5 ms·

Do remember that for every real serious problem such as this, American Express and any other large company receives a hundred or a thousand calls for non-issues

by T-hawk 15y ago

Do remember that for every real serious problem such as this, American Express and any other large company receives a hundred or a thousand calls for non-issues like phishing or minor issues like a compromised card number to cancel and reissue. The system is optimized for these common cases; the edge case of a real public vulnerability will require extra effort and it's not a failing of Amex that the system is so.

leif 15y ago
when the cost of a false negative is so damn high, you'd think they would know not to filter so aggressively
- bnr 15y ago
  at some point, all the people dealing with the false positives will be costlier.
  - stygianguest 15y ago
    Seriously? I won't take American Express anytime soon, I can tell you that. If this gets picked up in mainstream media, it is devastating.
    - bdr 15y ago
      More likely: people will be assured the problem is fixed, and then not care.
  - leif 15y ago
    Let me rephrase: you'd hope they would know...
- mst 15y ago
  If they didn't filter aggressively, that would mean that their more technical staff would be deluged with crap. And then quit. I was operations/development at an ISP once, had three layers of acceptably competent support techs between the customer and I and a serious reputation as a fire breathing dragon if a non-issue was escalated to me - but -still- regularly lost half my day dealing with escalated "urgent problems" that were neither.
TallGuyShort 15y ago
I agree in principle, but a core part of their business is maintaining the integrity of a system. When you combine this with some of the statements they have made regarding their password policy, it makes me as a paying customer very concerned about their approach to cyber-security. THey have excellent fraud prevention, but I'd really like to see them make some strides in this area.
wnight 15y ago
> it's not a failing of Amex that the system is so. Actually, it is. They failed. Their system was open for years in secret, and at least hours after someone tried to point out the problem to them. It's not the CS rep's fault. But it is their boss's fault, all the way up to the top.
- T-hawk 15y ago
  You misinterpreted me. What I said is that the extra effort needed to report this vulnerability isn't a fault of the Amex customer service system. Of course it's a faulty deployment process that allowed this to happen in the first place. But as far as escalating a trouble report from an ordinary consumer, what happened does seem pretty reasonable. Flip it around: what if Amex (or any other large company) made it easy to escalate everything to a technologically capable supervisor right away? Those supervisors would be deluged in uninformed, irrelevant, and just plain wrong security reports. Filtering out the signal from the noise in the security landscape is a monumental task in itself. As tech savvy hackers, we always think we're entitled to say "I know what I'm doing so escalate me over the idiots", but how does a company or CSR tell whether that's actually true?
  - nopassrecover 15y ago
    I would assume a credit card company or bank had a technical security support team.
  - pak 15y ago
    You are absolutely correct. The dozen or so hackers in this thread that expect that "security vulnerability" is some magic keyword that gets you talking to the head technical honcho of the security group have probably never answered phone calls for a big company. Phone support for somebody like AmEx is a huge burden of cost and manpower; the structure of the tree has been set firmly in place since the 1980's to take care of the most common 90% of issues using the least-paid person available. I'm sorry, if you're in the long tail you will just have to expect to wait extra. That goes double if you are not a cardmember (read: paying customer). I am surprised that the above person in Australia got through at all, and that the CSR had latitude to try to spend time replicating the issue. In my opinion, for a credit card company, 20 minutes and a positive conclusion for a matter as rare as reporting a webapp vulnerability is a success. Sure, none of you should be thrilled about the situation because as technically-oriented people with generous motives the system is not set up to serve you. But that's not a failure of the system, except maybe from your own individual perspective. Believe me, AmEx has done the cost-benefit analysis and they are saving boatloads of money by having those rare well-intentioned hackers listen to some hold music, because it is too expensive to sort you out from the thousands of loonies that got a phishing email. Security breaches are an acknowledged risk and they are already prepared to absorb their effects on multiple levels.

by T-hawk 15y ago

leif 15y ago

when the cost of a false negative is so damn high, you'd think they would know not to filter so aggressively

bnr 15y ago
at some point, all the people dealing with the false positives will be costlier.
- stygianguest 15y ago
  Seriously? I won't take American Express anytime soon, I can tell you that. If this gets picked up in mainstream media, it is devastating.
  - bdr 15y ago
    More likely: people will be assured the problem is fixed, and then not care.
- leif 15y ago
  Let me rephrase: you'd hope they would know...
mst 15y ago
If they didn't filter aggressively, that would mean that their more technical staff would be deluged with crap. And then quit. I was operations/development at an ISP once, had three layers of acceptably competent support techs between the customer and I and a serious reputation as a fire breathing dragon if a non-issue was escalated to me - but -still- regularly lost half my day dealing with escalated "urgent problems" that were neither.

TallGuyShort 15y ago

I agree in principle, but a core part of their business is maintaining the integrity of a system. When you combine this with some of the statements they have made regarding their password policy, it makes me as a paying customer very concerned about their approach to cyber-security. THey have excellent fraud prevention, but I'd really like to see them make some strides in this area.

wnight 15y ago

> it's not a failing of Amex that the system is so. Actually, it is. They failed. Their system was open for years in secret, and at least hours after someone tried to point out the problem to them. It's not the CS rep's fault. But it is their boss's fault, all the way up to the top.

T-hawk 15y ago
You misinterpreted me. What I said is that the extra effort needed to report this vulnerability isn't a fault of the Amex customer service system. Of course it's a faulty deployment process that allowed this to happen in the first place. But as far as escalating a trouble report from an ordinary consumer, what happened does seem pretty reasonable. Flip it around: what if Amex (or any other large company) made it easy to escalate everything to a technologically capable supervisor right away? Those supervisors would be deluged in uninformed, irrelevant, and just plain wrong security reports. Filtering out the signal from the noise in the security landscape is a monumental task in itself. As tech savvy hackers, we always think we're entitled to say "I know what I'm doing so escalate me over the idiots", but how does a company or CSR tell whether that's actually true?
- nopassrecover 15y ago
  I would assume a credit card company or bank had a technical security support team.
- pak 15y ago
  You are absolutely correct. The dozen or so hackers in this thread that expect that "security vulnerability" is some magic keyword that gets you talking to the head technical honcho of the security group have probably never answered phone calls for a big company. Phone support for somebody like AmEx is a huge burden of cost and manpower; the structure of the tree has been set firmly in place since the 1980's to take care of the most common 90% of issues using the least-paid person available. I'm sorry, if you're in the long tail you will just have to expect to wait extra. That goes double if you are not a cardmember (read: paying customer). I am surprised that the above person in Australia got through at all, and that the CSR had latitude to try to spend time replicating the issue. In my opinion, for a credit card company, 20 minutes and a positive conclusion for a matter as rare as reporting a webapp vulnerability is a success. Sure, none of you should be thrilled about the situation because as technically-oriented people with generous motives the system is not set up to serve you. But that's not a failure of the system, except maybe from your own individual perspective. Believe me, AmEx has done the cost-benefit analysis and they are saving boatloads of money by having those rare well-intentioned hackers listen to some hold music, because it is too expensive to sort you out from the thousands of loonies that got a phishing email. Security breaches are an acknowledged risk and they are already prepared to absorb their effects on multiple levels.