Hacker News Reader

Comment by kevintwohy | Hacker News Reader

They've responded here: http://blippy.posterous.com/

Not as apologetic as one might expect.

I think it's a pretty solid response.

The question is, why would banks put your credit card number on the description of transactions in the first place? I've never seen that done before.

I think they're perhaps not as apologetic as you'd like because the premise (Blippy publishes credit card numbers) is incorrect. They made a mistake in a beta period which they fixed.

why would banks put your credit card number on the description of transactions in the first place

This is actually pretty common. It happens on my statements, and while I think that my bank could do something better (last 4 digits would be enough), there is at least a reason. For my joint checking account with multiple debit cards, it helps figure out who bought what. Since each purchase has the exact card number, we can figure out who went to Starbucks 3 times in one day...

In the UK it's common to see last 4 digits only on receipts, statements etc. NEVER the whole CC number. Anywhere.

The last 4 digits, however, are the ones that are unique to you.

4 digits is enough for you to know which account holder made the purchase, but not enough to be of any use to anyone else.

The first 5+ digits are public (if the "attacker" knows what bank your card is issued by). Adding 3 digits and a check digit to the mix makes guessing your number all that much easier.

Personally, I am not sure why any digits need to be on sales receipts. Or why I even need a receipt.

Don't forget in the UK the vast majority of purchases are Chip+PIN only, so a credit card number is only really useful for making online purchases from other countries, which are usually scrutinized far more by banks.

Also you have the CSV on the back of the card and expiry date. You also have the "Verified by Visa" stuff where you have to enter your password for any online purchase, also you'll usually have to enter the card holders full address.

I agree though, receipts are mainly useless wastes of paper these days, and the less paper with personal details on the better.

Given the massive library of photos available on Flickr, it'd be unlikely that there aren't some credit cards on there - perhaps a credit card left on the coffee table in the background that can be enhanced... Maybe even a credit card in someones very thin see through shorts :/ Wonder how long it'd take to find some examples.

I can't help but feel that the way credit/debit cards work is inherently flawed. About once a year my (UK) bank calls informing me that someone in Malaysia / New York / etc. tried to use my card so they blocked it and sending a new one. If someone steals your wallet (happened to me not very long ago) they get physical access to your card and can spend an awful lot of money online before the bank blocks the card. In the end my bank refunded all my money but still it was a quite stressful experience. And if someone manages to get your PIN (by peeking over you shoulder), you can kiss goodbye to your daily cash withdrawal limit.

I'm no security expert by any means but still I'm sure that it must be possible to design a lot safer system. Of course you can never defeat human stupidity / irresponsibility / malevolence but it should be a lot harder to commit card fraud.

'Don't forget in the UK the vast majority of purchases are Chip+PIN only, so a credit card number is only really useful for making online purchases from other countries, which are usually scrutinized far more by banks.'

It's true. A friend of mine moved to Canada from the UK with tickets bought on her card, changed her credit card's billing address to Vancouver, and called the card issuer to let them know she would be moving.

Immediately after she made her first purchase in Canada, they put a hold on her card. She had to call back to get the hold released, but it was put back on as soon as she made another purchase. This continued until she got a new (Canadian) card.

It's too bad the banks in the UK don't scrutinize themselves.

That's a good point. In the US, it isn't really a big deal if someone gets your credit card number. You notice a problem, aren't liable for the purchase, and get a new card overnighted to you.

The one time this happened to me, Amex called me to tell me they thought there was a problem. I looked, noticed that there was, and I had a new card / account number the next day. Very convenient, and only an 8 hour or so window where I couldn't use my card.

Someone was careless with my card data, but it didn't matter -- it didn't cost me any time or money. So I guess that's why I don't get too upset about stories like the original article.

Yeah - all the relevant details are in there, and he's technically right about the CC# liability bit, but the last way you want to come off in a situation like this is "it's not all that bad..."

Well, it does at least show that the title of this news story is sensationalist link bait.

Some times people mess up. But there's a difference between "oh oops in the beta period we didn't realize that banks put credit card numbers in descriptions :/ and we didn't realize Google would index that. 4 people were affected and we're sorting it"

and

"We routinely share credit card numbers!!!"

Personally I'd give them a break about it. They're probably feeling pretty crappy about it all already without people blowing things out of all proportion. (This is one of the worst things about the internet IMHO - blowing tiny things up into mammoth proportions through rumor, misunderstanding and incorrect assumptions. And always assuming everyone is evil).

Out of proportion? Sure at least in the US you are protected from credit card fraud assuming you take the appropriate actions.However, such a problem on their end shows a lack of attention to security and while this may be an isolated incident it reveals a lot about how the company acts and prioritizes their responsibilities to their users. People like to repeat their mistakes, especially when they don't have the necessary resources, whether it be time, man power, money or something else, to correct them therefore I doubt this is the last serious blunder they will make and that is reason enough for me to avoid them.

Unless I've misunderstood their description:

  * They got some data
  * The data has a "description" field
  * They naively displayed that description field
  * They then found to our horror that sometimes this
    description field contains CC numbers :/

I don't think you can really blame them too much for that.

It would be another story if they were actually storing CC numbers and 'accidentally' published them, but that doesn't seem to be what happened.

There, I fixed it:

if(/\d{4}((\s|-)?\d{4}){3}/){

  # don't print it

}

n.b. not trying to be a smart-ass, just saying it can't be that hard.

And now you have two problems.

Sorry, I don't get it. What do you mean?

http://regex.info/blog/2006-09-15/247

interesting, never heard of that one before - thanks for sharing.

And I agree, that a root cause analysis should be done. E.g. asking the 5 why's (as Eric Ries advocates), for behind every technical problem, there's a human problem.

It's only 'not that hard' if you know that the numbers are going to be there. Perhaps the Blippy folk have never seen or heard of a credit card company that puts the card number in the description field. I certainly haven't. Have you?

It seems like a ridiculous idea, and while it makes sense in some corner cases, I'm not surprised that they missed something that was only a problem for four users ever.

Perhaps what we should be doing here is asking why Google kept a cache of months-old HTML instead of updating their cache instead?

I agree with your first statement, which is one of the things the Black Swan theory is about (love the book, def. recommend reading it): that you don't know what you don't know.

To that I would say, one should be very very very paranoid about what you print, given that you know that you're printing things from people's credit card bill statement.

Blippy shouldn't have output'd the cc numbers, whether or not Google caches it or not is a secondary to this. Note that Google's cache wasn't explicitly out to get Blippy, they just happened to cache whatever Blippy was emitting.

> To that I would say, one should be very very very paranoid about what you print, given that you know that you're printing things from people's credit card bill statement.

...to a point.

What other 'bad information' might be in that description? Social Security # for a USA customer? Social Insurance # for a Canadian customer? Pretty soon you'll have a laundry list of 'bad numbers' that you have to try and filter out.

"Today someone discovered a Google search that displays the credit card numbers of 4 Blippy users."

If as they say, all they released were 4 credit card numbers, I understand why they act like this isn't a big deal.

Their system works and has worked the entire time for 99.98 percent of all people. Those few people who did get their numbers published, well, send them a ham or something. At worst, if the cards are used, the user will have a couple days of saying "Chargeback X chargeback Y". This isn't even about a bug currently in their software, but a small one from a long time ago from a credit card processor arguably doing something incorrectly (or at least, quite strangely).

Yeah, not apologetic at all. I'm not sure I equate giving my credit card number to a waiter or store clerk with having it published on Google for virtually anyone in the world to freely access, as they do.

"The average user would see nothing, but a determined person could see 'raw' line items."

Yes, only someone with the temerity and tenacity to ... click "View Source".

yeah it basically boils down to "oh it's no big deal"

Reply on news.ycombinator.com