News for hackers. Stuff that matters.

A comment on Ex-Googlers Train Machine Army to Sift Out Crooks. Parent comment

Re:Ex-Googlers Train Machine Army to Sift Out Crooks by Volpe on Tuesday March 19, 2013 @07:30PM (#5404387)
https://siftscience.com/docs/rest-api

There is no requirement in their api to supply CC details... so no requirement to be PCI.

So it would be weird if they did mention PCI...

The first 6 and the last 4 is not enough to make a valid CC... And if you are still guessing the last details then it's the same as just guessing the full number. (just you'll get their quicker)

[ Parent | on HN ]
Re:Ex-Googlers Train Machine Army to Sift Out Crooks by alttag on Tuesday March 19, 2013 @10:48PM (#5405292)
No, but 10 of 16 numbers that must conform to a checksum algorithm significantly reduces the search space to a point that a brute force seems trivial if other information is already possessed (e.g., zip code, or especially, cvv).
[ Parent | on HN ]
Re:Ex-Googlers Train Machine Army to Sift Out Crooks by nwh on Tuesday March 19, 2013 @11:54PM (#5405535)
The MyKi ticketing system in Australia prints the first 6 digits, last 4 digits, expiry date and full name on it's recepts. I mentioned to them in the past how easily it could be attacked, but the response was "nobody would do that".
[ Parent | on HN ]
Re:Ex-Googlers Train Machine Army to Sift Out Crooks by Volpe on Sunday March 24, 2013 @01:20AM (#5431230)
Brute forcing "ALL" the credit card numbers is not hard... Limitiing the search space doesn't make it easier... it just saves a little bit of electricity.
[ Parent | on HN ]