cynwoody

15 ms·

91.
by cynwoody 13y ago
The consumer is almost always made whole in fraud incidents. For the consumer, it's mainly the pain in the ass factor. Which is not insignificant!
92.
by cynwoody 13y ago
What you say is true. However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expens
93.
by cynwoody 13y ago
> If you use a debit card, go to your bank and have them turn off the "feature" that lets you overdraft (and get charged a $35.00 fee each time). Better yet, have them issue you a new card that is only an ATM card and cannot b
94.
by cynwoody 13y ago
I would hope so (if done intentionally and without the user's informed consent). It would be a DoS attack.
95.
by cynwoody 13y ago
Google cache here: http://webcache.googleusercontent.com/search?q=cache:Oq8_jkw...
96.
by cynwoody 13y ago
Does anyone know what 'tbm' stands for?
97.
by cynwoody 13y ago
You could use first names as your dictionary. The US Census Bureau has lists† (in the form of frequency tables) of male and female given names. † http://www.census.gov/genealogy/www/data/1990surnames/names
98.
by cynwoody 13y ago
Kayak has a feature they call Hacker Fares™†. † http://www.kayak.com/news/a-new-way-to-find-deals-on-flights...
99.
by cynwoody 13y ago
I just tried BOS-DEN nonstop 31 Jan to 7 Feb through the UK† and Canada††. Southwest came in cheapest on both searches. As has been noted, Southwest did not appear in the same search using www.kayak.com. I was coming from a US IP. I wonder,
100.
by cynwoody 13y ago
That would also work, although there would be the problem of stolen key fobs. The point is not to have replayable data streams (mag stripes) available for interception and abuse.
101.
by cynwoody 13y ago
Chip & PIN only solves part of the problem: authenticating that you are you. You could still be a deadbeat. There are three parties involved: the merchant, you, and the bank. You are ordering the bank to transfer funds to the merchant.
102.
by cynwoody 13y ago
> For years, consumers in Europe and many other countries have used a technology called EMV (for Europay, MasterCard and Visa), created in the mid-1990s that makes it possible for retailers to confirm payments locally instead of placing
103.
by cynwoody 13y ago
Okay. In honor of the late Paul Harvey, what's the rest of the story?
104.
by cynwoody 13y ago
This nonsense been going on for decades. Back in the eighties, I came across a computer letter addressed to "Mr. Intl B. MacHines". Very simple. Upper-case garbage in, mixed-case garbage out! Printed using a mylar ribbon, so it lo
105.
by cynwoody 13y ago
Configure your browser to drop nytimes.com cookies on exit. Works for me. I never visit the site deliberately, but I do land there occasionally by following links. However, since I restart my browser at least once a day, I rarely come close
106.
by cynwoody 13y ago
Sounds like a matter† for the MSFT legal department. I'm rarely in MSFT's corner, but this would an exception. † http://en.wikipedia.org/wiki/Sherman_Antitrust_Act
107.
by cynwoody 13y ago
> Installing an app not from the appstore is almost impossible for a non-savvy user. I would post a video demonstrating step-by-step how to install non-approved apps in Chrome. Download the app. Open chrome://extensions. Tick
108.
by cynwoody 13y ago
I can think of at least two reasons for it to be on HN: (1) Replicating as a browser extension the functionality to which Yale objects qualifies as a damn good hack. (2) The original issue is about internet freedom, a matter of concern to t
109.
by cynwoody 13y ago
Since it's extracting additional data from the second -party website, I would classify it as enhanced browsing, not as scraping. Enhancing the browsing experience is the purpose of browser extensions.
110.
by cynwoody 13y ago
The days of phoning in with a 1200-baud modem or collecting embossed card impressions are long gone. A typical small-shop retail arrangement is to have the POS terminals behind a NAT router which is behind another NAT router that also serve
111.
by cynwoody 13y ago
That's being worked on†. It hasn't made it into the standard package library as far as I know. E.g., there are two ways to write Cañyon City. You can write the ñ as U+00F1 or as an ascii lower-case n followed by a combining tilde
112.
by cynwoody 13y ago
In Go, you can name your variables in Chinese† if you want. In Go, strings are immutable UTF-8 byte arrays,†† and the language provides facilities for iterating over them either byte by byte or rune by rune (a rune is an int32, wide enough
113.
by cynwoody 13y ago
Actually, natch's trick does just the opposite. It strips out any formatting information that may accompany the text on the clipboard. I've used the same trick on occasion when copying text from web pages into Gmail. When you past
114.
by cynwoody 13y ago
Nope. The PIN-block encryption scheme† is specifically designed to be secure against replay attacks. The same PIN will encrypt to a different PIN-block each time it's entered whether at the same POS terminal or a different one. † http:
115.
by cynwoody 13y ago
That might depend on a payment processor service. E.g., when a charge is made, the payment processor returns a unique ID for the transaction. Then, if the merchant decides to give a refund, they put through a transaction that references the
116.
by cynwoody 13y ago
> Also, the hack was most likely not on the POS system but on their payment switch (software for payments routing not to be confused with a network switch). There would be one central point where all their transactions are funneled to t
117.
by cynwoody 13y ago
The reports I've seen say 40m sets of card details for the full duration of the hack, which was about two and half weeks, not a single day. And I doubt Target was storing the data, as they don't have a legitimate business need. Bu
118.
by cynwoody 13y ago
They're only permitted to keep the full credit card number for as long a business need exists. For a hotel or a car rental agency, that might be days. But for a retail transaction, it is a couple of seconds: submit the charge, mag stri
119.
by cynwoody 13y ago
They weren't. They were uploading encrypted PIN blocks to their payment processor, and the bad guys captured those along with the mag stripe data. But encrypted PIN blocks are useless to a hacker. Target can't decrypt the PIN-bloc
120.
by cynwoody 13y ago
Yes. In order for Target to have the information mentioned, you would have needed to have bought something online from them or you would need to have a REDcard† or have filled in a survey or mailed in a refund request or phoned customer ser

More ›