Zamujasa posted:

Security Fuckup Megathread - v14.1 - "command and control to major fuckup"

Thanks Ants posted:

and there's still four days left of september

Thanks Ants posted:

moostaffa posted:

https://twitter.com/briankrebs/status/912791399619284992

moostaffa posted:

https://twitter.com/briankrebs/status/912791399619284992

mrmcd posted:

Wasn't this poo poo the reason we all got chip cards?

Thanks Ants posted:

are we at this point yet?

mrmcd posted:

Wasn't this poo poo the reason we all got chip cards?

flakeloaf posted:

oh is it time for this derail again

mrmcd posted:

I mean yeah supposedly the chips are also garbage, but breaking them at least takes effort, as opposed to 'even a brain dead Russian mafioso mule can hoover up and clone a bajillion numbers in one go' that you get with mag stripe.

Midjack posted:

sonic BOOOOOOOOOOOOOOOOM

Wiggly Wayne DDS posted:

no one should be surprised but twitter's new 280 char limit is only checked client-side

Pikavangelist posted:

Step back, Bluetooth’s about to skim your number!

cinci zoo sniper posted:

"For twelve years, you have been asking: Who is John Galt? This is John Galt speaking. I am the man who loves his life. I am the man who does not sacrifice his love or his values. I am the man who has deprived you of victims and thus has destroyed your world, and if you wish to know why you are perishing-you who dread knowledge-I am the man who will now tell you." The chief engineer was the only one able to move; he ran to a television set and struggled frantically with its dials. But the screen remained empty; the speaker had not chosen to be seen. Only his voice filled the airways of the country-of the world, thought the chief engineer-sounding as if he were speaking here, in this room, not to a group, but to one man; it was not the tone of addressing a meeting, but the tone of addressing a mind.

Wiggly Wayne DDS posted:

not quite that interesting, more that anyone can tweet to 280 characters, the old 140 limit is only enforced via javascript

Wiggly Wayne DDS posted:

no one should be surprised but twitter's new 280 char limit is only checked client-side

cinci zoo sniper posted:

the longtweets look surprisingly hideous

schranz kafka posted:

"front end web development"

Subjunctive posted:

it's hard to imagine lower security stakes than someone sending a long tweet

pr0zac posted:

Id even bet someone in Twitter is using the number of people that use the web dev tools to get access as a success/interest metric

Immanentized posted:

Chips have been out in the wild for like a decade in the EU, Russians have long cracked and economized the process of stripping card data.

Subjunctive posted:

it's hard to imagine lower security stakes than someone sending a long tweet

coffeetable posted:

i know the data on the magstripe can be skimmed/shimmed just fine from chip n pin setups, but afaik it can't be used to create another chip card? just a dumb magstripe one?

so chip n pin is more secure when it's ubiquitous and using the stripe is such an anomaly that it attracts antifraud attention

duz posted:

america isn't implementing chip and pin, we're implementing chip and sign
but wait, you ask, doesn't that only make it harder to clone and not actually improve any other security what so ever
you would be correct

duz posted:

america isn't implementing chip and pin, we're implementing chip and sign
but wait, you ask, doesn't that only make it harder to clone and not actually improve any other security what so ever
you would be correct

Immanentized posted:

To bounce off of this, it's all about risk transference and less about mitigation.

Chip and PIN means the issuers, processors, etc assume more of the risk liability and burden in the even of data exposure or a card breach (PIN is on their part, it's a user-input that is validated by the issuer/acquirer).

Chip and Sign is the card holder using really weak validation to effectively make their mark (a 5000 year old method of validation, that offers no deterrence or assurance features). Everybody on the backend is effectively let off the hook completely.

ymgve posted:

So there was no risk liability for the banks or processors at all.

ymgve posted:

IIRC the big push for Chip and PIN in Europe was that it was "secure", so when someone got their account drained it was obviously the customer's fault for not keeping their PIN protected well enough. So there was no risk liability for the banks or processors at all.

ymgve posted:

IIRC the big push for Chip and PIN in Europe was that it was "secure", so when someone got their account drained it was obviously the customer's fault for not keeping their PIN protected well enough. So there was no risk liability for the banks or processors at all.

coffeetable posted:

afaik the liability shift was from card issuers to retailers

evil_bunnY posted:

What? Where I live, by law anything you didn't approve isn't your responsibility (this covers skimming, etc), and anything up to 48 hours before you reported your card physically stolen also isn't your problem.