News for hackers. Stuff that matters.
Re:Braid Is Dead, Long Live Braid by dylan604 on Friday October 06, 2023 @10:36PM (#37798550)
I can some what sympathize with part of what it sounds like here getting crushed by people committing credit card fraud. I had a small little company online in the early day's of the interweb's online payments. We had a very niche retail site, and for a few months we were increasing sales month-to-month. We'd get sales, the merchant company would approve them, and we'd ship out the product. Right up until the point where we got hit with enough fraudulent sales in what had to have been a coordinated effort that it killed us. The card numbers used were stolen, and we got hit with a massive amount of charge backs. Except, now we're out the inventory and no money to restock. It was the end of the retail side of us. To this day, I still have some sort of PTSD from that experience. I have a new site being worked on integrating with a popular modern card processing company. I am terrified to let the site go live and get hit with fraudulent charges again. I am on the fence of not even allowing for sales through the website.
Re:Braid Is Dead, Long Live Braid by sneak on Friday October 06, 2023 @10:44PM (#37798582)
If only there were some good and fast internet payment mechanism without middlemen or gatekeepers, where the person getting paid could be immediately 100% sure that they were in possession of the money.

Maybe someone will invent it one day.

Re:Braid Is Dead, Long Live Braid by CJefferson on Friday October 06, 2023 @10:51PM (#37798618)
The problem is that would have the opposite problem, that purchases made with stolen cards were 100% unrecoverable. While im sure we can improve things, the fact that the current system favors individual people, rather than businesses, is intentional, not an accident.
Re:Braid Is Dead, Long Live Braid by kolinko on Saturday October 07, 2023 @01:50AM (#37799312)
Having a 2FA for credit card / wire transfer payments solves this issue and it's a de facto standard now in many European countries.
Re:Braid Is Dead, Long Live Braid by happymellon on Saturday October 07, 2023 @07:00AM (#37800676)
How are people using stolen cards?

Do your banks not have 2 factor enabled?

Using the card not present should require a second factor, Visa Secure type of thing and in person should require your pin for non-frivolous amounts.

Re:Braid Is Dead, Long Live Braid by dylan604 on Saturday October 07, 2023 @09:54AM (#37801701)
In the late '90s when it happened to me, this wasn't even invented yet. In the US today, 2nd-factor is not widely used at all. Not once I have I been challenged by a 2nd-factor, and if I were to be, I'd have no idea what to do with it.
Re:Braid Is Dead, Long Live Braid by happymellon on Sunday October 08, 2023 @09:35AM (#37810322)
If you were purchasing online then it will tell you to refer to your banking app. If it's in perso , them asking for a pin is pretty straightforward.

So who is pushing back against this? The networks already have it in place everywhere else, and since it's part of the transaction process there isn't a lot for stores or websites to do.

Re:Braid Is Dead, Long Live Braid by zdragnar on Saturday October 07, 2023 @10:06AM (#37801809)
In the US, entering a PIN at the terminal is only prompted for debit cards, not credit, and even then you can usually opt to run the debit card as if it were a credit card and just scribble a fake signature.
Re:Braid Is Dead, Long Live Braid by happymellon on Sunday October 08, 2023 @09:36AM (#37810330)
But that's a low hurdle to resolve.

The Fed should be able to phase in requirements. They've had decades so far.

Re:Braid Is Dead, Long Live Braid by vanviegen on Saturday October 07, 2023 @01:14AM (#37799170)
In the Netherlands we have such a system called iDEAL. People use the app/site from their own bank to authorize the payment and the money arrives on the receiver's bank account instantly and irrevocably (without a judge stepping in). It's also very cheap (like 25 cents fixed).

Merchant fraud doesn't appear to be a big problem. Probably because the merchant requires a Dutch bank account, which requires a lot of identifying paperwork

It's pretty awesome.

Many other European companies have a similar system, and I believe there are plans to join them into one system. Let's hope the credit card lobbyist don't manage to mess it up.

Re:Braid Is Dead, Long Live Braid by kolinko on Saturday October 07, 2023 @01:46AM (#37799294)
Hear hear. We have the same thing in Poland.
Re:Braid Is Dead, Long Live Braid by sneak on Saturday October 07, 2023 @03:52AM (#37799882)
I’m not knocking it for Dutch people, but the internet needs a trustworthy global payments system that works for more than the 20 million in .nl.

It also sucks that you have to provide strong identity to the payer or payee, sending or receiving payments should not require disclosing identity. That’s a bug, not a feature.

Re:Braid Is Dead, Long Live Braid by DonHopkins on Saturday October 07, 2023 @04:36AM (#37800068)
Your need to buy illegal drugs and launder money anonymously should not trump the needs of other people who simply require a fast, reliable way to make legal secure business transactions without fees and middlemen. Anyway, the Netherlands and rest of the world already has a fully functioning illegal drug trading and money laundering network, without any need for your cryptocurrency bullshit: that's just a solution looking for problems, which it turns out were solved much better, a long time ago.
Re:Braid Is Dead, Long Live Braid by autoexec on Saturday October 07, 2023 @04:53AM (#37800157)
I still hope for some solution to the problem that doesn't depend on imaginary internet money the value of which fluctuates wildly by the minute. We can keep using cash for anonymous transactions, but there are so many limitations to cash transactions that money transfers via internet don't have.
Re:Braid Is Dead, Long Live Braid by semi on Saturday October 07, 2023 @11:46AM (#37802675)
you're making a lot of assumptions in bad faith. why?

Maybe they just don't want all of their personal information to be stored in yet another database waiting to be leaked.

Re:Braid Is Dead, Long Live Braid by DonHopkins on Saturday October 07, 2023 @09:31PM (#37807067)
The blockchain is a public database that's leaked by definition.

Maybe they shouldn't spend their time evangelizing and shilling cryptocurrencies online just because their own financial security depends on tricking as many new suckers as possible into investing all of their money into the same get-rich-quick pyramid schemes they put their own money into, so they can pump and dump and pull the rug on them the way somebody else did to them.

Re:Braid Is Dead, Long Live Braid by sneak on Saturday October 07, 2023 @11:41PM (#37807693)
It’s not a database, it’s just a ledger, and it doesn’t identify people unless you use it incorrectly.

Your unhinged attacks are factually inaccurate, and contribute nothing to the discussion at hand (that is, about payment systems for individual use, which are usually denominated in fiat currencies, which usually get paid in stablecoins) besides anger and hostility. I’ve been using cryptocurrencies as an end user for more than a dozen years and have never done any of these things you list.

Perhaps you paint with too wide a brush.

Re:Braid Is Dead, Long Live Braid by DonHopkins on Sunday October 08, 2023 @02:33AM (#37808327)
>I’ve been using cryptocurrencies as an end user for more than a dozen years and have never done any of these things you list.

This whole discussion thread was started by YOU, shilling and evangelizing cryptocurrency, which I just listed as something you should not spend your time doing:

https://news.ycombinator.com/item?id=37798582

And if you use crypto to buy illegal drugs and launder money, I fully expect you'd lie about that.

But when you evangelize and shill like you're doing now, you're certainly assisting, encouraging, supporting, and appealing to criminals who do.

And if all you use if for is gambling, that's still a stupid idea. Did you pay taxes on all of your winnings, or is your whole point of using cryptocurrency income tax evasion?

Do you have any idea how much coal has been burnt on your behalf in the 12 years you've been gambling with cryptocurrencies?

You do know there are other ways to gamble and evading taxes that don't involve burning so much coal, don't you?

Re:Braid Is Dead, Long Live Braid by DonHopkins on Sunday October 08, 2023 @04:53AM (#37808906)
And if you're so professional and trustworthy and transparent as you claim, Mister Sneak, then why haven't you updated your list of government requests for user data on keytern.al since 2015-Q3, 8 years or 32 quarters ago?

https://keytern.al/p/faq/

Either you've had government requests since then during the intervening 8 years and you're dishonestly concealing them, or keytern.al is not a serious company, and you're just yet another cryptocurrency scammer trying to defraud people and get rich quick by shilling on Hacker News.

So stop shilling your crypto key stealing company on Hacker News as recently as 23 days ago, if you don't have the time to update your list of government requests for user data in 8 years, missing 32 quarters in a row, or honestly answer legitimate questions about your company, and provide objective proof of your outlandish claim about your own security and integrity.

Re:Braid Is Dead, Long Live Braid by DonHopkins on Sunday October 08, 2023 @05:03AM (#37808951)
As it turns out, my assumptions about Mister Sneak weren't nearly bad faith enough. See below.
Re:Braid Is Dead, Long Live Braid by mcherm on Saturday October 07, 2023 @05:39AM (#37800347)
> It also sucks that you have to provide strong identity to the payer or payee, [...] That’s a bug, not a feature.

No, it is a feature, just not a feature for the customer. It's also not a feature for the bank or fintech. The strict identity requirements are a feature for the GOVERNMENT, and if you want to avoid them you probably need to start your own government (which is notoriously difficult).

Re:Braid Is Dead, Long Live Braid by Dylan16807 on Saturday October 07, 2023 @03:34AM (#37799794)
I assume you're implying some kind of cryptocurrency, but it's impractical to use those without middlemen and you forgot to say "without huge fees".

Also instant 100% certainty is a bit too much in the face of fraud.

Re:Braid Is Dead, Long Live Braid by sneak on Saturday October 07, 2023 @03:36AM (#37799804)
> but it's impractical to use those without middlemen and you forgot to say "without huge fees".

It seems your information is quite a bit out of date. These hasn’t been true for a long time.

Re:Braid Is Dead, Long Live Braid by Dylan16807 on Saturday October 07, 2023 @03:41AM (#37799824)
I didn't say that the huge fees are unavoidable, but they're the norm.

And okay, tell me about how I get some cryptocurrency in a practical way without big middlemen.

Re:Braid Is Dead, Long Live Braid by sneak on Saturday October 07, 2023 @03:53AM (#37799886)
The lightning network works great, as does Ethereum.

The incumbents successfully lobbied to get easy on-ramps to this competing system regulated basically out of existence. It’s a tragic story.

Re:Braid Is Dead, Long Live Braid by DonHopkins on Saturday October 07, 2023 @04:42AM (#37800104)
Yeah, I'm sure that's how SBF feels too, but now he's in jail where he belongs. But that's just good government regulation and law enforcement working the way they're supposed to, and I wouldn't exactly call his lobbying "successful". It's SUPPOSED to feel tragic for the people who tried to do it, and got caught.
Re:Braid Is Dead, Long Live Braid by camgunz on Saturday October 07, 2023 @08:49AM (#37801294)
You can't really use lightning/Ethereum without using an exchange (a big middleman) to convert your fiat to BTC/ETH, because doing it without KYC etc. is money laundering. I don't really think this is incumbents lobbying, I think it's law enforcement saying, "the way we track organized crime is through money, so you can't do this". Crypto advocates know this, because a big selling point they always bring up is "spend money freely without regulation", which phrased another way is "buy/sell things your government doesn't want you to" which is the definition of organized crime--the only difference here is scale.
Re:Braid Is Dead, Long Live Braid by sneak on Sunday October 08, 2023 @04:01AM (#37808671)
There are many occasions where there are completely legal reasons you need or want to transfer money that your government nevertheless does not want you to.

If you are innocent, but accused of a crime, paying a defense attorney is high on that list. The government attorneys would much prefer you not be able to do that.

Donating money to legal organizations that threaten the status quo is another case; you may remember the Wikileaks banking blockade, which happened without any charges being filed against anyone, in response to journalism that some people didn’t like.

The burden of proof for losing access to one’s electronic assets presently is approximately zero. It’s guilty until proven innocent. Proving one’s innocence, unsurprisingly, requires money.

In 2011 I gave a talk at the CCC about how censorship resistant payments are an essential prerequisite to a free society. If you lose the ability to make legal payments the state does not approve of, you lose your basic liberty. You may be interested in seeing it if you care about these things, which I of course think are relevant to everyone.

https://media.ccc.de/v/cccamp11-4591-financing_the_revolutio...

Re:Braid Is Dead, Long Live Braid by camgunz on Sunday October 08, 2023 @11:22AM (#37811266)
Oh hey, I'm not arguing for less privacy in payments. GP was saying "tell me about how I get some cryptocurrency in a practical way without big middlemen" and there isn't one because of how states define crime and money laundering. I do think it's kind of a tricky problem, but I'm not really defending the regime here nor am I saying that it's actually important to fund things like Wikileaks (which, to disclaim my bias here, I'm not a fan of). I'm sympathetic to the idea that commerce is a basic human right, but I think it very quickly runs into "can I buy black market goods/services" (which are basically like, drugs, guns, human trafficking, violence-for-hire) and almost everyone says "no". I don't see how crypto gets us closer to "you can fund Wikileaks" while not moving us closer to "you can buy a human slave". I think for that we have to look to democratic action to change the laws.
Re:Braid Is Dead, Long Live Braid by crosa on Saturday October 07, 2023 @04:21AM (#37799995)
In Brazil the central bank has such system for free, it's called PIX and is so good and simple to use that some fintechs lost a good chunk of their market share. You only need your National ID or an email. It became even an expression "send me a pix"
Re:Braid Is Dead, Long Live Braid by nrp on Friday October 06, 2023 @10:47PM (#37798597)
We’ve had good experience using Stripe with extremely aggressive Stripe Radar settings, and using a manual review queue to avoid false positives. We also don’t enable payment methods that automatically accept disputes (e.g. SEPA Direct Debit).
Re:Braid Is Dead, Long Live Braid by dylan604 on Friday October 06, 2023 @11:42PM (#37798834)
Stripe is who I'm playing with now, but I just do not like having to include their JS library on every page just to use their fraud detection.
Re:Braid Is Dead, Long Live Braid by bpicolo on Saturday October 07, 2023 @02:18AM (#37799430)
The signals they get from you including that library are a big part of what makes the fraud detection effective
Re:Braid Is Dead, Long Live Braid by dylan604 on Saturday October 07, 2023 @09:52AM (#37801689)
It doesn't mean I have to like it. There's a lot of things in the "include our JS file, and get X benefit" in the world that I don't like. I don't have the time nor the desire to attempt to reverse all of the data that is being sent back to the mothership for some "benefit". I take pride in knowing that I'm not collecting data about my users to be stored for later use. I can't say that when I include 3rd party libraries.