Malicious PyPI packages stealing credit cards and injecting code

Re:Malicious PyPI packages stealing credit cards and injecti... by jetrink on Tuesday August 03, 2021 @09:18AM (#28048775)

Credit cards are insecure by design and worrying about having them stolen from your browser or vault is not worth it in my opinion. You're far more likely to have it compromised from the retailer side no matter how careful you are. Also, it's easy to set up a notification on your phone for every time a card is used, so you can report fraud before any harm is done.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by prower on Tuesday August 03, 2021 @09:36AM (#28048979)

Some online banks (don't know how widespread this is) allow you to create "virtual card" that expire either after 1 purchase or at a specific date (and with a set maximum of budget). I use them for every single purchase I make online, it's inconvenient but at least i've never entered my real card info anywhere.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by brianwawok on Tuesday August 03, 2021 @09:42AM (#28049030)

That sounds like a lot of work. At least in the US you are not responsible for fraud. (I think the law may have like a $50 liability thing, but Visa/MC waive). So it's better to just not do this, and every 3-4 years when my CC is stolen, call them up - dispute the charges, get a new number. Takes < 5 minutes and I keep going.

For what it's worth, the 2 times my number got stolen in the last 6 years, one was from a rogue agent at a hotel in Chicago, and one was from a bad website that stored credit cards.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by trepatudo on Tuesday August 03, 2021 @02:54PM (#28052748)

In Portugal, you basically open the app, scan fingerprint to give permission and get a new card.

You can even scan the card via webcam or copy the details to clipboard.

The virtual card also limits itself either to single transaction or single store so it can't be used even if compromised on store level.

It's pretty simple process (<30sec) and it's really useful.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by hggythhdtr on Tuesday August 03, 2021 @12:10PM (#28050939)

> That sounds like a lot of work.

My bank has a browser plugin that can create virtual cards with just a few clicks.

> dispute the charges, get a new number. Takes < 5 minutes and I keep going.

This isn't the case for me, it would take me quite a bit of time over a period of several weeks to update all of the places i use my card if I were using the same number everywhere and it was compromised. I handle a lot of billing. I've had cards compromised at least three times in the past and it's very unpleasant. (for me)

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by nIHOPp6MQw0f5ut on Tuesday August 03, 2021 @10:09AM (#28049372)

Privacy (dot) com offers that as a service and you can use their extension to generate a card without leaving the page.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by bastardoperator on Tuesday August 03, 2021 @11:47AM (#28050630)

Exactly this. I just assume my credit card will be stolen or leaked. Nearly every credit card has zero liability protection too so there is no use in worrying, this is why I use credit cards.

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by TheFreim on Tuesday August 03, 2021 @11:54AM (#28050736)

Liability and protection provided by credit cards is one of the reasons some people suggest using them and never using a debit card. Easier to get money back if it gets stolen from a credit card (assuming some YouTube video I saw was accurate).

[ Parent | on HN ]

Re:Malicious PyPI packages stealing credit cards and injecti... by kristianp on Tuesday August 03, 2021 @06:32PM (#28055038)

I definitely want to avoid having my credit card details stolen. The inconvenience of calling the bank to report fraudulent transactions and then waiting a few weeks for a replacement card to arrive is something to avoid if you value your time.

I save most passwords in the browser, including discord, but not important things like banks and emails. Password manager for that. I think it's foolish of Chrome to offer to save CC details.

[ Parent | on HN ]