Hacker News Reader

Comment by aroch | Hacker News Reader

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe...

Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the actual customers product.

Additionally, I'm willing to bet quite a few of these people have used the listed email and last 4 for other things online and/or for verification of identify places.

Also, how is this PCI compliant?

View on HN

There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII. I work information security but I am not on my company's compliance team, so I'm familiar with PCI/SOX but not steeped in it. I believe the above is true, but I'm not an auditor.

As far as trying to gain a copy of the information in the email, it might be possible if you were willing to put your own email on record as being part of this data breech. It's also possible that the only thing contained in the email is purchase confirmation (aka, what is shown in the printable invoice).

Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.

Correct. From the DSS, 'Cardholder data includes: Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code'

This is not true, I used to work in the industry and you can use a hosted credit card solution (where you transfer customers to a secure payment page) without needing PCI compliance.

If it were correct, and the card holder name needed to be secure, the company I worked at would not have received level 1 PCI compliance. The solution sends back the truncated card number, expiry date and the full card holder name.

Of course I'm assuming the banks wouldn't want you to make that data public, but you are allowed to store it without needing to be PCI compliant.

CVV code is another matter, under no circumstances are you allowed to store it, unless you're a level 1 compliant payment processor.

Phew! At least we can all take comfort in the fact that ClickBank is a Level 1 compliant payment processor.

http://www.clickbank.com/press/clickbank-achieves-level-1-pa...

Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant.

https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)

PCI is designed to protect credit card fraud, not customer's address information. Banks don't care about the risk of identify theft, but rather credit card fraud.

You can also (re)download the super expensive scammy ebooks.

And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...

True, I did one - "Mastering the skill of Blah Blah.."

Does not beat "How to pull your ex (Female version)"

It's not all expensive scammy ebooks, but "most" is probably an accurate assumption. I've actually purchased some useful software from a company using clickbank, but for the most part it's a strange part-pyramid scam type of thing with ebooks that tell you how to make your own part-pyramid scam business.

Reply on news.ycombinator.com