dewey 5y ago
    "such that US companies have to care about PCI more than Indian companies." If you think about the social security number system, paper checks or credit cards with magnet strips I think you'll notice that other countries sometimes have stricter and more advanced security regulations.
powerapple 5y ago
Agree. There is really no way of knowing which website has my credit information now (I choose not to save credit details anyway). I wish all websites can ask permission every year to hold my information.
NavinF 5y ago
I agree as long as merchant banks let you transfer tokenized cards to a new provider. Otherwise businesses will get locked into one provider for recurring billing. (No, this doesn’t make tokenized cards as dangerous as card numbers. Transferring a merchant account is a whole process. Not to mention that when a breach happens, you can cancel one merchant’s tokens without forcing every customer to get new cards)
Abishek_Muthian 5y ago
RBI(Central bank) has been filling-up for a long time for the total lack of security practices by merchants & data-privacy laws. e.g. One can control how much money can be withdrawn from the credit/debit card per-day according to domestic/International merchants/online/physical/ATM/ etc. through net-banking with the minimum in the multiples of INR 1000. So even if the card data gets stolen, Criminals can utmost withdraw only the minimum amount in the other part of the world. But unfortunately due to the digital-divide, Not many have access or awareness of such facilities and hence control over card data is required. IMO the single point of failure for India's financial security is its extraordinary dependence on mobile number for 2FA, Even security conscious customers can do little against SIM jacking attacks, But for those who are not security conscious; all it requires is a social engineered SMS with ngrok URL[1] or Phone call asking for that OTP. Please write to RBI and demand your bank to support hardware tokens (or) at least TOTP. > 3. PayTm (One of the largest, if not the largest digital payments app in India) Did you mean that largest digital payments company which integrated the PoS facility on the merchant's app and the customers were asked to enter their credit/debit card details manually?[2] [1] https://twitter.com/Abishek_Muthian/status/1406964960081571845 https://twitter.com/Abishek_Muthian/status/14069649600815718... [2] https://abishekmuthian.com/paytm-says-to-me-that-its-pos-feature-didn-t-have-a-security-risk-8fd7c3849e54/ https://abishekmuthian.com/paytm-says-to-me-that-its-pos-fea...
- andi999 5y ago
  So who has to pay up. What I mean, let's say your cc data gets stolen and somebody draws money from your card, can't you just initiate a charge back?
  - Abishek_Muthian 5y ago
    Although charge back mechanisms exists for merchant transactions, I don't know of anyone who had got back their money lost through the theft of their card data. I wouldn't be surprised if VISA/MASTER/AMEX don't have such liabilities in India as they do in US/Europe. I had a conversation with cyber-crime police reg the aforementioned SMS scam using ngrok, They mentioned that many in my city have lost huge sums of money through it and the scam is not just for stealing bank credentials, the attacker's application tries to exploit victim's system and had successfully installed RAT. Successive Indian Govt. have been at loggerheads with VISA/MASTER duopoly and have successfully derailed it for domestic payments, Now Unified Payments Interface(UPI)[1] which works with payment apps has more transactions than debit/CC. So the domestic criminals have largely switched to UPI/Bank account based scams. Occasionally some of these criminals get caught and some get their money back. [1] https://timesofindia.indiatimes.com/business/india-business/cash-no-longer-king-upi-transactions-up-70-times-in-last-4-years-debit-card-transactions-dip/articleshow/88116060.cms https://timesofindia.indiatimes.com/business/india-business/...
unbanned 5y ago
And yet people still think hiring Indian software and IT engineers is a good idea. This is not a racist thing. So don't disagree because it hurts someone else's assumed feelings. There is a significant gap in that sort of knowledge there.
- neya 5y ago
  I disagree with this premise, I have worked across many countries and I can tell you bad script kiddies and programmers exist universally, everywhere. It just so happens the population of India and China are quite large compared to the rest of the world, so they're more easily visible. I have worked with some of the best talent from these nations as well, so I would be very hesitant to attach a particular country to it.
- aniforprez 5y ago
  "assumed feelings"? Does that somehow magically excuse racist statements like this? Good engineers are everywhere. Bad engineers are everywhere
  - deleted 5y ago
    [deleted]
- deleted 5y ago
  [deleted]
pronlover723 5y ago
What is this Apple email masking service? I keep reading about it but every time I pick "Apple Pay" to pay some service it tells me it's going to give them my icloud address and it gives me no option to choose "mask my email" or anything remotely related or giving some alternate email
- dewey 5y ago
  It's called "Hide My Email" and you can use it to sign up to services in apps: https://support.apple.com/en-us/HT210425 https://support.apple.com/en-us/HT210425
  - pronlover723 5y ago
    Ah, so it doesn't work for purchases
kashif 5y ago
This is not all that - this is a push to move people to digital wallets such as PayTM (more crony capitalism) The fix for the problems you highlight is a audit and stringent rule of law.
deleted 5y ago
[deleted]
ehnto 5y ago
I have spent a long time in eComm in the west, and you see that kind of stuff there as well. The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance. Thousands of credit card numbers were just sitting there for the taking, in plain text, in plain sight.
- chefandy 5y ago
  Indeed, astonishing retail-level security shenanigans will happen anywhere relying on simple credit card numbers. That said, the attack surface of a piece of paper is vastly smaller than a web-app-connected database.
- fishtacos 5y ago
  Not quite as egregious, but when I worked in QA for an internally accessible, hospital record keeping web app, most of the "test" data was real customer data, and OBVIOUSLY I had complete access to prod with no particular oversight (although I'm certain logging was enabled) for HIPPA. Still, glad it was available, as going through approval processes would've been a nightmare for our implementations.
  - Tempest1981 5y ago
    > going through approval processes would've been a nightmare So internal apps can skip the HIPPA approval process? Or everyone can?
  - coldcode 5y ago
    The healthcare place I worked (mid 00's) kept all the prod passwords in a text file accessible to half the company. No auditing of logins into those servers either, so who knows what was leaked.
- spookthesunset 5y ago
  > The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance Back in my younger days, I've implemented exactly such a system. Looking back, it seems like a "WTF where you thinking" but somehow it made sense back then. What is obvious practice now took 20+ years of internet evolution to reach. I've also worked for companies that: - Stored user passwords in plaintext so you can email the customer their password if they forgot - Stored the CVV so "we could issue refunds" - Accidentally created anonymous email relays using copy & paste code from some "how do I create a webform in PHP" site. - Test data was simply a mirror of production - Test servers would send real emails to real customers (because the test data was a prod mirror) There are probably some other atrocities I've been exposed to but those are the highlights. Oh yeah, forgot one: - To "save money" on hard drives for "the server" we did a RAID0 array. Works great until one of the disks die and you loose everything. (This was my own dumb fault though). Live and learn I guess!
randombits0 5y ago
I’m a PCI QSA and this is exactly correct. No one should store card data for recurring transactions. India just made it a law. Good for them.
txtsd 5y ago
How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?
- the_other 5y ago
  Cost.
  - nmstoker 5y ago
    It's really cost plus a chance they'll get away with it (or the team/mgr hiring will have moved on by the time it's found out). If it were cost but they were guaranteed to get caught they wouldn't do it.
- LeonM 5y ago
  The issue is often that: 1. The vendor is not aware that this is a problem 2. As a result of point 1, the vendor does not have budget planned for this. 3. The reward for the investment does not make sense for most of the vendors. About point 3: For the vendor, there is no tangible improvement in sales (in fact, some security measures raise the barrier for their customers to place an order). So why should they do it? In their experience, the budget is better spent on improving the customer experience, marketing, increasing stock, lowering prices, etc. Point 3 is really tricky, especially in some cultures and countries. If there is no legal consequence for leaking customer data, why should they be spending money on preventing something that may or may not happen in the future?
chakkepolja 5y ago
> (As an aside) - As a personal mission, I started touring around the country teaching college kids for free about basics of web development, security, etc. But, still, I have a long way to go. Kudos for doing God's work! As someone who studied in India, I think youtube videos might have a better reach with Indian student audience. There is so many mediocre content out there on YouTube and high-SEO sites like GFG (they are kinda fine for algorithm / Leetcode stuff but I can't stand their student-contributed code for anything else). A higher quality de-facto tutorial series might make a better impact. But of course promoting is important.

by neya 5y ago

paxys 5y ago

That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. India is also the top 7-8 e-commerce market in the world. Large local apps in the space have valuations in the tens of billions of dollars, and all major global players like Amazon and Walmart are involved in the country as well. These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry.

deathtrader666 5y ago
Yes, but large valuations don't correlate with better security practices.. Obviously the person above isn't talking about Amazon or Walmart when referring to "script kiddies". Of the nearly 45-50 contract jobs I've seen, a lot of them use pirated WP or Magento plugins, and plain text storage of sensitive content.
- sidm83 5y ago
  Again, generalization. What you're talking about mostly refers to small time sites with maybe not more than few dozen orders a day. Typical ecommerce businesses (usually the kind with at least 100s or 1000s of orders a day) write their own code rather than using WP plugins. As far as PCI DSS goes, there are multiple levels. Even at the tier 2 Indian ecom company I used to work at, we did not store any card info, it was just submitted in an iframe rendered by the payment gateway. And even then we were subjected to annual/semi-annual security audits (this was in addition to quarterly external security audits we ordered ourselves apart from typical OWASP top 10 checks performed by QAs in weekly sprints).
yjftsjthsd-h 5y ago
> That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies. > These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry. Those are less connected than you think; loads of companies run obscenely large monetary transactions and essential business processes with horrifying hacked-up systems (50k LoC files, 20-year-old Perl scripts that nobody understands, Solaris 2.x desktop in the maintenance closet...); utility and good code are less correlated than we wish.
- dewey 5y ago
  "such that US companies have to care about PCI more than Indian companies." If you think about the social security number system, paper checks or credit cards with magnet strips I think you'll notice that other countries sometimes have stricter and more advanced security regulations.

powerapple 5y ago

Agree. There is really no way of knowing which website has my credit information now (I choose not to save credit details anyway). I wish all websites can ask permission every year to hold my information.

NavinF 5y ago

I agree as long as merchant banks let you transfer tokenized cards to a new provider. Otherwise businesses will get locked into one provider for recurring billing. (No, this doesn’t make tokenized cards as dangerous as card numbers. Transferring a merchant account is a whole process. Not to mention that when a breach happens, you can cancel one merchant’s tokens without forcing every customer to get new cards)

Abishek_Muthian 5y ago

RBI(Central bank) has been filling-up for a long time for the total lack of security practices by merchants & data-privacy laws. e.g. One can control how much money can be withdrawn from the credit/debit card per-day according to domestic/International merchants/online/physical/ATM/ etc. through net-banking with the minimum in the multiples of INR 1000. So even if the card data gets stolen, Criminals can utmost withdraw only the minimum amount in the other part of the world. But unfortunately due to the digital-divide, Not many have access or awareness of such facilities and hence control over card data is required. IMO the single point of failure for India's financial security is its extraordinary dependence on mobile number for 2FA, Even security conscious customers can do little against SIM jacking attacks, But for those who are not security conscious; all it requires is a social engineered SMS with ngrok URL[1] or Phone call asking for that OTP. Please write to RBI and demand your bank to support hardware tokens (or) at least TOTP. > 3. PayTm (One of the largest, if not the largest digital payments app in India) Did you mean that largest digital payments company which integrated the PoS facility on the merchant's app and the customers were asked to enter their credit/debit card details manually?[2] [1] https://twitter.com/Abishek_Muthian/status/1406964960081571845 https://twitter.com/Abishek_Muthian/status/14069649600815718... [2] https://abishekmuthian.com/paytm-says-to-me-that-its-pos-feature-didn-t-have-a-security-risk-8fd7c3849e54/ https://abishekmuthian.com/paytm-says-to-me-that-its-pos-fea...

andi999 5y ago
So who has to pay up. What I mean, let's say your cc data gets stolen and somebody draws money from your card, can't you just initiate a charge back?
- Abishek_Muthian 5y ago
  Although charge back mechanisms exists for merchant transactions, I don't know of anyone who had got back their money lost through the theft of their card data. I wouldn't be surprised if VISA/MASTER/AMEX don't have such liabilities in India as they do in US/Europe. I had a conversation with cyber-crime police reg the aforementioned SMS scam using ngrok, They mentioned that many in my city have lost huge sums of money through it and the scam is not just for stealing bank credentials, the attacker's application tries to exploit victim's system and had successfully installed RAT. Successive Indian Govt. have been at loggerheads with VISA/MASTER duopoly and have successfully derailed it for domestic payments, Now Unified Payments Interface(UPI)[1] which works with payment apps has more transactions than debit/CC. So the domestic criminals have largely switched to UPI/Bank account based scams. Occasionally some of these criminals get caught and some get their money back. [1] https://timesofindia.indiatimes.com/business/india-business/cash-no-longer-king-upi-transactions-up-70-times-in-last-4-years-debit-card-transactions-dip/articleshow/88116060.cms https://timesofindia.indiatimes.com/business/india-business/...

unbanned 5y ago

And yet people still think hiring Indian software and IT engineers is a good idea. This is not a racist thing. So don't disagree because it hurts someone else's assumed feelings. There is a significant gap in that sort of knowledge there.

neya 5y ago
I disagree with this premise, I have worked across many countries and I can tell you bad script kiddies and programmers exist universally, everywhere. It just so happens the population of India and China are quite large compared to the rest of the world, so they're more easily visible. I have worked with some of the best talent from these nations as well, so I would be very hesitant to attach a particular country to it.
aniforprez 5y ago
"assumed feelings"? Does that somehow magically excuse racist statements like this? Good engineers are everywhere. Bad engineers are everywhere
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]

pronlover723 5y ago

What is this Apple email masking service? I keep reading about it but every time I pick "Apple Pay" to pay some service it tells me it's going to give them my icloud address and it gives me no option to choose "mask my email" or anything remotely related or giving some alternate email

dewey 5y ago
It's called "Hide My Email" and you can use it to sign up to services in apps: https://support.apple.com/en-us/HT210425 https://support.apple.com/en-us/HT210425
- pronlover723 5y ago
  Ah, so it doesn't work for purchases

kashif 5y ago

This is not all that - this is a push to move people to digital wallets such as PayTM (more crony capitalism) The fix for the problems you highlight is a audit and stringent rule of law.

deleted 5y ago

[deleted]

ehnto 5y ago

I have spent a long time in eComm in the west, and you see that kind of stuff there as well. The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance. Thousands of credit card numbers were just sitting there for the taking, in plain text, in plain sight.

chefandy 5y ago
Indeed, astonishing retail-level security shenanigans will happen anywhere relying on simple credit card numbers. That said, the attack surface of a piece of paper is vastly smaller than a web-app-connected database.
fishtacos 5y ago
Not quite as egregious, but when I worked in QA for an internally accessible, hospital record keeping web app, most of the "test" data was real customer data, and OBVIOUSLY I had complete access to prod with no particular oversight (although I'm certain logging was enabled) for HIPPA. Still, glad it was available, as going through approval processes would've been a nightmare for our implementations.
- Tempest1981 5y ago
  > going through approval processes would've been a nightmare So internal apps can skip the HIPPA approval process? Or everyone can?
- coldcode 5y ago
  The healthcare place I worked (mid 00's) kept all the prod passwords in a text file accessible to half the company. No auditing of logins into those servers either, so who knows what was leaked.
spookthesunset 5y ago
> The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance Back in my younger days, I've implemented exactly such a system. Looking back, it seems like a "WTF where you thinking" but somehow it made sense back then. What is obvious practice now took 20+ years of internet evolution to reach. I've also worked for companies that: - Stored user passwords in plaintext so you can email the customer their password if they forgot - Stored the CVV so "we could issue refunds" - Accidentally created anonymous email relays using copy & paste code from some "how do I create a webform in PHP" site. - Test data was simply a mirror of production - Test servers would send real emails to real customers (because the test data was a prod mirror) There are probably some other atrocities I've been exposed to but those are the highlights. Oh yeah, forgot one: - To "save money" on hard drives for "the server" we did a RAID0 array. Works great until one of the disks die and you loose everything. (This was my own dumb fault though). Live and learn I guess!

randombits0 5y ago

I’m a PCI QSA and this is exactly correct. No one should store card data for recurring transactions. India just made it a law. Good for them.

txtsd 5y ago

How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?

the_other 5y ago
Cost.
- nmstoker 5y ago
  It's really cost plus a chance they'll get away with it (or the team/mgr hiring will have moved on by the time it's found out). If it were cost but they were guaranteed to get caught they wouldn't do it.
LeonM 5y ago
The issue is often that: 1. The vendor is not aware that this is a problem 2. As a result of point 1, the vendor does not have budget planned for this. 3. The reward for the investment does not make sense for most of the vendors. About point 3: For the vendor, there is no tangible improvement in sales (in fact, some security measures raise the barrier for their customers to place an order). So why should they do it? In their experience, the budget is better spent on improving the customer experience, marketing, increasing stock, lowering prices, etc. Point 3 is really tricky, especially in some cultures and countries. If there is no legal consequence for leaking customer data, why should they be spending money on preventing something that may or may not happen in the future?

chakkepolja 5y ago

> (As an aside) - As a personal mission, I started touring around the country teaching college kids for free about basics of web development, security, etc. But, still, I have a long way to go. Kudos for doing God's work! As someone who studied in India, I think youtube videos might have a better reach with Indian student audience. There is so many mediocre content out there on YouTube and high-SEO sites like GFG (they are kinda fine for algorithm / Leetcode stuff but I can't stand their student-contributed code for anything else). A higher quality de-facto tutorial series might make a better impact. But of course promoting is important.