News for hackers. Stuff that matters.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:20PM (#15351911)
Edit: it is sad that my comment that is relevant and contains nothing but facts is downvoted... What has HN become?

Say what you want about Bitcoin, but it does solve credit card theft for good. If I could use my Bitcoin hardware wallet¹ to pay Sonic, I wouldn't be affected by this security breach.

¹ No Bitcoin theft has ever occurred on a hardware wallet thanks to their tamper proof isolation of private keys.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by abalone on Wednesday September 27, 2017 @05:36PM (#15352563)
Your digital wallet gives up consumer protections such as chargebacks which is a regression in consumer benefits. It is also accepted approximately nowhere, with very little incentive for merchants to add support.

Apple Pay and related solutions offer "tamper proof isolation of private keys" while still offering all of the consumer protections of cards, plus broad and growing acceptance via compatibility with standard contactless card terminals and POS systems.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @07:12PM (#15353209)
«gives up consumer protections such as chargebacks»

True. On the flip side, most merchants are honest so chargebacks are rarely needed. It's a different tradeoff: credit cards open you to ID theft, which is a lot more prevalent than the need for a chargeback, so personally I prefer Bitcoin.

«accepted approximately nowhere»

Any new technology, such as Bitcoin or Apple Pay, has to start from zero. So it is an irrelevant argument anyway. Today Bitcoin is in fact accepted at about 160,000 merchants.

«very little incentive for merchants to add support»

Not true. The biggest, and arguably most important, incentive for merchants to accept Bitcoin is that it allows them to avoid chargeback fraud (payments are irreversible.)

Apple Pay & similar technologies are a huge step up from plain credit/debit cards. Really, it's important to recognize this. But they still have multiple drawbacks. For example, (1) it has transaction limits, (2) it isn't usable for person-to-person payments (eg. paying back lunch money to a coworker), (3) purchases are still subject to authorization so in a way you don't have 100% control of your own money (eg. the system could accidentally flag the transaction as fraudulent and prevent you from buying something.)

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by stordoff on Wednesday September 27, 2017 @07:54PM (#15353409)
> On the flip side, most merchants are honest so chargebacks are rarely needed.

You also lose the convenience factor of that I don't need to care if a merchant is honest. If it's a merchant I haven't heard of it, I can just make the order without worrying too much (providing there are no obvious red flags) as there's very little risk. On the other hand, Bitcoin's irreversibly would mean I'd have to look into the company before ordering, and I'd probably avoid smaller merchants as a result.

> it allows them to avoid chargeback fraud (payments are irreversible.)

How big of an issue is this in practice? My gut reaction is most customers are honest so it's not big enough incentive to add another payment flow, but I've got no idea if that is accurate or not.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @08:29PM (#15353548)
«If it's a merchant I haven't heard of it...»

You are right. However, examine your pattern of purchases: if you are like the typical consumer, most of your purchases are made at the same merchants that you have been shopping at for years and already trust.

«How big of an issue is this in practice»

It's a huge issue in some markets (eg. online shopping.) I can't remember the stats but CC fraud actually has bankrupted some merchants because it is so prevalent. Dishonest clients are a lot more common than dishonest merchants. It's easy to understand why: by being dishonest, a merchant damages its reputation instantly, however if someone attempts to use a stolen CC and gets flagged, he would simply try another CC number or try another merchant.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by abalone on Thursday September 28, 2017 @09:39AM (#15357025)
This is just poor reasoning. There would be more dishonest merchants if the possibility of chargebacks ceased to exist. Your reasoning is like saying look how safe this town is, guess we don’t need police anymore.

And to say that virtually no merchant acceptance[1] is an “irrelevant argument” is laughable. Merchants have little incentive to spend money and effort to add support for an obscure payment method that virtually no one uses and likely never will, due to its reduction in consumer benefits. Apple Pay piggybacked the rollout of contactless terminals which gave it support at millions of locations out of the gate, and fully supports standard consumer protections and reward programs.

Finally, “person-to-person payments” is completely irrelevant to person-to-business transactions. But even in that corner Apple Pay will very soon be superior to any other method for “paying back lunch money to a coworker”. They are rolling out P2P this fall which supports all debit cards, is free, instantaneous, and you can spend the money right away at any Apple Pay merchant or send it to your bank account.

That cuts your argument down to just avoiding transaction limits and authorization at merchants you trust. Extremely narrow use case, so no way there’s going to be enough consumer interest to drive merchant adoption.

[1] https://www.bloomberg.com/news/articles/2017-07-12/bitcoin-a...

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Thursday September 28, 2017 @12:31PM (#15358477)
«There would be more dishonest merchants if the possibility of chargebacks ceased to exist»

Yes there will probably be a minor uptick in merchants being dishonest. But I doubt it will be as bad as you make it to be. Many other factors push merchants to stay honest: legal repercussions, damaged reputation, etc.

«And to say that virtually no merchant acceptance[1] is an “irrelevant argument” is laughable»

Irrelevant was the wrong word. I meant illogical. Your argument is like saying in the early days of Blu-ray that "no one will buy Blu-ray discs because no one has Blu-ray players".

«Merchants have little incentive»

Second time you say it, second time you are wrong. I already pointed out their main (largest!) incentive to accept BTC is to avoid chargeback fraud. This fraud is a major problem for merchants. They can go bankrupt (eg. https://www.youtube.com/watch?v=6Chp12sEnWk&t=45m0s) or be drawn into costly suits with no way to recover the money (https://www.reddit.com/r/legaladvice/comments/5r9nqi/credit_...).

Apple Pay P2P will be riddled with roadblocks. For starters most people will not be able to use it as it requires a $500 device (iPhone). I guarantee you there will be transaction limits, delays in access to funds, etc. All things that Bitcoin solves.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by abalone on Thursday September 28, 2017 @03:58PM (#15360230)
> Yes there will probably be a minor uptick in merchants being dishonest. But I doubt it will be as bad...

Simply wishful thinking. If that were the case consumer protections never would have been a very interesting feature. But they are. Especially for ecommerce.

> Your argument is like saying in the early days of Blu-ray that "no one will buy Blu-ray discs...

No and I clearly stated otherwise. Apple Pay is more like launching a new disc standard that is compatible with millions of existing players already deployed, compared to one that requires brand new hardware and has fewer features. No contest.

You also ignored -- probably because it is in your interest to ignore it -- that the reason merchants have no incentive to adopt is that nobody uses it. Payments are a two-sided market. Advances need to offer benefits to both sides of the market. You've only cited an advantage to one side, the merchant, which comes directly at the cost of a regression in benefits to the other side, the consumer.

Bitcoin as it stands is a major regression in consumer benefits, and you've only managed to cite one extremely narrow case where it offers any advantage whatsoever (no transaction limits or approval step). This is nowhere near enough to offer a compelling value proposition to consumers.

As for P2P, your own use case was sending lunch money. You've offered nothing to suggest that Apple Pay won't dominate this category. You're also incorrect in your "guarantee" about delays in access to funds; they are debit transactions that process instantly.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Friday September 29, 2017 @01:52PM (#15367484)
«Simply wishful thinking»

People will pay in BTC only merchants that they already trust. Think high-reputation businesses like Amazon, Costco. Do you really think companies like that would start being dishonest if they accepted bitcoins?

«compared to one that requires brand new hardware»

No, accepting Bitcoin doesn't require new hardware. It's a software update to a website or to a point-of-sale.

«You also ignored -- probably because it is in your interest to ignore it -- that the reason merchants have no incentive to adopt is that nobody uses it»

You can continue writing they have "no incentive" but it doesn't make it true. This is the 3rd time you ignore it, and the 3rd time I point it out: their #1 incentive to accept BTC is to avoid chargeback fraud. Will I have to repeat it a 4th time?

As to "nobody uses it", I am not ignoring you, it is simply that you are wrong. Usage is growing: we got from 0 to 160,000 merchants in a few years, the transaction rate is doubling every 18 months (not due to speculation: https://news.ycombinator.com/item?id=15281860)

«Bitcoin as it stands is a major regression in consumer benefits»

It is a (small) regression, yes, no denying that, but it is far outweighed by the advantages: permissionless, near-instant international payments, no inflation, censorship-resistant, gives access to the underbanked/unbanked, etc.

As to Apple P2P, it is pointless to continue discussing it before it is rolled out and before we have a clear idea of its advantages and inconvenients. But I maintain my position that, if not delays, there will be transactions limits, and it also won't ever be used widely (for starters, only 2-3% of the world population has an iPhone.)

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by QAPereo on Wednesday September 27, 2017 @04:25PM (#15351954)
If someone else uses my cc, I’m not paying it. If someone steals my bitcoins, they’re fucking GONE.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by craftyguy on Wednesday September 27, 2017 @04:34PM (#15352035)
Pretty much this. Bitcoins are like carrying around cash. Most folks will not argue that you own it, since it's in your pocket, but if someone picks your pocket in a crown then there's no way you're getting it back.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by koiz on Wednesday September 27, 2017 @04:37PM (#15352060)
No they aren't.

When did cash get 2 factor auth?

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by craftyguy on Wednesday September 27, 2017 @04:40PM (#15352101)
2FA is not inherently part of bitcoin's design. It's something that can be enabled, but not all implement it.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by koiz on Wednesday September 27, 2017 @04:44PM (#15352145)
So I ask again... Where's Cash's 2 factor auth.

All of the major wallets/traders use 2FA and all the hardware wallets have it too.

It's like saying... Well there's safes and banks for cash but its something that not everyone "enables" but you and I both know they use it.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by losteric on Wednesday September 27, 2017 @04:45PM (#15352156)
When has 2fa stop a bullet or knife?

Very little cash is stolen by pick-pockets or home burglars. People open their wallets because they fear pain, it doesn't matter how many locks are on the wallet.

relevant xkcd: https://xkcd.com/538/

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by ryanlol on Wednesday September 27, 2017 @04:56PM (#15352271)
Timelock stops bullets and knives.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by losteric on Wednesday September 27, 2017 @05:02PM (#15352319)
Have you ever been robbed? Tell the wrong person you don't have money, and they'll attack just to make sure.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:34PM (#15352034)
Wrong. In the US you may be liable for the full amount stolen if you fail to notice the theft in 30 days. Even if you report the theft promptly, the law allows your issuer to make you liable for the first $50.

Also you completely ignored my point about hardware wallets making theft a non-problem.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by castis on Wednesday September 27, 2017 @04:51PM (#15352218)
> the law allows your issuer to make you liable for the first $50

This has never happened to me, and ive had a CC compromised a few times.

If someone steals your hardware wallet, what do you consider that?

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:54PM (#15352248)
Physically stealing a hardware wallet is typically not usefull because they are PIN-protected. And you can back them up by writing the 12/24-word seed in a safe/hidden spot.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by simlevesque on Wednesday September 27, 2017 @04:41PM (#15352111)
Can't you steal a hardware wallet ?
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:53PM (#15352239)
They are typically PIN-protected. And you can back them up by writing the 12/24-word seed in a safe/hidden spot.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by Pinckney on Wednesday September 27, 2017 @11:13PM (#15354269)
What assurance do I have that the HW wallet vendor doesn't have my seed written down for when they decide to retire?
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Thursday September 28, 2017 @12:08AM (#15354499)
If you are paranoid you can choose your own random seed when initializing the wallet.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by QAPereo on Wednesday September 27, 2017 @04:37PM (#15352065)
Sure, so don’t ignore your finances for a month.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:46PM (#15352162)
You will still be liable for $50. And you again ignored my point about hardware wallets making theft a non-problem.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by QAPereo on Wednesday September 27, 2017 @05:16PM (#15352430)
Actually it can still be stolen, but like an impenetrable safe full of money, of no use to the thief. You’d still be screwed though!
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @05:51PM (#15352658)
Not screwed, because a hw wallet can easily be backed up by writing down the 12/24-word seed in a safe/hidden spot.

Our discussion thread demonstrates that more education is needed around hardware wallets, as most people have no idea how they work or even that they exist.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by koiz on Wednesday September 27, 2017 @04:35PM (#15352041)
If someone steals my wallet with my cash, its GONE.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by topleveldomain on Wednesday September 27, 2017 @04:36PM (#15352055)
But if someone steals your credit card and buys $10,000 worth of stuff, you're probably getting that money back.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by TallGuyShort on Wednesday September 27, 2017 @04:37PM (#15352059)
Sounds more like an argument against cash, than an argument for Bitcoin...
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by koiz on Wednesday September 27, 2017 @04:40PM (#15352105)
Credit Cards can co-exist with bitcoin, while btc solves some CC issues its target replacement is still cash.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by drzaiusapelord on Wednesday September 27, 2017 @04:38PM (#15352072)
So does using a chip reader. Assuming its up to current standards the card's information is cryptographically locked to Sonic's vendor ID and any stolen stored CC info could only be used at other Sonics.

Chip + Pin solves it even better by forcing the attacker to learn the pin for the card. We're not there yet in the US but once everyone has modern chip readers, adding pins will be trivial.

Also as a customer I'm not liable for these issues. The vendor is. With cryptocurrency, if there's a hack against me and my coins are gone, well, they're gone forever.

Sure beats giving up on cc's entirely for cryptocurrency, which comes with its own headaches and problems, especially Bitcoin which as a network wouldnt be able to cover 1 hour of credit transactions in the states.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by peterwwillis on Wednesday September 27, 2017 @04:51PM (#15352209)
The US will not be getting PINs for cards. It would put liability on the bank rather than the merchant. And it only affects cloned card fraud, it doesn't affect online transactions. As far as banks are concerned, the chip itself provides enough protection, and they have no interest in helping reduce merchant losses.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by amenghra on Wednesday September 27, 2017 @05:00PM (#15352297)
> cryptographically locked to Sonic's vendor ID and any stolen stored CC info could only be used at other Sonics.

That's not how chip cards work.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by losteric on Wednesday September 27, 2017 @04:39PM (#15352087)
Bitcoin is more analogous to gold bricks or cash, not credit cards.

Credit cards are built on underlying currencies, offering easy short-term debt and a simpler payment process (compared to check/cash)... I expect that bitcoin credit cards are another prerequisite for consumer adoption.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by jff on Wednesday September 27, 2017 @05:04PM (#15352335)
You're getting downvoted because everyone hates when Bitcoin idiots force it into every damn conversation.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @08:36PM (#15353573)
I would have never guessed I was downvoted because "Bitcoin is mentioned too often"…

I need to point out that your comment ("idiots") is against HN guidelines ("be civil"): https://news.ycombinator.com/newsguidelines.html

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by cm2187 on Wednesday September 27, 2017 @04:49PM (#15352189)
Yeah, if I keep my credit card in a safe and never use it, no fraud is going to happen. If I use it to pay for things multiple times a day, this happens. It's not like if there hasn't been bitcoins stolen in the past.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by ryebit on Wednesday September 27, 2017 @05:01PM (#15352315)
Bitcoins can only be transferred if you approve it with your private key; which the other party never sees. You can go lock the bitcoin private key up again, and not worry someone is going take more coins while you're sleeping. All that you have to trust is that the device storing your private key (hardware wallet, phone, whatever) isn't compromised.

This also roughly applies to chip-and-pin systems, where the chip holds the private key. They're both like cash in a wallet -- giving someone cash from your wallet doesn't give them the ability to magically disappear more money while your wallet's sitting beside your bed later that night.

Whereas with a (non-chip) credit card, once another party has your information just once, a theft can happen anytime from then until years later when the CC expires.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by viraptor on Wednesday September 27, 2017 @05:52PM (#15352669)
It sure can happen: breach at the bank, predictable patterns used, intercepted mail. I'm sure there are more situations I haven't thought of.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by mrb on Wednesday September 27, 2017 @04:57PM (#15352279)
100% of the bitcoin thefts up to this day could have been avoided if people had used hardware wallets. I'm serious when I said hw wallets make theft a non-problem.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by tzs on Wednesday September 27, 2017 @05:55PM (#15352693)
> Say what you want about Bitcoin, but it does solve credit card theft for good

Bitcoin is very similar to cash in many respects, especially when compared to credit cards.

I doubt anyone would say this:

> Say what you want about cash, but it does solve credit card theft for good. If I could use my cash wallet to pay Sonic, I wouldn't be affected by this security breach

It's obviously true, but it's also trivial and pointless. Saying Bitcoin instead of cash doesn't change any of that.

Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by b3lvedere on Wednesday September 27, 2017 @06:04PM (#15352754)
You can't have 'free money' in Bitcoin in the same way a lot of people (ab)use their credit cards.
Re:Breach at Sonic Drive-In May Have Impacted Millions of Cr... by chrisco255 on Wednesday September 27, 2017 @05:01PM (#15352313)
Agreed. Credit card nums, social security, etc all suffer from the lack of private keys and signed transactions.