5 ms·

Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did sec

by WA 5y ago

Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did security consulting and we knew a shop or two where it was possible to enumerate the CCVs without submitting an order and without being blocked. Not sure if this is still valid nowadays, but it blew my mind as well.

captn3m0 5y ago
Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.
- lillecarl 5y ago
  As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.
  - hdjjhhvvhga 5y ago
    > impossible Absolute quantifiers shouldn't be used in the context of cybersecurity. Yes, it's more difficult and would most likely require a SIM swap. But there are some gullible people who willfully gave their one-time code to attackers identifying as their bank after some initial groundwork had been done (calling them previously from a number identifying as their bank and warning of a fraud, the victim verifying the number is correct, the attacker calling again and redirecting them to a form requiring a validation with the code).
    - lillecarl 5y ago
      > impossible to steal money from me without these things First of all, "stripe" pushes information to the BankID app asking for confirmation, there's no code to input to the site, the verification happens on my phone where I'm asked if i wanna authenticate X or Y to happen (logging in, or transferring money) But yes, they actually saw an attack vector where people could be fake challenged at the same time they're logging in themselves if someone knows they're about to log in. This was solved by putting a QR code on the Bank website (and others that have implemented this so far) to be scanned by the BankID app. So now to steal money you would have to pwn the HTTPS between the bank and "me" or pwn my browser, or pwn my entire machine. Also if you get 2 BankID challenges at the same time they cancel both of them. Anyways, point is that without my phone and my own personal code being entered after a challenge where I see who's challenging me it's impossible to get money out of my account. It's designed to be REALLY hard to be tricked into authenticating someone else. This system doesn't care about SIM swaps because it doesn't use the carrier network for anything other than encrypted communications with the BankID service. I don't think there's a more secure system deployed on this wide of a scale anywhere and I'm quite happy with it. It's a PITA if you lose your phone though since there's no fallback method other than getting a new smartphone. Nitpicking on words seems a bit below the standard of discussion I want to have though, and it seems like you thought it was just SMS verification. We're not cavemen across the pond, we're people just like you. A nice benefit of this system is that when I call my bank I'll input my social security number in the system and it'll challenge me with a BankID challenge meaning the bank person knows they're talking to me. It's useful for a lot of things and at the same time VERY privacy invasive. Also doesn't work without a connection on your phone, but we're quite connected here so it's usually fine. CC purchases in person are not authenticated with this system, we rely on the NFC thingy or chip. Magstrip isn't used anywhere here anymore. The bank covers all fradulent NFC charges without pin entry (which is why they're limited to 40$). If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks. We also have electronic mail via a system called "Kivra" that the government will send mail through to me so that i don't have to rely on someone not dropping my mail. Also privacy invasive of course, but quite convenient.
      - hdjjhhvvhga 5y ago
        > If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks. I'm not sure if it's the same technology as in Norwegian banks: https://link.springer.com/chapter/10.1007/978-3-540-85230-8_18 https://link.springer.com/chapter/10.1007/978-3-540-85230-8_...
        lillecarl 5y ago
        Paywalled paper from 2008 or am I missing something?
        hdjjhhvvhga 5y ago
        It turns out they are not the same thing[0], they just share the same name. The one you use in Sweden is different from the one in Norway that was cracked already in 2008 (and fixed somehow since then). I'm sure the one in Sweden will show its weaknesses sooner or later, all these systems do. Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1]. [0] https://en.wikipedia.org/wiki/Talk:BankID https://en.wikipedia.org/wiki/Talk:BankID [1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules/ https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...
        hdjjhhvvhga 5y ago
        Sorry, wrong link in [1]: https://www.thelocal.se/20180813/millions-of-kronor-stolen-in-spate-of-bankid-scams/ https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...
        lillecarl 5y ago
        Since then banks (at least my bank) has changed so that the Bank presents a QR code which I scan with the BankID app, meaning there's no "prewriting my social security number for a challenge". Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money. So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is. Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away. What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.
- deleted 5y ago
  [deleted]
- cailie 5y ago
  Wouldn't there be 1000 options?

by WA 5y ago

captn3m0 5y ago

Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.

lillecarl 5y ago
As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.
- hdjjhhvvhga 5y ago
  > impossible Absolute quantifiers shouldn't be used in the context of cybersecurity. Yes, it's more difficult and would most likely require a SIM swap. But there are some gullible people who willfully gave their one-time code to attackers identifying as their bank after some initial groundwork had been done (calling them previously from a number identifying as their bank and warning of a fraud, the victim verifying the number is correct, the attacker calling again and redirecting them to a form requiring a validation with the code).
  - lillecarl 5y ago
    > impossible to steal money from me without these things First of all, "stripe" pushes information to the BankID app asking for confirmation, there's no code to input to the site, the verification happens on my phone where I'm asked if i wanna authenticate X or Y to happen (logging in, or transferring money) But yes, they actually saw an attack vector where people could be fake challenged at the same time they're logging in themselves if someone knows they're about to log in. This was solved by putting a QR code on the Bank website (and others that have implemented this so far) to be scanned by the BankID app. So now to steal money you would have to pwn the HTTPS between the bank and "me" or pwn my browser, or pwn my entire machine. Also if you get 2 BankID challenges at the same time they cancel both of them. Anyways, point is that without my phone and my own personal code being entered after a challenge where I see who's challenging me it's impossible to get money out of my account. It's designed to be REALLY hard to be tricked into authenticating someone else. This system doesn't care about SIM swaps because it doesn't use the carrier network for anything other than encrypted communications with the BankID service. I don't think there's a more secure system deployed on this wide of a scale anywhere and I'm quite happy with it. It's a PITA if you lose your phone though since there's no fallback method other than getting a new smartphone. Nitpicking on words seems a bit below the standard of discussion I want to have though, and it seems like you thought it was just SMS verification. We're not cavemen across the pond, we're people just like you. A nice benefit of this system is that when I call my bank I'll input my social security number in the system and it'll challenge me with a BankID challenge meaning the bank person knows they're talking to me. It's useful for a lot of things and at the same time VERY privacy invasive. Also doesn't work without a connection on your phone, but we're quite connected here so it's usually fine. CC purchases in person are not authenticated with this system, we rely on the NFC thingy or chip. Magstrip isn't used anywhere here anymore. The bank covers all fradulent NFC charges without pin entry (which is why they're limited to 40$). If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks. We also have electronic mail via a system called "Kivra" that the government will send mail through to me so that i don't have to rely on someone not dropping my mail. Also privacy invasive of course, but quite convenient.
    - hdjjhhvvhga 5y ago
      > If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks. I'm not sure if it's the same technology as in Norwegian banks: https://link.springer.com/chapter/10.1007/978-3-540-85230-8_18 https://link.springer.com/chapter/10.1007/978-3-540-85230-8_...
      - lillecarl 5y ago
        Paywalled paper from 2008 or am I missing something?
        hdjjhhvvhga 5y ago
        It turns out they are not the same thing[0], they just share the same name. The one you use in Sweden is different from the one in Norway that was cracked already in 2008 (and fixed somehow since then). I'm sure the one in Sweden will show its weaknesses sooner or later, all these systems do. Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1]. [0] https://en.wikipedia.org/wiki/Talk:BankID https://en.wikipedia.org/wiki/Talk:BankID [1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-blocked-from-bankid-after-banks-roll-out-new-rules/ https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...
        hdjjhhvvhga 5y ago
        Sorry, wrong link in [1]: https://www.thelocal.se/20180813/millions-of-kronor-stolen-in-spate-of-bankid-scams/ https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...
        lillecarl 5y ago
        Since then banks (at least my bank) has changed so that the Bank presents a QR code which I scan with the BankID app, meaning there's no "prewriting my social security number for a challenge". Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money. So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is. Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away. What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.
deleted 5y ago
[deleted]
cailie 5y ago
Wouldn't there be 1000 options?