6 ms·

PayPal is lying or playing dumb and here's why: Ask them if the customer service agents can see the last four or if they have to enter them first before the cu

by ck2 13y ago

PayPal is lying or playing dumb and here's why: Ask them if the customer service agents can see the last four or if they have to enter them first before the customer's records come up. They can see the last four right away. Call paypal and ask them which card you have on file, you cannot remember. The agent can give you last four to identify it.

chimeracoder 13y ago
> Call paypal and ask them which card you have on file, you cannot remember. Exactly. I've done this before when services ask me for my full credit card number or expiration date (to verify), and I ask them for the last four digits (to remind me which card I used). What PayPal did may be bad, but what GoDaddy did (use the last six digits) to verify is even worse. If you know the last four digits, you have a better than 1% chance of guessing the previous two, since they are not uniformly distributed: http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm (There are actually even more restrictions than the Luhn algorithm on credit card numbers, but I won't go into them here. Suffice to say, there's a reason than the attacker says he was able to guess it in a single try - he was lucky, but not that lucky).
- ianstormtaylor 13y ago
  Someone should just record a video of themselves doing it to their own account and post it online, that would be proof enough I'd think.
- erikpukinskis 13y ago
  You are right that Last Six is a miserable password. One correction thought: the attacker didn't guess the two digits in a single try, they guessed them in a single phone call. The GoDaddy agent allegedly let them just try numbers until they got it.
- bluesmoon 13y ago
  The last 4 digits are known, and the first 6 digits are based on the type of card (VISA/MC/AMEX + Bank/Issuer), so are guessable. Apply the Luhn algorithm to these, and you're left with only 10-100K possibilities for the remaining middle digits. If you're only required to specify the last 2, you can narrow it down significantly by only looking at valid combinations of those last 2, which is far smaller than 100. I've written up some of this here: http://tech.bluesmoon.info/2011/01/how-guessable-is-your-credit-card.html http://tech.bluesmoon.info/2011/01/how-guessable-is-your-cre...
- WatchDog 13y ago
  Unless you know every other digit in the card number, I don't see how knowing the luhn algorithm is going to narrow the possibilities of guessing just the two digits.
  - unreal37 13y ago
    Also credit card can never be used by itself for any purchase, ever. You must have the name, expiry date, and if you're doing transactions online, often the address and ccv2 as well.
    - jrockway 13y ago
      As far as I know, not true. Merchants get discounts for asking for more information, but it's not strictly required to process your card.
      - swombat 13y ago
        It depends on the bank. Some require more data than others. In either case, though, if the transaction turns out to be fraudulent, it's the merchant that pays, so the merchant has a strong incentive to ask for more rather than less.
    - WatchDog 13y ago
      More than likely you dont need the name or cvv, sometimes not even the expiry.
zaroth 13y ago
I doesn't make sense to point fingers without proof. PayPal says that they did find records of the attempt, and they state affirmatively that they did not provide any credit card details. It sounds to me like they are saying they listened to a recording of the call, and they know they didn't disclose any credit card details. If you're PayPal in this situation, how do you know the hacker doesn't have their own recording of the call? It would be one thing to claim no record of a call. But I think it would be incredibly reckless to claim you found the records, and you know you didn't disclose anything, if/when in fact you did. The fact is, there's nothing PayPal can do to prove a negative. If the hacker, or anyone else, produces actual proof that PayPal discloses this information improperly (not just claiming it's easy), I'm sure we will see how PayPal responds then.
- jader201 13y ago
  > If you're PayPal in this situation, how do you know the hacker doesn't have their own recording of the call? If I were PayPal, I would asks the question: Why would a hacker keep a recording -- of obtaining information illegally -- that would only incriminate himself? Obviously I have no way of knowing either way, but PayPal has earned the mistrust many have in their security best practices. PayPal has much more to gain by covering this up than the hacker would by lying about it.
  - poopsintub 13y ago
    I don't think it's uncommon for a hacker to believe they're invincible. Especially if they are doing something to a U.S. company or citizen when they are in a 3rd or even a 2nd world country. The laws and enforcement are often lax in comparison or even non-existent.
stevewillows 13y ago
Those four digits aren't hard to get - - it's scary how much access was given with such minor info.

by ck2 13y ago

chimeracoder 13y ago

> Call paypal and ask them which card you have on file, you cannot remember. Exactly. I've done this before when services ask me for my full credit card number or expiration date (to verify), and I ask them for the last four digits (to remind me which card I used). What PayPal did may be bad, but what GoDaddy did (use the last six digits) to verify is even worse. If you know the last four digits, you have a better than 1% chance of guessing the previous two, since they are not uniformly distributed: http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm (There are actually even more restrictions than the Luhn algorithm on credit card numbers, but I won't go into them here. Suffice to say, there's a reason than the attacker says he was able to guess it in a single try - he was lucky, but not that lucky).

ianstormtaylor 13y ago
Someone should just record a video of themselves doing it to their own account and post it online, that would be proof enough I'd think.
erikpukinskis 13y ago
You are right that Last Six is a miserable password. One correction thought: the attacker didn't guess the two digits in a single try, they guessed them in a single phone call. The GoDaddy agent allegedly let them just try numbers until they got it.
bluesmoon 13y ago
The last 4 digits are known, and the first 6 digits are based on the type of card (VISA/MC/AMEX + Bank/Issuer), so are guessable. Apply the Luhn algorithm to these, and you're left with only 10-100K possibilities for the remaining middle digits. If you're only required to specify the last 2, you can narrow it down significantly by only looking at valid combinations of those last 2, which is far smaller than 100. I've written up some of this here: http://tech.bluesmoon.info/2011/01/how-guessable-is-your-credit-card.html http://tech.bluesmoon.info/2011/01/how-guessable-is-your-cre...
WatchDog 13y ago
Unless you know every other digit in the card number, I don't see how knowing the luhn algorithm is going to narrow the possibilities of guessing just the two digits.
- unreal37 13y ago
  Also credit card can never be used by itself for any purchase, ever. You must have the name, expiry date, and if you're doing transactions online, often the address and ccv2 as well.
  - jrockway 13y ago
    As far as I know, not true. Merchants get discounts for asking for more information, but it's not strictly required to process your card.
    - swombat 13y ago
      It depends on the bank. Some require more data than others. In either case, though, if the transaction turns out to be fraudulent, it's the merchant that pays, so the merchant has a strong incentive to ask for more rather than less.
  - WatchDog 13y ago
    More than likely you dont need the name or cvv, sometimes not even the expiry.

zaroth 13y ago

I doesn't make sense to point fingers without proof. PayPal says that they did find records of the attempt, and they state affirmatively that they did not provide any credit card details. It sounds to me like they are saying they listened to a recording of the call, and they know they didn't disclose any credit card details. If you're PayPal in this situation, how do you know the hacker doesn't have their own recording of the call? It would be one thing to claim no record of a call. But I think it would be incredibly reckless to claim you found the records, and you know you didn't disclose anything, if/when in fact you did. The fact is, there's nothing PayPal can do to prove a negative. If the hacker, or anyone else, produces actual proof that PayPal discloses this information improperly (not just claiming it's easy), I'm sure we will see how PayPal responds then.

jader201 13y ago
> If you're PayPal in this situation, how do you know the hacker doesn't have their own recording of the call? If I were PayPal, I would asks the question: Why would a hacker keep a recording -- of obtaining information illegally -- that would only incriminate himself? Obviously I have no way of knowing either way, but PayPal has earned the mistrust many have in their security best practices. PayPal has much more to gain by covering this up than the hacker would by lying about it.
- poopsintub 13y ago
  I don't think it's uncommon for a hacker to believe they're invincible. Especially if they are doing something to a U.S. company or citizen when they are in a 3rd or even a 2nd world country. The laws and enforcement are often lax in comparison or even non-existent.

stevewillows 13y ago

Those four digits aren't hard to get - - it's scary how much access was given with such minor info.