Slashdot Mirror

If you exchange your Visa for a MasterCard, you won't really be boycotting Visa:

Visa and Mastercard are really two names for the same economic enterprise, i.e. a group of 6000 banks. Of these, the same 50 or so big banks own, govern and make all of the competitive decisions for the brands called Visa and Mastercard.
From PBS

Visa and MasterCard are being sued by American Express and the DOJ for antitrust and by a a group of retailers for antitrust related to debit cards.

Some other random notes re one of my favorite pet peeves - thanx to the poster for bringing this up :)

• It's been many years since I've received the hard sell for car rental CDW, et al; I'm either lucky, or the sales droids have figured out that AmEx automatically covers CDW. The last time I rented, the sales "agent" did try to sell me the fillup service, $4.99 per gallon to spare me the gross inconvenience of filling up down the street from the airport. Assuming I brought it back empty, that tank of gas would have cost more than the rental itself.
• I came by the aforementioned car in an interesting way. Needed to book a weekend trip DTW --> BWI on two days notice. Best nonstop round-trip coach fare for two people: $1900 thru CheapTickets. Same website, same airline, same flights, plus a car: $560 (of which $90-odd was assorted surcharges). With fare structures like this, how the fsck can the airlines even know whether they make/lose money!?
  (Btw, lesson learned from this trip: don't book flights less than two weeks in advance unless you enjoy being "randomly" searched, repeatedly.)
• Dish Network's first lame attempt at a PVR carried a $10/month charge to use the PVR features. No added features beyond what was built into the box; you paid the $10 solely for the privilege of using the hardware you'd just laid out $600 for. Dish sold maybe a half-dozen of these, unsurprisingly, and the newer/better (and Linux-based!) PVR boxen carry no surcharge.
• Cruises & vacation package ads: Decent price prominently displayed, and beside it in 3-point type: "+ $80", or similar 75% markup. You can't not pay the markup; imho obscuring the actual price this way is damn near fraud.
• ATM fees, and bank surcharges in general: Don't get me going on these.
• Don't know if people outside metro Detroit see these: Car commercials featuring buy/lease prices unattainable by mere mortals. "We'll lease you a brand new fully-equipped (mumble)(mumble) for only $199/month with zero down. . .IF you're already leasing a car from us, AND you're an employee of the manufacturer, AND you won't be moving out of the area anytime soon (seriously), AND you have better credit than God. IOW, the CEO of GeneralDaimlerFord gets this price; you don't. Not so very long ago, TV ads gave the average price quoted by metro area dealers for all sales. Did the law change while I wasn't looking?

DDB (who should be modded up for working Linux into an otherwise-irrelevant topic. :) )

Some other random notes re one of my favorite pet peeves - thanx to the poster for bringing this up :)

• It's been many years since I've received the hard sell for car rental CDW, et al; I'm either lucky, or the sales droids have figured out that AmEx automatically covers CDW. The last time I rented, the sales "agent" did try to sell me the fillup service, $4.99 per gallon to spare me the gross inconvenience of filling up down the street from the airport. Assuming I brought it back empty, that tank of gas would have cost more than the rental itself.
• I came by the aforementioned car in an interesting way. Needed to book a weekend trip DTW --> BWI on two days notice. Best nonstop round-trip coach fare for two people: $1900 thru CheapTickets. Same website, same airline, same flights, plus a car: $560 (of which $90-odd was assorted surcharges). With fare structures like this, how the fsck can the airlines even know whether they make/lose money!?
  (Btw, lesson learned from this trip: don't book flights less than two weeks in advance unless you enjoy being "randomly" searched, repeatedly.)
• Dish Network's first lame attempt at a PVR carried a $10/month charge to use the PVR features. No added features beyond what was built into the box; you paid the $10 solely for the privilege of using the hardware you'd just laid out $600 for. Dish sold maybe a half-dozen of these, unsurprisingly, and the newer/better (and Linux-based!) PVR boxen carry no surcharge.
• Cruises & vacation package ads: Decent price prominently displayed, and beside it in 3-point type: "+ $80", or similar 75% markup. You can't not pay the markup; imho obscuring the actual price this way is damn near fraud.
• ATM fees, and bank surcharges in general: Don't get me going on these.
• Don't know if people outside metro Detroit see these: Car commercials featuring buy/lease prices unattainable by mere mortals. "We'll lease you a brand new fully-equipped (mumble)(mumble) for only $199/month with zero down. . .IF you're already leasing a car from us, AND you're an employee of the manufacturer, AND you won't be moving out of the area anytime soon (seriously), AND you have better credit than God. IOW, the CEO of GeneralDaimlerFord gets this price; you don't. Not so very long ago, TV ads gave the average price quoted by metro area dealers for all sales. Did the law change while I wasn't looking?

DDB (who should be modded up for working Linux into an otherwise-irrelevant topic. :) )

AmDrEx points to Discover Card.

tswinzig says that American Express works fine.

spaceling points out that you could get an AT&T Universal Card.

inepom01 recommends Chase Manhattan.

An Anonymous Coward says that he uses Providian.

Several folks have also pointed out online banks that they use:

• jimmu: Key Bank
• Anonymous Coward: Washington Trust
• Descartes: 1st Financial Bank
• Anonymous Coward: Fleet Boston
• Anonymous Coward: Bank of America
• mcelrath: UmbrellaBank

Go online, log on, generate a one-time use number, plug that into the web site, only good for one transaction.

So sure, you can like the other folks have already mentioned, use pricewatch, pricegrabber, even mysimon to find good prices on QUALITY components. But don't buy cheapie stuff--the best part of building your own system is that you can use quality parts and get it done for the same price as a system manufacturer might with cheap stuff!

But then you go to a store with a good reputation, such as Dell, NewEgg, Buy.com, etc. to buy all the stuff at a higher price. The best part is when you whip out the Amex Gold card to pay for it. Then you call American Express up and tell them that you found all these items for cheaper at other websites (referencing your searches above). They kindly cut you a check for the difference.

This way, you get the best price and the best service. Ahh how wonderful.

Details on doing Amex pricematching are here which is a link on www.xpbargains.com. XPBargains is a very cool site by the way.

it's called "Private Payments". Only for US people, though.

Until you get an am-ex black card, it don't mean a thing. The black card (Centurian Card is American Express' highest card you have to be invited, and there is no credit limit, they will find anything for you, you get free first class upgrades, room upgrades, and European cells phones when you travel to Europe.
The catch one of several qualifiers is to spend more than $150,000 per year on their current american express cards.

The credit card paradigm is whats causing the problem, not securing the cc numbers!

No matter what you do, or how you do it, there is always the potential for loosing the information...either by theft, fire, fraud, etc.

The only sensible way to "charge" things are, IMHO, by changing the way credit cards work.

Before anyone mods this as off topic, consider aquiring the ability to accept a credit card that does one time transaction numbers and when you enter into a selling relationship with a customer who does not utilize this kind of credit card ... suggest it!!!

This not only ensures your customer that you care about the security of thier transactions it also serves as an opporitunity to explain that there is always a chance, even if it's a remote one, that thier current credit card numbers can be comprimised.

I do not know the answer to your original question. I personally think using the above suggestions with the system you currently are working to secure would be an option to consider.

Even if the customer does not want, or can not get a credit card that utilizes "one time transaction numbers" the fact you take the time to explain it to them should be a little reassuring to them..I know it would for me!

Here are a few more links to info on one time cc numbers:

American Express offers disposable credit card numbers for online shopping
Frequently asked questions about American Express Private Payments System
The O-Card

You can purchase pre-paid american express cards at 7-11 with cash. You can add more money to them also. I think this is what he was talking about, not visa buxx, which is just a credit card for kids where the parent gets to limit its use.

Here's some more info: http://home3.americanexpress.com/corp/latestnews/7 -11.asp

addendum: I checked another link (http://www.7-eleven.com/internetcard/) and it looks like these are no longer available... so nevermind.

I mean first here was silver, then gold, then platinum.....I think they are going to create a new element/metal pretty soon!

The next card up from Platinum is Black from American Express. Available by invitation only to existing Platinum cardholders (which themselves are only available by invitation from Green or Gold).

Someday...

American Express was the first to do this I think. They have an option called private payments where you go to their site and get a number for one time use.

However, AmEx has the best dang credit card feature available: Private Payments, which is basically a generate-as-you-need one time use credit card number. It bills back to your card account, but the number can't be reused, and the expiration date is the current month. No worries about stolen cards at e-commerce sites with questionable security or shifty practices.

As far as I can tell, these "smart cards" do nothing at all.

Sure they do, they make a bunch of unwashed Windows users think they're 31337 because they have a credit card with a computer chip in it.

That's right, just Windows users. Oh you thought Macs and Linux might be supported? Fat chance! AmEx Blue has been promising Mac support Real Soon Now since their card debuted two years ago, but now they don't even mention it on their system requirements page anymore. The promised Mac support was one of the reasons I got the Blue card, along with the 'added security'-- but their security is a joke in general. There was significant fraud perpetrated with my account number before I even got the card, and it did not involve identity fraud or interception of my postal mail.

VISA's smart cards also offer bupkis in the way of non-Windows support.

~Philly

It's nice to see some card companies finally moving towards smart cards in the hope that one day we may not need to carry cash.

The two major offerings are currently Visa's smart Visa and American Express's Blue. At this stage, it seems that MasterCard does not have a combined smart card/credit card.

There have also been various smart card only cards including MasterCard's Mondex and Visa's Visa Cash, but neither of these seems to have gained wide acceptance, despite being backed (however weakly) by the major credit card companies. Let's hope these new combined cards don't suffer the same fate.

You can do something like this if you have an American Express card.

American Express has a service called Private Payments (there is a FAQ here). With this service, you can get a special credit card number with a very limited lifespan (number will expire after 30-67 days). You can get as many special credit card numbers as you like; it's free to anyone with an American Express card.

And, check it out--if you get a Blue card, which has a Smart Card chip onboard, you can get a reader that will let you use the Blue card as a security token! I need to think about that one... Anyway, a serial port reader is free and a USB reader is $25. And Compaq makes a keyboard with a reader built-in, probably intended for use in a POS setup.

steveha

You can do something like this if you have an American Express card.

American Express has a service called Private Payments (there is a FAQ here). With this service, you can get a special credit card number with a very limited lifespan (number will expire after 30-67 days). You can get as many special credit card numbers as you like; it's free to anyone with an American Express card.

And, check it out--if you get a Blue card, which has a Smart Card chip onboard, you can get a reader that will let you use the Blue card as a security token! I need to think about that one... Anyway, a serial port reader is free and a USB reader is $25. And Compaq makes a keyboard with a reader built-in, probably intended for use in a POS setup.

steveha

You can do something like this if you have an American Express card.

American Express has a service called Private Payments (there is a FAQ here). With this service, you can get a special credit card number with a very limited lifespan (number will expire after 30-67 days). You can get as many special credit card numbers as you like; it's free to anyone with an American Express card.

And, check it out--if you get a Blue card, which has a Smart Card chip onboard, you can get a reader that will let you use the Blue card as a security token! I need to think about that one... Anyway, a serial port reader is free and a USB reader is $25. And Compaq makes a keyboard with a reader built-in, probably intended for use in a POS setup.

steveha

You can do something like this if you have an American Express card.

American Express has a service called Private Payments (there is a FAQ here). With this service, you can get a special credit card number with a very limited lifespan (number will expire after 30-67 days). You can get as many special credit card numbers as you like; it's free to anyone with an American Express card.

And, check it out--if you get a Blue card, which has a Smart Card chip onboard, you can get a reader that will let you use the Blue card as a security token! I need to think about that one... Anyway, a serial port reader is free and a USB reader is $25. And Compaq makes a keyboard with a reader built-in, probably intended for use in a POS setup.

steveha

American Express offfers disposable card numbers to all card holders (as far as i can tell).

By simply signing in and selecting a card (for those of you with more than one :-) a normal looking card number will be generated along with an expiration date in a small window that pops up.

It's very cool, plus since it relies on Java/Javascript, so nearly all of us can use it (no doofy Window plugin req'd!)

What's stupid is the Discover Card method. They have a "disposable card number" feature, but it requires a really heinous install procedure, plus it does annoying things like create a bookmark for their site in every browser user's bookmarks file (thanks guys!). But wait, theres more! If you want to use this feature, you have to shop within a small number of stores (and i mean small, like ~50 the last time i checked).

Bottom line, disposable credit card technology is great - i've used these disposable numbers for over 6 months, and i'm totally sold on the idea. Now when i purchase something on the web, my Amex number can only be used that one time, after which it is completely invalid for charges. I'll be glad to see all Visa and MC companies follow this someday.

Seen the amihotornot All Your Base site yet?

I have the blue card from amex (the one with the microchip) and use this payment numbers. I insert my card in its reader, enter my pin to authenticate and generate a card number. I have now used it for quite a few online purchases without problems. Personally I think it is one of the best things they have done.

Of course, I can also generate the random numbers by login into their site using my username and pw but hopefully they will add a restriction so i can limit login to my smart card.

Also, I just took a survey they sent out to gather feedback. In it they asked what of the additional features listed you found most interesting. They included several listed in the article, including generating a long term number you could put on file with someone like Amazon but if was stolen could not be used by someone else (only accepted charges from Amazon) and putting limits on generated numbers (ie. you can know a site cannot overcharge you, you can give the number to a child without worrying etc.) once they have these I will be using Amex for all my online purchases.

Now I am just waiting for them to get rid of the number on the card itself so I can use it in a store without worrying. There is no reason at all to have a fixed number.

This, in turn, will save them billions in fraud that they do not recover (so long as the merchant follow the authorization procedure today they are not responsible for fraud charges). We can only hope that they will pass this saving on to us.

The number of newly registered privacy-related trademarks and patents has risen dramatically in the past few years; they include everything from banking services and computer technologies to window treatments and even an independent software agent ("for protecting consumers' privacy") called Privacy Just Got Cool. Anonymous Web-browsing and e-mailing services are available from companies called Anonymizer, Hushmail, IDcide, PrivacyX, and ZipLip. An outfit called Disappearing has developed an e-mail system that allows users to send messages that permanently unwrite themselves after a previously specified amount of time. Sales of personal paper shredders are up. Personal bodyguards are increasingly in demand. American Express has just unveiled a system called Private Payments, which generates a random, unique card number for each online purchase. A California law firm now offers to prepare something it calls The Privacy Trust, which, it claims, "successfully conceals ownership of bank and brokerage accounts, the family home, rental properties, and interests in other entities." Money may soon begin to be "minted" solely in electronic form, creating "digital cash" that could make credit cards (and the data gathering they make possible) obsolete. There is serious talk of building privacy protection into the infrastructure of the Internet, and of using such protection, paradoxically, to make the flow of information freer than ever before.

And the snippet I gave above is only the smallest fraction of the content of the article. It isn't even a primary point. It is just a part of the introduction.

I'm going to have to bookmark this mag, just because it helps excercise my brain cell.

;-)

This incident underscores the usefulness of one-time credit card numbers, such as those provided by American Express' Private Payments service. This service allows the cardholder to generate an account number for each transaction. So if that number is stolen from a merchant's database later, it's useless. This also comes in handy for preventing unauthorized billings from the same merchant later on.

American Express offers "Private Payments" free with all(?) their credit cards. If you log into their website (using SSL) you can get a unique credit card number that is linked to your card account. The unique number is only valid for one transaction and if not used, expires after 30 days. You can use these numbers for online transactions or anywhere that accepts numbers over the phone. It's not recommended for things such as recurring payments, obviously.

If someone has already gained access to your computer, and they can read the web page (and hence the new number) that gets displayed, you're still out of luck. But if nothing else, this seems to be a step in the right direction. Does anyone think that this is pointless?

Actually, if companies weren't so careless about how they handle on-line transactions (like storing credit card numbers on a webserver with a domain name like CreditCards.com) we wouldn't need Private Payments either.

I'm not affiliated with American Express, I just thought it was a good idea

The one commentator said "If someone steals your credit card, you get a new one. What do you do if someone steals your thumbprint? Get a new thumb?"

That's the gist of it. Once my signature is digitized, it can be reproduced and sent along with anything.

The only way I can see this working is if it is some sort of secret that is known only to me, and it is revocable. I somehow doubt that that digitizing tablet and thumbprint reader on TV was using the data to unlock an internal secret key and using THAT to sign the data. No, I'm sure it was just digitizing the actual sig or print and sending THAT along.

I also get very nervous signing credit card slips using digitizing tablets at stores now, even though I'm fairly sure it doesn't record stroke and weight. All you need to do is sign once some tablet that DOES do that, and then anyone can print out perfect stroke and weight sigs using a plotter and a pen. (In these cases, I alter my sig by signing the name of the store across my sig on the table...)

I'd be more comfortable with a smart-card idea like the America Express Blue Card than what I've seen so far. At least it's something only issued to you and it can be revoked.

Yeah, things like PGP signatures could be used to do this, but I can't imagine the average person managing that correctly. I could easily, for example, go to someone's office at work and ask them to type in their PGP sig so I can debug their computer, then go back to my office and scarf their private key file. But I would have far less success going into their office and asking to borrow their smart-card for a while..

Press release type details from AmEx
http://home3.americanexpress.com/corp/latestnews/p ayments.asp

A search for SMARTDATA found it in an unlikely place.

Maybe we really will be able to buy stuff with this card :-)

I love the panic that comes from credit card number theft in an on-line context. To the worrisome masses that own and use credit cards but don't use them to purchase stuff online:

Have you ever used your card to pay for a meal at a restaurant and the server walks away with your card and comes back a couple minutes later? It is the same risk, you don't know if you card number is being copied down by someone whilst out of your possession.

Any decent credit card company offers protection against fraud anyway - some specific to online transactions like Amer ican Express for example. I'm an AMEX card owner have unfortunately taken advantage of this benefit in the past and they took care of EVERYTHING.

Perhaps I'm oversimplifying the situation, but I see it no different than in the off-line world of financial transactions - no more less risky. Buy freaking gold bullion of you can't handle it.

As for the Spamazon thing; consider:

• There is some art to choosing passwords. Choosing badly is a bad idea.

  Happily, these days there are tools that are reasonably good at storing things you can't possibly remember. I pick formally random passwords, and cut/paste between a semi-secure application and the web browser.

• The extent of the exposure to exploit at Spamazon is somewhat limited.
  • If you make interesting changes, such as to address, you are required to enter the credit card number.
  • They don't report back the credit card number.
  • They tend to send you email messages concerning impending orders.

  This all adds up to there being pretty limited room for dramatic, not-readily-cancelled, harvestable credit exploits.

For more secure, take a look at American Express' Blue, which requires that for online sales, you have the credit card handy, and actually have it interact with one's PC. Win32-only, at this point...

Ok, so I forgot to read one line of the previous post. :) Here's some info on Amex's "Wallet"

Is this sort of like what American Express has done with "Blue?"

about the chip-reader
about the "wallet"

Just to save people some time hunting...

about the chip-reader
about the "wallet"

Just to save people some time hunting...

avaiable here from American Express web site. Not much, some pretty pictures, some "offers", etc, but it's the "official" home.

(Not directly linked from the original news article - irritating)

http://home4.americanexpress.com/b lue/splash.asp

Nothing unfortunately in the way of technical information to speak of.

--
This isn't the post you're looking for. Move along.

IPIX North American Sales
1-800-336-7113
sales@ipix.com

IPIX Stockhouse Manager, Jeff Puckett
1-888-909-IPIX
stock@ipix.com

IPIX CLIENTS
Suprisingly.. blank

Maybe you'd like to talk to their investors?

Motorola
Mediaone
Advance Internet
American Express
Financial Advisors
Cendant
General Electric
Invision
JP Morgan

--

IPIX North American Sales
1-800-336-7113
sales@ipix.com

IPIX Stockhouse Manager, Jeff Puckett
1-888-909-IPIX
stock@ipix.com

IPIX CLIENTS
Suprisingly.. blank

Maybe you'd like to talk to their investors?

Motorola
Mediaone
Advance Internet
American Express
Financial Advisors
Cendant
General Electric
Invision
JP Morgan

--