Hacker News Reader

One interesting thing I've noticed as a home depot customer is they don't require you to have a receipt for returns, as they can access all previous transactions based on your credit card number (... and therefore presumably have a centralized database which maintains a record of any credit card used at a home depot, hopefully in some hashed/encrypted format)

View on HN

> presumably have a centralized database which maintains a record of any credit card used at a home depot

That's a bit of a leap. I'd assume they just have a hash of the data.

CC numbers are not that large of a space and can be enumerated. They could use a short hash (like a 26-bit hash) so each hash value has multiple plausible numbers -- at the risk of having collisions.

What does that get you, though? The formula for a valid card number (Mod 10) is public. If Home Depot uses a 1-way hash for the card number, and ONLY uses the card number, you gain nothing - you still need the expiration date/CVV/Name to do much else.

That's true whether or not they use a hash function.

Let's be honest here. They probably have the full details of every transaction in plain text in a database.

If they do, they're not PCI compliant and risk having their ability to conduct credit card transactions revoked.

Reply on news.ycombinator.com