Hacker News Reader

Comment by pcarolan | Hacker News Reader

I've had my card replaced three times in the last two years due to data breaches (Target, Home Depot, undisclosed). Every time I've had to re-setup all of my subscriptions. If there was no number/cvv/exp date to steal, there'd be no fraud without them having my phone.

View on HN

And why would cell phone payments not be subject to the same problem if they were as widespread as credit card payments/

ApplePay uses one time transactions. Even if it's intercepted, you can't reuse the information.

So then the problem of having to change the information for any recurring payments you have is obviated by a total inability to set up recurring payments? I suppose that's one solution.

I'm 90% sure recurring payments still work. I can't imagine them going to market with something like this without considering recurring payments.

IIRC for recurring they can use the same token or they get a slightly different token. Either way it's like using a different card with each merchant so you can easily track back who got hacked.

Nope. Recurring payments can use the same token, but that token is not a card number that can be presented to another merchant if stolen. Also, if a vendor is breached, only the tokens need be invalidated.

I imagine it will eventually be worthwhile to remote-clone whatever's on a phone, or MITM it somehow. Maybe that's "impossible by design" (it is to laugh), but the 2G phone downgrade and the export security downgrade of recent reminds us that the internet is full of surprises.

"Don't be too proud of this $SHINY you've constructed."

Aside: Did you just manage to combine references to Star Wars and Serenity/Firely there?

Ah, good catch, I didn't see the Firefly until you pointed it out.

I think the world needs a "reference to fiction" sentiment analysis browser plugin - probably with a tvtropes backend for maximum distraction capabilities.

Reply on news.ycombinator.com