5 ms·

We need some technology that makes our Credit Card numbers change every few days. I am shocked that most people think it's OK these days to drop the "Oops, nas

by keyle 13y ago

We need some technology that makes our Credit Card numbers change every few days. I am shocked that most people think it's OK these days to drop the "Oops, nasty baddies bad bad got in and there goes your details, so so sorry, come again." If this happens to some small startup with the one PHP nerd that doesn't really know what he's doing (and is underpaid anyway) - that's fine. Or at least acceptable. You're living on the edge. But a Fortune 100 company... COM'ON.

keyle 13y ago
Is there a site that tracks all the hacked companies? This needs a ladder of shame. If we don't shine the light on this, things just won't get better.
- elliottcarlson 13y ago
  http://datalossdb.org/ http://datalossdb.org/
  - hnha 13y ago
    prompts to login everywhere. bah!
    - elliottcarlson 13y ago
      http://www.bugmenot.com/view/datalossdb.org http://www.bugmenot.com/view/datalossdb.org works for me
tlrobinson 13y ago
Some credit card companies let you generate expiring CC numbers for specific purchases, but that's a lot of work, and wouldn't work for recurring purchases (like Adobe Creative Cloud)
- nivla 13y ago
  >Some credit card companies let you generate expiring CC numbers. I know Citi Credit card lets you do that. > and wouldn't work for recurring purchases (like Adobe Creative Cloud) It could. If I remember correctly, Citi card lets generate three types of Virtual Cards. One based on the expiration (less than a month), another based on the maximum amount/balance (where expiration is about a year) and finally a combination of both. Virtual credit-cards are real handy especially when trying those 30 day trial services.
  - unclebucknasty 13y ago
    Yeah, AMEX used to allow one-time use numbers with its Platinum Corporate Card (maybe other cards as well). But, they stopped years ago. Don't know if it was hard to manage or if I was just the only one using it, but I loved it. Seems that another way to solve this for recurring payments would be to likewise issue a virtual number. But, only the merchant with a particular Merchant ID could apply a charge to that number. In general, it's actually a strange concept that we walk around with these wide open payment methods that only require that a dishonest person acquire a few bits of information to abuse with impunity.
    - tanzam75 13y ago
      > Yeah, AMEX used to allow one-time use numbers with its Platinum Corporate Card (maybe other cards as well). But, they stopped years ago. Don't know if it was hard to manage or if I was just the only one using it, but I loved it. Very few people used it But there is an additional problem, from American Express's point of view. Virtual credit card numbers are patented by Orbiscom, which was acquired by MasterCard in 2009.
      - unclebucknasty 13y ago
        Interesting. I wonder if non-virtual credit numbers are patented (i.e. the very idea of credit cards)? I'm sure I could look that up, but too lazy. Pretty ridiculous though. On a related note, I just came across this: http://storefrontbacktalk.com/securityfraud/the-big-three-credit-card-cos-aim-to-revamp-security/ http://storefrontbacktalk.com/securityfraud/the-big-three-cr... >Visa, MasterCard and American Express proposed new global standards to replace traditional account numbers with a digital payment “token” for online and mobile transactions. So, either they are licensing it from Orbiscom, ignoring the patent, or it doesn't apply here. In any case, it's good news. Looks like some semblance of virtual numbers will return on a standardized, more global basis.
Simucal 13y ago
I think that some banks let you generate temporary credit card numbers to make online transactions which you can disable at any time.
drawkbox 13y ago
Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to an oauth type token). If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens. So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card. New payment systems have this, for instance stripe is built similar to this. Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant. Some banks have this like Bank of America ShopSafe but it should be the new normal.
- mmanfrin 13y ago
  This is actually how a lot of merchants work -- they send CC info to a bank or processor, and get back a token they can use to charge that CC (without having to store CC information). Why Adobe didn't utilize this is beyond me.
  - iriche 13y ago
    And what do you do when the payment provider you use sucks, and you want to move to a new one? Oh right! Every existing customer have to sign up again, and input the same info again. That's the reason to aim for PCI compliance your self.
    - jarito 13y ago
      This isn't really true anymore. Most major tokenization providers also provide a way to transfer data from one provider to the next. I'm sure they aren't happy about the idea, but most of them recognize that lock-in is a reason people don't use their services.
      - iriche 13y ago
        Then I need to investigate if our payment provider provides this service :)
mrtksn 13y ago
In Turkey, we have these things called virtual credit cards. You basically log in into internet banking, click a button to generate a new card, it shows up instantly, then you define how much limit it would have and you are ready to use it. For convenience you can use that card many times, just reset the limit or you can create new one if you wish. It's really good, I use it every time.
mikeash 13y ago
Why do you care? Seriously, I don't get it. At least in the US, card holders have zero liability in these instances. If your card number got leaked and is used to make a fraudulent purchase, simply report it to your card issuer. They will reverse the charge and issue you a new card number. The paranoia around card numbers for consumers is crazy. There's literally no risk. It makes sense for merchants because they bear risk, but I don't understand why cardholders get upset.
- 6thSigma 13y ago
  It's a combination of uneasiness that someone was attempting to steal from you and you have to do work to remedy the situation.

by keyle 13y ago

keyle 13y ago

Is there a site that tracks all the hacked companies? This needs a ladder of shame. If we don't shine the light on this, things just won't get better.

elliottcarlson 13y ago
http://datalossdb.org/ http://datalossdb.org/
- hnha 13y ago
  prompts to login everywhere. bah!
  - elliottcarlson 13y ago
    http://www.bugmenot.com/view/datalossdb.org http://www.bugmenot.com/view/datalossdb.org works for me

tlrobinson 13y ago

Some credit card companies let you generate expiring CC numbers for specific purchases, but that's a lot of work, and wouldn't work for recurring purchases (like Adobe Creative Cloud)

nivla 13y ago
>Some credit card companies let you generate expiring CC numbers. I know Citi Credit card lets you do that. > and wouldn't work for recurring purchases (like Adobe Creative Cloud) It could. If I remember correctly, Citi card lets generate three types of Virtual Cards. One based on the expiration (less than a month), another based on the maximum amount/balance (where expiration is about a year) and finally a combination of both. Virtual credit-cards are real handy especially when trying those 30 day trial services.
- unclebucknasty 13y ago
  Yeah, AMEX used to allow one-time use numbers with its Platinum Corporate Card (maybe other cards as well). But, they stopped years ago. Don't know if it was hard to manage or if I was just the only one using it, but I loved it. Seems that another way to solve this for recurring payments would be to likewise issue a virtual number. But, only the merchant with a particular Merchant ID could apply a charge to that number. In general, it's actually a strange concept that we walk around with these wide open payment methods that only require that a dishonest person acquire a few bits of information to abuse with impunity.
  - tanzam75 13y ago
    > Yeah, AMEX used to allow one-time use numbers with its Platinum Corporate Card (maybe other cards as well). But, they stopped years ago. Don't know if it was hard to manage or if I was just the only one using it, but I loved it. Very few people used it But there is an additional problem, from American Express's point of view. Virtual credit card numbers are patented by Orbiscom, which was acquired by MasterCard in 2009.
    - unclebucknasty 13y ago
      Interesting. I wonder if non-virtual credit numbers are patented (i.e. the very idea of credit cards)? I'm sure I could look that up, but too lazy. Pretty ridiculous though. On a related note, I just came across this: http://storefrontbacktalk.com/securityfraud/the-big-three-credit-card-cos-aim-to-revamp-security/ http://storefrontbacktalk.com/securityfraud/the-big-three-cr... >Visa, MasterCard and American Express proposed new global standards to replace traditional account numbers with a digital payment “token” for online and mobile transactions. So, either they are licensing it from Orbiscom, ignoring the patent, or it doesn't apply here. In any case, it's good news. Looks like some semblance of virtual numbers will return on a standardized, more global basis.

Simucal 13y ago

I think that some banks let you generate temporary credit card numbers to make online transactions which you can disable at any time.

drawkbox 13y ago

Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to an oauth type token). If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens. So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card. New payment systems have this, for instance stripe is built similar to this. Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant. Some banks have this like Bank of America ShopSafe but it should be the new normal.

mmanfrin 13y ago
This is actually how a lot of merchants work -- they send CC info to a bank or processor, and get back a token they can use to charge that CC (without having to store CC information). Why Adobe didn't utilize this is beyond me.
- iriche 13y ago
  And what do you do when the payment provider you use sucks, and you want to move to a new one? Oh right! Every existing customer have to sign up again, and input the same info again. That's the reason to aim for PCI compliance your self.
  - jarito 13y ago
    This isn't really true anymore. Most major tokenization providers also provide a way to transfer data from one provider to the next. I'm sure they aren't happy about the idea, but most of them recognize that lock-in is a reason people don't use their services.
    - iriche 13y ago
      Then I need to investigate if our payment provider provides this service :)

mrtksn 13y ago

In Turkey, we have these things called virtual credit cards. You basically log in into internet banking, click a button to generate a new card, it shows up instantly, then you define how much limit it would have and you are ready to use it. For convenience you can use that card many times, just reset the limit or you can create new one if you wish. It's really good, I use it every time.

mikeash 13y ago

Why do you care? Seriously, I don't get it. At least in the US, card holders have zero liability in these instances. If your card number got leaked and is used to make a fraudulent purchase, simply report it to your card issuer. They will reverse the charge and issue you a new card number. The paranoia around card numbers for consumers is crazy. There's literally no risk. It makes sense for merchants because they bear risk, but I don't understand why cardholders get upset.

6thSigma 13y ago
It's a combination of uneasiness that someone was attempting to steal from you and you have to do work to remedy the situation.