So why can't anyone else do this? Having to go through a large number of services to change my card details because I once used it Target was annoying. And then not too much later again because I used the new one at Home Depot was annoying.
(For people outside the US, both Target and later Home Depot got hacked. Many banks proactively replaced their customer cards if they had transactions at those stores, which meant new numbers, expiry and CVC even if no fraud occurred on the card.)
Does this mean that those who hacked Target could have just added the card details to their own Stripe account and waited for Stripe to update the data once the banks got around to replacing the customer cards?
At least with my banks, when they send me updated cards, only a handful of the digits actually change and most of those changes have tended to be in the last 4 digits — which Stripe lets you see, along with the updated expiry month/year.
At this point, it's just a matter of brute forcing the remaining permutations. Am I misunderstanding something or are there countermeasures to protect against such attacks?
Well the brute forcing of it would be mighty suspicious: the number on the back has a 1,000 or 10,000 combinations. So that will be noticed, even if you got the first 12 numbers right on the first try. Also, theoretically, of the remaining 12 numbers, 6 should change with each new card, which is another 1,000,000 possibilities (and bigger banks may change more numbers than that)!
Seems like you could just have it not work until a card has been on system for certain amount of time. That way people couldn't just upload card they stole? Would also make easy to detect those who uploaded stolen cards
I have changed my credit card because of a security lapse and found that some recurring charges continued to work against the old card number without me having to update the card at the vendor. I figured that the processor or issuer was handling this for my convenience, based on their knowledge of my established relationship with the vendor.
However I have never had a vendor try to rebill an expired card, even though the CVC's and the expiration year are the only data which changed.
https://spreedly.com offers this card updating as well. You store your customers' payment info with them instead of with a specific processor, and you can charge those cards with Stripe today or PayPal tomorrow just by changing one token in your code.
Over a decade ago several places (eg Amex IIRC) would let you generate "aliases" for your card, which worked well. You couldn't limit amounts or expiry like final does. It would be nice if my bank started doing that, as I really don't want yet another financial relationship and sure as hell do not want another pin.
Google already does this. My wife recently got a new card after hers was mangled by an overzealous cashier. She went to update the information everywhere she knew it belonged, and noticed that her Google Checkout details already had the new card information.
We spent a couple of puzzled hours wondering how in the world Google could have possibly gotten that information before concluding that it must have been a service made available to them by the issuing bank -- Navy Federal in our case -- but not having any real way to confirm it.
We'd scoured the paperwork that we did have and found nothing indicating those terms anywhere, and shockingly, this is our first indication that such a service exists.
Comments
So why can't anyone else do this? Having to go through a large number of services to change my card details because I once used it Target was annoying. And then not too much later again because I used the new one at Home Depot was annoying.
(For people outside the US, both Target and later Home Depot got hacked. Many banks proactively replaced their customer cards if they had transactions at those stores, which meant new numbers, expiry and CVC even if no fraud occurred on the card.)
Does this mean that those who hacked Target could have just added the card details to their own Stripe account and waited for Stripe to update the data once the banks got around to replacing the customer cards?
At least with my banks, when they send me updated cards, only a handful of the digits actually change and most of those changes have tended to be in the last 4 digits — which Stripe lets you see, along with the updated expiry month/year.
At this point, it's just a matter of brute forcing the remaining permutations. Am I misunderstanding something or are there countermeasures to protect against such attacks?
Well the brute forcing of it would be mighty suspicious: the number on the back has a 1,000 or 10,000 combinations. So that will be noticed, even if you got the first 12 numbers right on the first try. Also, theoretically, of the remaining 12 numbers, 6 should change with each new card, which is another 1,000,000 possibilities (and bigger banks may change more numbers than that)!
The number on the back is generated by an algorithm with secrets that are not very secret (though apparently "secret enough").
Seems like you could just have it not work until a card has been on system for certain amount of time. That way people couldn't just upload card they stole? Would also make easy to detect those who uploaded stolen cards
I have changed my credit card because of a security lapse and found that some recurring charges continued to work against the old card number without me having to update the card at the vendor. I figured that the processor or issuer was handling this for my convenience, based on their knowledge of my established relationship with the vendor.
However I have never had a vendor try to rebill an expired card, even though the CVC's and the expiration year are the only data which changed.
https://spreedly.com offers this card updating as well. You store your customers' payment info with them instead of with a specific processor, and you can charge those cards with Stripe today or PayPal tomorrow just by changing one token in your code.
Check out final http://getfinal.com it seems like what they're working on could potentially solve this problem.
Over a decade ago several places (eg Amex IIRC) would let you generate "aliases" for your card, which worked well. You couldn't limit amounts or expiry like final does. It would be nice if my bank started doing that, as I really don't want yet another financial relationship and sure as hell do not want another pin.
Google already does this. My wife recently got a new card after hers was mangled by an overzealous cashier. She went to update the information everywhere she knew it belonged, and noticed that her Google Checkout details already had the new card information.
We spent a couple of puzzled hours wondering how in the world Google could have possibly gotten that information before concluding that it must have been a service made available to them by the issuing bank -- Navy Federal in our case -- but not having any real way to confirm it.
We'd scoured the paperwork that we did have and found nothing indicating those terms anywhere, and shockingly, this is our first indication that such a service exists.
Note, I did not call the bank.