Domino's Pizza in the UK recommend changing password and checking bank statement | Hacker News Reader

Domino's Pizza in the UK recommend changing password and checking bank statement

communicatoremail.com

36 pointsphilbo27 comments

NPR's Marketplace did an interview with Domino's CEO a few years back and surprisingly, one of the things he said was top on his list was digital security. Smart man.

Also, a company that is detecting breaching of this kind has its eyes open. Not only aren't they breached, but they are out there explaining how it happened to a tiny portion of their customer base and warning others who are using poor password management practices.

A hat tip to you Dominos Pizza. Here's the interview:

https://www.marketplace.org/2015/09/24/business/corner-offic...

There are a variety of projects that students from my university as well as other companies especially on Michigan collaborate with Domino's on. One of my favorites is the new Domino's specialized delivery car [1], and a pizza pick-up cart with accompanying mobile apps that will hopefully make it to production sometime in the future.

[1]: http://www.dominosdxp.com

Reminds me of Snow Crash.

If what they say in the memo is true, and by the domain name (an email marketing service, and not their official site?), it seems like an individual email, and not a general public message. Maybe they're just running customer's emails through a service like haveibeenpwned, and emailing the ones that return results. Apparently several major UK services have had account leaks recently, and I bet Domino's is an easy target for fraud.

I don't know anything about the company/CEO's policy, but I worked as a driver for them beginning around ~2011, and I'd have to say, they really had their s--t together on the tech front. For example, the "Pizza Tracker" is entirely real and accurate (which always amazes my friends), it's actually just a side effect of the system they have to track inventory and paying employees (an employee has to enter their ID at each station and select and order. So maybe Henry isn't actually the person doing the "quality check", but he's the person who punched in his ID and approved it). I worked at a few less experienced delivery places afterwards and the experience was just awful comparatively.

It wasn't just the UK. Two days ago my wife's Domino's account and her stored credit card were compromised. Someone in Texas ordered pizza on her dime (we live in Atlanta). At first she thought it was just her card and the thief had tested it with a Domino's order, but she also got an email from Domino's about the order itself. She immediately filed a claim and canceled the card, and she contacted Domino's about it. Their response was along the lines of "We're not going to do anything about a $40 order, but thanks for reporting it, and good luck with your credit card." It was infuriating to say the least. Thankfully her card issuer (Amazon Visa card via Chase bank) reversed the charge without a problem.

It's weird that they didn't offer a refund, the next logical step for any consumer would be to file a chargeback, which Domino's has to pay for (in addition to the money she was refunded through the chargeback)

It's my understanding from her conversation with the credit card company that it's not being processed as a chargeback, but as a payment reversal. No extra fees to Domino's, they are just out a bit of food at one of their (likely franchisee) restaurants.

That's not how it works. Payment reversal is only possible via chargeback or by the vendor themselves refunding the charge, so Domino's will absolutely get a fee.

Then either we misunderstood the credit card company, or they misinformed us. Either way, it was handled promptly and nearly painlessly, something I didn't expect given my past experience with someone gaining access to my credit card information. Times have changed.

One of the nice things about takeaway food delivery is you don't always need to give a service your payment details, if they accept cash on delivery. Domino's don't even need an account.

A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at various apps, JustEat, Domino's and the like. Domino's were written off instantly when we discovered we couldn't use a third party service like PayPal. If major tech companies can't manage their security properly I have little faith in Fast Food outlets investing in getting it right. I know they don't think they have been breached, and this may well be the case, but do they really need to be storing sensitive data at all?

Edit: turns out you can use PayPal (see below), ignore me I'm wrong!

You've been able to pay for Dominos in the UK via PayPal for years now.

Ditto Australia.

Hmm, thanks! I'm not sure why we couldn't figure that out. I can't remember if we were using the app or the website, I just know we were using mobiles.

Hm, I can't remember exactly what the condition is, but I know there is a situation in which they won't except PayPal because it's happened to me before. I think that might be if your order is under £10, or if you're collecting or something like that.

That reminds me of how I've always refused to allow pizzahut.com to store my credit card because they have some ridiculous password rules that make you choose a less secure password and therefore make me mistrust how they store data in general.

Why do people care about this? It's the bank's credit card number that gets stolen, not yours. Fraud is so routine that you probably don't even have to call anyone when this happens. They discover it, reverse the charges, and send you a new card.

Sometimes it's a debit card, so reduces your balance, and causes overdraft charges. Sometimes, you have your credit card paid automatically from your bank account; refunding wouldn't reverse the bank payment. Sometimes you want to use your card and it's stopped and you've not yet been told why. Sometimes the bank messes up and doesn't spot a fraud and it costs you a lot of time and money.

They seem like realistic reasons you wouldn't trust the bank's anti-fraud protections alone.

tl;dr that probably hides a big financial risk [for the poor].

Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone.

If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS.

Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row.

So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.

Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable.

Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two.

The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.

This happens to me at least once a year but I still consider it a huge inconvenience. Two days is an eternity, especially to be without my primary card. I don't wait that long for socks from Amazon. One day is generally my expectation at this point and for a lot of things it's same day. I'd really like to see banks/card companies step up their game in getting new cards out to people.

Talking about the time it takes to get something, passports in the U.K. are ridiculous. I had mine stolen a few years ago while abroad, and had to get a replacement from my embassy. They gave me a one-time-use 'emergency passport', which looks basically the same as a normal passport except it's smaller and I guess doesn't have biometric features - inside it looks the same. It took them a total of 1 hour to make it.

When I came home I needed a new one as I was supposed to be moving abroad a couple of weeks later. The earliest appointment (which is supposedly faster than doing it by post) they could give me was after 1 month, and after that I still had to wait a week for it to arrive.

My wife is from Lithuania (EU country) and when we got married she went to the passport office (just walk in and wait) and got a new passport the next day.

None of us (students) had credit cards and we frequently used PayPal to cover the scenarios you mentioned. As a group it just became easy to all use the one app for requesting/sending smaller amounts of money. You can do it through a phone number which makes it quite simple even if it's not the best way.

Well, for me, once I reach the payment screen and have the option of pulling out my wallet and typing in my card information vs simply entering my PayPal credentials, which I have memorized, it's any easy choice.

Maybe it's a bad habit, but I have my card numbers, expiration dates, and security codes memorized. I'm that way with random strings though; I know the VINs to all of my vehicles, and I even have the license key to my old Windows 98SE disk rolling around in my head, fifteen years after the last time I reinstalled it. It's not quite a useless talent, but it's certainly a boorish one.

If only my bad habits were so useful.

I think just like a year or two ago PayPal wouldn't let me use a good generated password due to it being too long.

Edit: Just checked and the limit is still 20 characters :\

Reply on news.ycombinator.com