Hacker News Reader

Kinda is their fault... the recipient might be the dictator but the sender can choose not to play or can display a checkbox to consumers authorizing an unsafe transmission so they can make an informed decision. Instead they just do it and you assume the store is secure because isn't store security mostly a solved problem at this point?

Those of us who transact directly with the hotel instead of booking agents stay winning I guess.

If the sender doesn't play ball, they won't have any business.

Third-party aggregators and hotels are a complete shit-show. But as long as I can save $30 on my trip, I will keep using them...

I am not a marketing professional but what about something like this. "Our booking service is xxx MM consumer's first choice for planning trips. Get access to our customer base and reduce administrative workload by adding our integration to your point of sale system. 4 competitors within 5 miles of you are already booking with us!"

Especially since I have zero fraud liability as a customer. No real incentive for me to care.

The real solution is for the credit card companies to lay down requirements for these merchants (no storing in plain text).

They already do so. The card data is not stored 'in plain text', but encrypted at rest. But for the Hotels there are interfaces that allow these to be exposed to the Hotel employees (accesses of such information are logged). Just prior to displaying them they are decrypted.

You have your facts wrong. https://arstechnica.com/information-technology/2023/02/myste...

Would it pain you to spell out which of the facts are wrong?

For the “encrypted at rest” statement I guess it depends on your definition of “at rest”. Email passes through many hands, and random mom-and-pop shops definitely aren’t using PGP. So any emailed credit card information is being stored on many different computers. In theory those kinda of logs should be purged regularly, but who knows.

Looks to me like you got your facts wrong. And your definitions too...

> And every time you visit a hotel and hand them your card they tend to make an imprint of the card

I haven't had my card imprinted (or, later, photocopied) in hotels since a long time. Now it's just a pre-authorization.

Although recently I had my credit card photocopied by a car rental agency so they would be able to phone the card processor and cancel the pre-auth manually. Absolute madness.

> the only thing the hotel doesn't have is the CVC

Considering the most recent credit cards that I have been issued, most lost the embossing and now print the PAN on the back together with the CVC, so if some hotel photocopies the card - as nobody have the imprinters anymore - the CVC is there. This also applies to the last embossed card that I have in my wallet, an Amex card, which always had the CVC on the front that wasn't captured with an imprinter. Now with photocopiers, it is.

I've still had it happen this year, but I visit weird places :)

why does it feels like I read this exact chain of thread few days ago? the only thing different is that chsin mentioned UK too.

PCI DSS requirement 4.2 explicitly forbids sending credit card data via email.

https://pcidssguide.com/pci-compliance-and-email-security/

And even though I've not worked there in many years, I can tell you with extreme certainty that booking doesn't do that. They're also (hopefully obviously!) PCI compliant.

And they do not. What they do do is offer a portal where the hotel can look this information up and they very explicitly caution against photographing or doing other stuff to that number other than to enter it into their POS to perform some transaction.

It's 2023 and my credit card is left wide open to fraud and booking.com facilitates this. I presume when you choose "pay at the hotel" and have to enter your full details including CVC, this is in order for the hotel to charge you in the case you decide to not pay. But in that case booking.com should handle the dispute, as opposed to introducing another compromise vector for any attacker. I've literally seen my details printed on paper at a small hotel in Tyrol. God knows what security they are running at the front-desks at these places.

That flaw is inherent in credit cards and you as the user have a dispute process at your disposal for charges that you don't want to be on the hook for.

The CVC is just slightly less problematic than the rest of the card data.

And that small hotel in Tyrol is probably ok, but I had my card cloned within minutes of eating at a restaurant in Toronto. The whole concept of a bunch of numbers that allow for arbitrary charges against you is flawed.

Booking.com doesn't facilitate fraud any more than your credit card company does, and so far I've been able to successfully dispute every charge that I did not agree with on my card. The day that changes I'll stop using them entirely.

I’ve been to hotels in Brazil where they literally copy your CC information completely into a text box in the hotel’s check in system. After that experience once, never ever again…