Didn’t Homejoy Shut Down?

Re:Didn’t Homejoy Shut Down? by jasonlaramburu on Wednesday October 28, 2015 @07:11PM (#10468078)

Aaron, I was a homejoy customer. I am frustrated and concerned that my credit card # was sold to another company without my consent. How can users opt-out of having their data sold to flymaids (or any future ventures)? The fact that flymaids' site is a poorly-built clone of a competitor's site also makes me scared that my data is not being protected.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by nostromo on Wednesday October 28, 2015 @07:20PM (#10468112)

Your CC is probably safe on Stripe's servers.

Which makes me wonder -- does Stripe allow entire accounts to change hands willy-nilly like this?

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by noneTheHacker on Wednesday October 28, 2015 @08:33PM (#10468458)

Yes, Stripe makes it SUPER simple for accounts to change hands.

I bought a small business from a brokerage site.

He transferred the Stripe account to me no problem. It was as simple as me making a Stripe user account and then him adding me to the account he used for the business and then me removing him.

The entire process took minutes. It took about 3 weeks for PayPal.

https://support.stripe.com/questions/change-account-owner

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by chris_wot on Wednesday October 28, 2015 @08:44PM (#10468496)

According to Stripe, they require evidence you comply with PCI-DSS. I'm interested, did they ask you for this?

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by ceejayoz on Wednesday October 28, 2015 @08:56PM (#10468541)

As long as you're using their JS solutions so credit card data never ever goes through your servers (even temporarily), PCI-DSS compliance on Stripe just means serving the payment page over SSL.

https://support.stripe.com/questions/do-i-need-to-be-pci-com...

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by nerdy on Thursday October 29, 2015 @01:36AM (#10469467)

Except this article says it is not served over SSL. There's even a huge graphic with an arrow pointing it out.

https://cdn-images-1.medium.com/max/1600/1*dLlQGvWTeMTB7PT_n...

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by jessedhillon on Thursday October 29, 2015 @02:24AM (#10469577)

That could just be the last four digits. When you create a token with Stripe, you do still get those back. Conceivably, they're showing 12 asterisks and the naked last four, while retaining the token Homejoy used with you so they can recharge -- although in order to do that, they would need Homejoy's Stripe API secret.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by shkkmo on Thursday October 29, 2015 @04:10AM (#10469756)

The last four digits are still plenty sensitive enough to make serving them over http blatantly irresponsible.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by chris_wot on Thursday October 29, 2015 @05:31AM (#10469938)

It's not just that - it allows you to update your credit card over unencrypted http.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by ceejayoz on Thursday October 29, 2015 @08:46AM (#10470544)

Yes. That's a problem, certainly. I'm just pointing out that Stripe's "are you PCI compliant" process is pretty low-key.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by staringispolite on Wednesday October 28, 2015 @07:34PM (#10468176)

I was also thinking through which rules would apply here. (What entity owns a Stripe account? What constitutes a transfer of data? How does this case differ from say, an acquisition?)

The medium article only shows info you can get from a Stripe card_id request. Not using https on that page is troublesome, but I don't think there's any evidence to suggest FlyMaids (or even HomeJoy) ever had access to actual CC information.

It seems more likely that this depends on Homejoy's ToS/Privacy Policy. (Although it's certainly possible the transfer was done in a way that violates Stripe's policies, I'm just not familiar with those)

Edit: It might even be the same business entity with different d.b.a names. Good discussion here: https://news.ycombinator.com/item?id=10468161

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by TimSchumann on Wednesday October 28, 2015 @07:29PM (#10468152)

My guess is the account never changed hands. Stripe can't really prevent a legitimate owner of an account from doing something stupid with it. At least, not until after the fact.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by carrja99 on Wednesday October 28, 2015 @07:33PM (#10468175)

Most likely they just have the same API keys

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by johnsalzarulo on Wednesday October 28, 2015 @07:27PM (#10468145)

I was wondering the same thing about Stripe or any of the big credit card processors. That'd be shady.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by nandemo on Thursday October 29, 2015 @01:26AM (#10469441)

True, they probably don't have the full card numbers. But if the new business can charge my card, then I don't think my card info is "safe".

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by jmathai on Wednesday October 28, 2015 @08:43PM (#10468492)

Doesn't look like it is stored (only) with Stripe. The profile section of the site (per the blog post screenshot) displays some of the credit card info.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by ceejayoz on Wednesday October 28, 2015 @09:06PM (#10468568)

Stripe's API returns the last four digits for a tokenized card so you can display them to users.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by tcdent on Wednesday October 28, 2015 @11:25PM (#10469059)

It's also intentionally difficult to gain access to the customer's card number on checkout. All the server is allowed to receive is a unique token representing the customer to complete the transaction with. Pretty clever, but I suppose not impossible to workaround.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by jmathai on Thursday October 29, 2015 @04:20AM (#10469774)

Thanks for clarifying that. Did not know.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by jasonlaramburu on Wednesday October 28, 2015 @07:27PM (#10468147)

Are they using stripe on the new site(s)? Looks like those have all been taken down.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by justinzollars on Wednesday October 28, 2015 @07:43PM (#10468234)

If so this information should be deleted. If I were effected I would be pissed.

I hope someone at Stripe responds because this is a personal data issue.

[ Parent | on HN ]

Re:Didn’t Homejoy Shut Down? by detaro on Wednesday October 28, 2015 @08:02PM (#10468330)

If they keep data in Stripe, you should contact Stripe about it. I'd be interested in what they have to say.

[ Parent | on HN ]