News for hackers. Stuff that matters.

A comment on Didn’t Homejoy Shut Down?. Parent comment

Re:Didn’t Homejoy Shut Down? by bigtones on Wednesday October 28, 2015 @06:57PM (#10468009)
And when I say "testing different approaches" I mean:

* completely ripping off competitor business websites

* throwing PCI compliance and SSL encryption out the window

* generally treating our VC money purchased customers from our old firm like commodity dirt.

This one is gonna be a winner for sure.

[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by SomeCallMeTim on Wednesday October 28, 2015 @09:53PM (#10468724)
>throwing PCI compliance and SSL encryption out the window

If they were using Stripe or similar, then they don't have access to your credit cards. Only the last four digits and expiration.

[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by manigandham on Thursday October 29, 2015 @02:40AM (#10469599)
Yet without HTTPS anyone changing or entering new credit card info is at risk on this site. There's also personal information like where to find spare keys and stuff; it should be a lot more secure than this.
[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by SomeCallMeTim on Thursday October 29, 2015 @05:13PM (#10474327)
Stripe won't let you submit a credit card except through their form, which will be submitted through https.

Not defending the rest of the site. Just pointing out what I felt was not a problem. There are plenty of problems to go around, though.

[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by danhak on Wednesday October 28, 2015 @09:55PM (#10468731)
How bout the part where they're sending expiration date and last 4 digits over http?
[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by __P on Wednesday October 28, 2015 @10:23PM (#10468826)
That isn't secure information... Emails often contain that info, which is kind of worse than HTTP.
[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by slantedview on Thursday October 29, 2015 @12:23AM (#10469257)
But it is secure information. If I recall, last 4 digits were part of how the CIA chief's e-mail was hacked recently.
[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by SomeCallMeTim on Thursday October 29, 2015 @12:42AM (#10469306)
No, it's not secure information.

Any time you use last-4 as something secure, you're doing it wrong.

As mentioned above, last-4 is sent by email frequently, and email passes, unencrypted, through intermediate servers all over the Internet. Any compromised host can observe all of the email that passes through it.

Any process that uses last-4 to unlock a password or otherwise as a secure token is broken by design.

[ Parent | on HN ]
Re:Didn’t Homejoy Shut Down? by CamperBob2 on Thursday October 29, 2015 @06:39AM (#10470097)
Any time you use last-4 as something secure, you're doing it wrong.

It's not a question of what I use those digits for, it's a question of what everyone else uses them for.

[ Parent | on HN ]