EDIT: I may have spoken too soon on the below; I checked myself, and the journalist's test card numbers in the OP do not, in fact, pass the Luhn algorithm! So p

EDIT: I may have spoken too soon on the below; I checked myself, and the journalist's test card numbers in the OP do not, in fact, pass the Luhn algorithm! So perhaps some grace is deserved. But I'm preserving my comment below, if anything to be illustrative of how companies should approach this, and that if you want your product to be secure from criticism from journalists who don't know how to make test credit card numbers, you should possibly use even more robust approaches than what one random person on HN comes up with in real time. === But these are incredibly solvable problems! If a series of digits on screen passes the Luhn algorithm (https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm), or matches AAA-BB-CCCC, prevent that screen/area from being captured! And Microsoft literally owns the code for https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning https://docs.github.com/en/code-security/secret-scanning/int... for determining other high-entropy secrets. We're not nearly at the level of https://xkcd.com/1425/ https://xkcd.com/1425/ - and even that canonical example has been entirely solved by now. The problem isn't that these things are fundamentally impossible. And the problem isn't even that Microsoft decided speed to market was more important than safeguarding their users' data - I get speed to market! The problem, allegedly, is that Microsoft said these things were fixed without actually fixing them [EDIT: see above], and didn't think that their users' data was important enough to assign a red team or even an empowered SDET to do even the simple tests this journalist did before making that announcement.