Hacker News Reader

Comment by ars | Hacker News Reader

> Credit card data was not compromised

So? Who cares about credit card data - it so easy to just send a list of compromised numbers to the banks and get new numbers. I've been sent new cards at least twice without being told why they are changing the number, except for some nebulous "security measure", so they clearly do do this.

Of all things to worry about credit card numbers hardly rank.

I don't know how it works - but can the breach allow attackers to upload modified apps in the name of the developer?

View on HN

I would care. If I know that it hasn't been compromised I don't have to get a new number and go around to all the services I'm registered with to update my credit card details. Saves me a lot of hassle.

They are supposed to update those automatically.

Who are? I use my credit card at multiple services. Is the bank going to call around to services that I have paid for previously and tell them my new credit card details? I hope not

When you get a new credit card, only the last 4 numbers will change, and your bank might charge the new credit card for payments that were supposed to be going to the old card if they are deemed low risk (if it's something you used to pay for before)

Of course, YMMV, this is just what my bank does.

Not even close. I work at a large bank and often 12 or more numbers change. Beyond that it is irrelevant how many numbers change. Beyond that only approved but unsettled transactions will go through under the old number. You can't continue to use the old number for new transactions.

> Is the bank going to call around to services that I have paid for previously and tell them my new credit card details? I hope not

Yes. Anyplace that bills you regularly on the old number will automatically get the new number.

> You can't continue to use the old number for new transactions.

It depends on how you define new. A new biller, then correct. But if it's a biller that you have an existing relationship with, i.e. they bill you every month, then they do send them the new numbers (and/or allow them to use the old number).

I can't say if this is a global policy of all issuers, but I can say that I've experienced it. I've also seen it in the fine print when I signed up for repeated billing.

It's usually called something like "automatic account updater" by the credit card issuer. I think it's pretty common for merchant banks and merchant service providers to offer it these days. (We use it where I work.)

Here's an older Braintree blog post about it: https://www.braintreepayments.com/blog/automatic-update-of-c...

People using debit cards would care. It's much more difficult to get payments refunded with them.

> but can the breach allow attackers to upload modified apps in the name of the developer?

It doesn't look like they can. Uploading apps to the app store is done via iTunes Connect. That's always been a separate login from the developer center, and it has not been down during the current dev center outage.

Reply on news.ycombinator.com