Chase did a bad thing, so we did a good thing

Re:Chase did a bad thing, so we did a good thing by asimjalis on Tuesday June 11, 2019 @06:22PM (#20160042)

How secure is this website? What prevents a phishing site from pretending to be an opt-out site?

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by zbruhnke on Tuesday June 11, 2019 @06:25PM (#20160057)

Hey there,

Maker of the site here! Our servers don't touch any of this data, it goes straight to Very Good Security and lives in a PCI compliant vault ... We ourselves are building a new kind of bank so we take security very seriously and are not phishing.

Happy to talk through in more details but the FAQs do a pretty good job of that too!

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by krrose27 on Tuesday June 11, 2019 @06:59PM (#20160285)

With a better understanding of how VGS works I really just fall back to my weakest link in the chain questions:

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content (it appears they do)? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?

What stops you from scraping this data from Lob's API?

---

Original comment below.

I'm confused on how this data lands at Lob with an account number if you never get it.

Correct me if I'm wrong but the letter you send includes the account number and not the VGS token?

All of my following questions assumes an affirmative answer.

How is the account number landed in Lob? It appears something must be calling the Lob API with an unencrypted account number? What is making that call?

Does Lob hold any PCI level certifications? It appears they hold HIPAA but I see no mention of PCI?

Does Lob provide any interface that shows sent mail and the content? If so and they don't hold any PCI certifications what benefit do we really have with ever getting a VGS token?

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by snug on Tuesday June 11, 2019 @06:25PM (#20160064)

So how do you send the mail if you never get the data?

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by heavymark on Tuesday June 11, 2019 @06:29PM (#20160087)

As they mentioned checkout the FAQ where it outlines that process under the aptly named, "How does this site work?" and they also offer a template for you to mail yourself if your prefer.

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by zbruhnke on Tuesday June 11, 2019 @06:34PM (#20160116)

We cannot send it if we do not get the data - the user would have to fill out the template and mail it themselves in that case

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by codemati on Tuesday June 11, 2019 @06:48PM (#20160204)

FYI - there is some duplicated content under the "How does this site work?" heading.

[ Parent | on HN ]

Re:Chase did a bad thing, so we did a good thing by zbruhnke on Tuesday June 11, 2019 @07:40PM (#20160513)

Thanks for catching that! fix should be pushed now!

[ Parent | on HN ]