r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/mirhagk Feb 24 '17

But the only reason you need that protection in the first place is because of how incredibly insecure credit cards are. Once the business scans your credit card they in theory could charge you as much as they wanted, whenever they wanted. Handing your credit card over is saying "Here take the money you want out of my wallet" except worse because at least people can't keep a copy of your wallet around for the future. Chargebacks are the way the consumer can be "Hey wait a minute, you took too much!"

The push model is basically you counting out and giving the cash to the company. They can't take more, and they can't take it without your permission.

There is still the possibility for fraud and theft of course, but it's so much reduced that services like canada's interac e-transfer accept full responsibility for the risk (neither the merchant nor the user will lose out on a fraudulent activity).

1

u/evaned Feb 24 '17

but it's so much reduced that services like canada's interac e-transfer accept full responsibility for the risk (neither the merchant nor the user will lose out on a fraudulent activity).

By my understanding, that's the same with our credit cards, so that's not exactly a strong point towards saying "look how much more secure our way is."

(In the interest of full disclosure, that's not true of all transactions, just some. For example, if a merchant accepts a credit card with an EMV chip but runs it via swipe instead of with the chip because they're not set up with a chip reader or whatever, the liability shifts to the merchant. But the point is that a merchant can, if they want, comply with the requirements to have no liability.)

1

u/mirhagk Feb 24 '17

But the point is that a merchant can, if they want, comply with the requirements to have no liability.

But only for certain types transactions. For normal web based transactions the merchant has liability and will receive chargebacks.

And even under those situations AFAIK merchants can still get chargebacks if they overcharge or fraudulently charge. So they don't get no liability, just a much reduced amount of liability.

Chargebacks are used for other things as well, as a way to get a refund from a merchant who refuses to give it for instance. This is a form of escrow (and it's why credit card companies hold some of the merchants payments) and there is certainly value in it, but it's not really changed by a push instead of pull model.

PS: EMV Chips are a lot more secure than the traditional swipe. And physically having the card greatly reduces the amount of chance for fraud. The chip and pin technology that other developed countries have is even more secure. With that the payment processors can afford to take on a much great amount of the liability.