Hacker News Reader

It's not silly. The point is that security codes are only ever supposed to be sent in transit, and the only place they are ever stored is by the issuing processor.

It's not supposed to solve every potential vulnerability, but there is a whole class of exploits, exactly like the one in the article, that result from stolen storage, that this rule is designed to protect against.

> Now instead of acquiring N numbers, the hacker needs to acquire N+3 (or N+4) numbers

This seems almost as reductive as suggesting my mechanic should keep her customers' key(k) in their cars(c) in her parking lot because instead of just acquiring c, now the thieves just need to acquiring c+k.

If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authentication factor, which seems pretty worthwhile to me. Getting that info isn't exactly a snap if you don't just find it laying around-- it's not like you can brute force it. I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand.

Sure, there are undoubtedly better ways to handle these transactions, but lacking magic wands to change a giant dinosaur of an industry that should have wanted to change on its own, this is a prudent policy-based strategy to mitigate harm. Whether or not you sweat these breaches is a good way to gauge your own processes, but it's not a useful way to gauge industry-wide processes.

> If we were talking about 3 extra digits on the card number, that would be one thing. But we're talking about a separate authentication factor, which seems pretty worthwhile to me.

It's not really another factor in the sense of the three types of factors: Something you know, something you have, something you are. It's just more digits of "something you know" so it's the same factor. It's why 2-factor auth isn't just 2 separate passwords.

Seems to me that when you turn it into data, it pretty much all becomes "something you know." If a credit card required biometric authentication to make credit card transactions and a vendor stored my biometric signature in a database along with my credit card number, it would be no more or less secure than a 3 digit number.

There are better ways to handle it. Policy is a good interim step to mitigate damage before they're implemented.

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand.

If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you only had to try about 24 or 36 cards with one month/year.

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.

I would need to hear that from someone who actually works in a CC company fraud department because I don't think it's that straightforward. I've had MC transactions declined on a card I use for everyday purchases at two stores in my neighborhood. I don't think reasoning about their transaction monitoring like someone might monitor network traffic is a good analog-- they're specifically looking for patterns in small-scale, localized events without many data points. They don't have to connect the events to stymie the fraudster's efforts.

> If you have a whole database of them, the trick is to try one code with a thousand cards

That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.

Of course there is no guarantee, but statistically if you have 1/1000 probability of success and you try a 1000 times, that's not bad.

Their fraud detection algorithms are specifically looking for small, localized, per-transaction events with few data points as well as overall patterns-- I doubt it would be that straightforward. It might not mean you'd be targeted, but on a per-transaction basis, I there's a good chance you'd get blocked for any individual attempt even if you got a match.

It's kind of silly though. They are no more "secret" than your credit card number itself or expiration date.

Apple Card rotates the CCV (fixed time interval, AFAICT, not per transaction), so it is a secret, even if only temporarily.

Once you give it out once or hand your credit card to literally anyone, it's out.

Sure, the cashier now has it, but they're not supposed to be entering it into a database so that everyone has it, hence the "PCI" part.

Kind of silly? Can’t/don’t the three digits get rotated independently of rotating your credit card or account number though?

Also some clearer rules/expectations in place that nobody should ever persist the data on disk?

They usually (always?) get rotated at the same time as the expiration date.

> bozos in charge who can't seem to develop a secure payment system

Actually, the credit card system is very secure to you the consumer.

By regulation, you're not liable for anything if your card number is abused in a card not present transaction (typically the case here for numbers stolen over the internet).

I don't have any other form of payment that is as secure, so good job credit cards.

(As a cryptography and security nerd, it took me a long time to learn that while mathematically guaranteed security is very cool, sometimes you can achieve an equal result just by passing a law.)

For physical transactions, change is happening, but it’s a slow migration. Looks like MasterCard has plans to remove the magnetic stripe [1].

Online, perhaps credit cards will disappear into password managers and mobile payments (Google and Apple Pay, etc.) with ordinary businesses storing very little.

[1] https://www.theverge.com/2021/8/17/22628455/mastercard-magne...

its not silly just because it can't solve all problems. It goes a long way to gas station type skimmers less valuable because you can't print a phony card from them, or the phony card you can print is limited to a subset of possible purchases. perfect-enemy-of-good yadayda.

You're not wrong, but GP is saying that 3 digits is a pretty weak 'security' code and gas station skimmers are on the tail end of the threat model compared to exfil of data at any point in the processing chain.

I tried to better clarify what I'm saying in [1]. I'm not saying the small number of digits makes it insecure, it's that "moar numbers" is not really adding anything in terms of multi-factor or secrecy. Instead of knowing N digits, you merely need to know N+M digits. It is not changing the nature of the secret.

1: https://news.ycombinator.com/item?id=38655609

It's a different sent of protocols, reducing the surface area of successful breach strategies. If you simply added three digits to credit card numbers but maintained the same protocols on the credit card numbers, it wouldn't improve security nearly as much. There's fewer tactics that will successfully get you N+M digits those that would get you the N digits. Most 2FA works the same way. It's not like the six digits of Google Auth add security, but the protocols around them.

To put it another way: the value of those extra three digits is that they are indeed "more secret". They exist on far fewer hard drives.

I think this topic came up a week or 2 ago, and I made an almost identical comment as you, which was why the content of my reply was fresh in my memory. Anyway, in the recent convo, a kind hn poster provided this explanation of CVV

https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3...

I totally see why it just seems like "moar numbers" though, and I find them unnecessarily annoying. I wish they could reduce the complexity (maybe letters, colors or shapes, something more human-compatible), but there's just too much legacy code with too little benefit.

It is a poor person's version of a password for using the credit card, only available to people that has the credit card in their hands. Not silly at all.

I agree with you. When the secret is always collected side-by-side with the number it seems little comfort that only one part is “supposed to be stored”.

if no one is storing it, they don't have it. If someone is storing it, it increases the likelihood that they can acquire it.

perfect is the enemy of good.

it's not supposed to be a secret in the "something you know" way, but rather "something you have" - i.e. the physical card. If they store it you no longer need the physical card for an entire family of attacks & frauds.