4 ms·

How Visa Protects Your Data

56 points by bwag 15y ago

freejack 15y ago
Meanwhile, outside their data centre, they do very little to ensure customer card security and enforce heavy-handed policies that put most of the risk on merchants and downstream processors. --- obDisclosure: I am a merchant who has been defrauded hundreds of thousands of dollars and have no love for the credit card companies.
- freejack 15y ago
  Instead of ranting about it here, I thought it might be more appropriate to enumerate my primary concerns in a post to my blog - http://www.byte.org/2011/10/28/the-visa-shakedown/ http://www.byte.org/2011/10/28/the-visa-shakedown/
cstone 15y ago
"This is Visa's OCE, or Operations Center East, the biggest, newest, and most advanced of its U.S. data centers. It is a data-security heaven--and Visa's acknowledgment that hackers are increasingly savvy, that data is an ever-desirable black-market commodity, and that the best way to keep Visa (and its 150 million daily transactions) safe is to ensconce its network inside a heavily fortified castle that instantly responds to threats. The OCE's 130 workers have two jobs: Keep hackers out and keep the network up, no matter what. That's why rule No. 1 for visitors is: Never reveal its location. "On the eastern seaboard" is as specific as Visa will allow." uhh, right. two articles from the 90s put it in mclean, va: http://www.recordnet.com/apps/pbcs.dll/article?AID=/19940101/A_NEWS/301018211 http://www.recordnet.com/apps/pbcs.dll/article?AID=/19940101... http://news.google.com/newspapers?nid=1298&dat=19931218&id=Z14zAAAAIBAJ&sjid=mAcGAAAAIBAJ&pg=4684,3600394 http://news.google.com/newspapers?nid=1298&dat=19931218&...
- freejack 15y ago
  according to this profile, it may have move to herndon. http://www.linkedin.com/profile/view?id=59159289&authType=OUT_OF_NETWORK&authToken=UZgy&locale=en_US&srchid=43074055-cfe0-4618-adde-c9071e62c95b-0&srchindex=4&srchtotal=57&goback=%2Efps_PBCK_visa+oce_*1_*1_*1_*1_*1_*1_*2_*1_Y_*1_*1_*1_false_1_R_*1_*51_*1_*51_true_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2&pvs=ps&trk=pp_profile_name_link http://www.linkedin.com/profile/view?id=59159289&authTyp...
munin 15y ago
the mantraps and hand scanners sound insane to I guess all normal people, but in my experience that is a pretty standard level of security. I have a few 1U servers co-located and I have to pass through multiple mantraps with palm readers to access them.
- krobertson 15y ago
  Agreed. Was reading through their "measures" and pretty much everything is standard process/equipment for your typical medium to high end data center. Man traps, batteries, generators, water cooling, avoid corrosion (uhh duh). The only things I think they have I haven't seen before: 1) The concrete barrier and hair pin turn. Most data centers don't fear James Bond. 2) The air lifted mailroom.
steve8918 15y ago
This really doesn't sound like Visa protecting my data. It sounds more like Visa having enough horsepower and backups so that they can keep their company continuously running. Not that that's a bad thing, but I really don't believe they care about protecting our data. From personal experience, they seem to let any type of fraud occur on your credit card, and then if you protest, then they might reverse the charges. And then they issue you a new credit card number. They would prefer to fix the problem before, putting the onus on us to determine if fraud occurred, rather than actually prevent the fraud and protect our data.
- pyre 15y ago
  Even when fraud occurs they are not interested in going after the source unless that dollar amounts are high enough. I know this from personal experience on an e-commerce site. We detected blatant fraud happening, and the banks/card companies/processors don't care because the scale is too small. (lots of ~$100 purchases on many, many credit cards all to the same two or 3 addresses)
CWIZO 15y ago
That's cool. But after just returning from a month long road trip across USA (I'm from Slovenia), I'm simply baffled by the lack of security when I'm paying with my Visa card. In 97% of times I just swiped my card and the transaction was done. 1% of the time the cashier bothered to check my ID, 1% of the time I had to sign the check, and in 1% of the time I had to enter my PIN number. What the hell? I'm surprised any of you yanks still have any money left, considering how easy one can take all your money, if one comes into possession of your card. Here you always have to at least sign the card (and the cashier checks the signature against the one on the card), but in most cases you have to enter your PIN number. And I live in fricking Slovenia who was, just 5 minutes ago, a part of a communist union ... Anybody has an explanation for this lack of security in the states?
- stilkov 15y ago
  Can't explain this, other than what do you expect from a country that's still using checks? FWIW, Germany is similar to your country in this regard - entirely impossible to pay with your credit card anywhere without at least a signature.
- freejack 15y ago
  I live in Canada, and practices are all over the place here as well. Sometimes its chip & PIN, other times its swipe & run. Some places require a signature, some don't. These are just some of the basic pitfalls in the security model I referred to in another comment on this article and its crazy how VISA forces the costs back onto customers and merchants...
- Wilduck 15y ago
  For small transactions you often don't have to sign anything or enter a PIN. I think the rational is that it would be fairly hard for someone to drain all your funds with < $20 transactions. Hopefully I'd realize fairly soon that my card was stolen/missing, and would call to cancel it. Also, Visa tracks your purchasing habits to an insane degree. More than once I've gotten a phone call asking if I actually bought some item. Finally, I likely wouldn't be liable for much if any of the goods purchased with a stolen card. So, all in all, I'm not terribly worried about that end of the security.
powertower 15y ago
Does anyone know if the Fire Code specifies that "mantraps" have to open in a fire alarm? You should have to have an open path out in that type of a situation.
andrewcooke 15y ago
here it is - you can see the bend and pool. http://maps.google.cl/maps?q=45005+Russell+Branch+Pkwy,+Ashburn,+VA+20147&ll=39.050654,-77.446444&spn=0.001262,0.001725&hnear=45005+Russell+Branch+Pkwy,+Ashburn,+Virginia+20147,+United+States&gl=cl&t=h&z=19&vpsrc=6 http://maps.google.cl/maps?q=45005+Russell+Branch+Pkwy,+Ashb... (from looking at job ads)
- sunchild 15y ago
  That is hilarious. Thank you for putting this extreme hubris in its place!

56 points by bwag 15y ago

Meanwhile, outside their data centre, they do very little to ensure customer card security and enforce heavy-handed policies that put most of the risk on merchants and downstream processors. --- obDisclosure: I am a merchant who has been defrauded hundreds of thousands of dollars and have no love for the credit card companies.

freejack 15y ago
Instead of ranting about it here, I thought it might be more appropriate to enumerate my primary concerns in a post to my blog - http://www.byte.org/2011/10/28/the-visa-shakedown/ http://www.byte.org/2011/10/28/the-visa-shakedown/

cstone 15y ago

"This is Visa's OCE, or Operations Center East, the biggest, newest, and most advanced of its U.S. data centers. It is a data-security heaven--and Visa's acknowledgment that hackers are increasingly savvy, that data is an ever-desirable black-market commodity, and that the best way to keep Visa (and its 150 million daily transactions) safe is to ensconce its network inside a heavily fortified castle that instantly responds to threats. The OCE's 130 workers have two jobs: Keep hackers out and keep the network up, no matter what. That's why rule No. 1 for visitors is: Never reveal its location. "On the eastern seaboard" is as specific as Visa will allow." uhh, right. two articles from the 90s put it in mclean, va: http://www.recordnet.com/apps/pbcs.dll/article?AID=/19940101/A_NEWS/301018211 http://www.recordnet.com/apps/pbcs.dll/article?AID=/19940101... http://news.google.com/newspapers?nid=1298&dat=19931218&id=Z14zAAAAIBAJ&sjid=mAcGAAAAIBAJ&pg=4684,3600394 http://news.google.com/newspapers?nid=1298&dat=19931218&...

freejack 15y ago
according to this profile, it may have move to herndon. http://www.linkedin.com/profile/view?id=59159289&authType=OUT_OF_NETWORK&authToken=UZgy&locale=en_US&srchid=43074055-cfe0-4618-adde-c9071e62c95b-0&srchindex=4&srchtotal=57&goback=%2Efps_PBCK_visa+oce_*1_*1_*1_*1_*1_*1_*2_*1_Y_*1_*1_*1_false_1_R_*1_*51_*1_*51_true_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2_*2&pvs=ps&trk=pp_profile_name_link http://www.linkedin.com/profile/view?id=59159289&authTyp...

munin 15y ago

the mantraps and hand scanners sound insane to I guess all normal people, but in my experience that is a pretty standard level of security. I have a few 1U servers co-located and I have to pass through multiple mantraps with palm readers to access them.

krobertson 15y ago
Agreed. Was reading through their "measures" and pretty much everything is standard process/equipment for your typical medium to high end data center. Man traps, batteries, generators, water cooling, avoid corrosion (uhh duh). The only things I think they have I haven't seen before: 1) The concrete barrier and hair pin turn. Most data centers don't fear James Bond. 2) The air lifted mailroom.

steve8918 15y ago

This really doesn't sound like Visa protecting my data. It sounds more like Visa having enough horsepower and backups so that they can keep their company continuously running. Not that that's a bad thing, but I really don't believe they care about protecting our data. From personal experience, they seem to let any type of fraud occur on your credit card, and then if you protest, then they might reverse the charges. And then they issue you a new credit card number. They would prefer to fix the problem before, putting the onus on us to determine if fraud occurred, rather than actually prevent the fraud and protect our data.

pyre 15y ago
Even when fraud occurs they are not interested in going after the source unless that dollar amounts are high enough. I know this from personal experience on an e-commerce site. We detected blatant fraud happening, and the banks/card companies/processors don't care because the scale is too small. (lots of ~$100 purchases on many, many credit cards all to the same two or 3 addresses)

CWIZO 15y ago

That's cool. But after just returning from a month long road trip across USA (I'm from Slovenia), I'm simply baffled by the lack of security when I'm paying with my Visa card. In 97% of times I just swiped my card and the transaction was done. 1% of the time the cashier bothered to check my ID, 1% of the time I had to sign the check, and in 1% of the time I had to enter my PIN number. What the hell? I'm surprised any of you yanks still have any money left, considering how easy one can take all your money, if one comes into possession of your card. Here you always have to at least sign the card (and the cashier checks the signature against the one on the card), but in most cases you have to enter your PIN number. And I live in fricking Slovenia who was, just 5 minutes ago, a part of a communist union ... Anybody has an explanation for this lack of security in the states?

stilkov 15y ago
Can't explain this, other than what do you expect from a country that's still using checks? FWIW, Germany is similar to your country in this regard - entirely impossible to pay with your credit card anywhere without at least a signature.
freejack 15y ago
I live in Canada, and practices are all over the place here as well. Sometimes its chip & PIN, other times its swipe & run. Some places require a signature, some don't. These are just some of the basic pitfalls in the security model I referred to in another comment on this article and its crazy how VISA forces the costs back onto customers and merchants...
Wilduck 15y ago
For small transactions you often don't have to sign anything or enter a PIN. I think the rational is that it would be fairly hard for someone to drain all your funds with < $20 transactions. Hopefully I'd realize fairly soon that my card was stolen/missing, and would call to cancel it. Also, Visa tracks your purchasing habits to an insane degree. More than once I've gotten a phone call asking if I actually bought some item. Finally, I likely wouldn't be liable for much if any of the goods purchased with a stolen card. So, all in all, I'm not terribly worried about that end of the security.

powertower 15y ago

Does anyone know if the Fire Code specifies that "mantraps" have to open in a fire alarm? You should have to have an open path out in that type of a situation.

andrewcooke 15y ago

here it is - you can see the bend and pool. http://maps.google.cl/maps?q=45005+Russell+Branch+Pkwy,+Ashburn,+VA+20147&ll=39.050654,-77.446444&spn=0.001262,0.001725&hnear=45005+Russell+Branch+Pkwy,+Ashburn,+Virginia+20147,+United+States&gl=cl&t=h&z=19&vpsrc=6 http://maps.google.cl/maps?q=45005+Russell+Branch+Pkwy,+Ashb... (from looking at job ads)

sunchild 15y ago
That is hilarious. Thank you for putting this extreme hubris in its place!