Slashdot Mirror

• Amex (varies by card)
• Capital One

While a bit old, it's still valid. Sorry to hear about your luck, I've been bitten by return periods (with brakes) but I ended up reselling them on my own. As far as computer components, I prefer to buy those from a walk-in retailer like Microcenter. They're right down the street from me and I prefer being able to do returns same day if there is an issue. Anyway, sorry to hear about your misfortune, that'd piss me off, happy holidays!

photobucket.com wikipedia.org sitepoint.com archive.org https://www.capitalone.com/

$ for i in {1..2000}; do curl https://www.capitalone.com/ 2>/dev/null | grep "as low as" -m 1 | cut -d ">" -f 3 | cut -d "%" -f 1; done | sort | uniq -c
        420 2.30
        499 2.70
        428 3.10
        653 3.50

So for 2000 samples (with the default curl user-agent) we get
2.3% (~21%)
2.7% (~25%)
3.1% (~21%)
3.5% (~33%)

Now let's try it again with a firefox for windows user agent.

$ for i in {1..2000}; do curl https://www.capitalone.com/ --user-agent 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11' 2>/dev/null | grep "as low as" -m 1 | cut -d ">" -f 3 | cut -d "%" -f 1; done | sort | uniq -c
        395 2.30
        536 2.70
        450 3.10
        619 3.50

So for 2000 samples (with the firefox user agent) we get
2.3% (~20%)
2.7% (~27%)
3.1% (~23%)
3.5% (~31%)

This deviation does not seem statistically meaningful to me, I would conclude that user agent is not relevant, at least not between firefox and curl.

$ for i in {1..2000}; do curl https://www.capitalone.com/ 2>/dev/null | grep "as low as" -m 1 | cut -d ">" -f 3 | cut -d "%" -f 1; done | sort | uniq -c
        420 2.30
        499 2.70
        428 3.10
        653 3.50

So for 2000 samples (with the default curl user-agent) we get
2.3% (~21%)
2.7% (~25%)
3.1% (~21%)
3.5% (~33%)

Now let's try it again with a firefox for windows user agent.

$ for i in {1..2000}; do curl https://www.capitalone.com/ --user-agent 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101012 Firefox/3.6.11' 2>/dev/null | grep "as low as" -m 1 | cut -d ">" -f 3 | cut -d "%" -f 1; done | sort | uniq -c
        395 2.30
        536 2.70
        450 3.10
        619 3.50

So for 2000 samples (with the firefox user agent) we get
2.3% (~20%)
2.7% (~27%)
3.1% (~23%)
3.5% (~31%)

This deviation does not seem statistically meaningful to me, I would conclude that user agent is not relevant, at least not between firefox and curl.

I cleared all cookies from Chrome, Opera, and FF, and went to http://www.capitalone.com/autoloans/

Chrome and Opera both gave me rates of 3.5%.
Firefox gave me 2.7%.

I proxy my FF sessions through a ssh tunnel to a personal Linux server I have, which is located in Michigan. So to see if that had an effect on it, I cleared cookies again and then disabled the proxy settings. Restarted FF and went to the URL again. This time I got a rate of 2.3%.

I went back to Opera and Chrome, deleted cookies and restarted again. Now Opera was 2.3%, and Chrome was 3.1%. Did it again, and Opera was still at 2.3%, and Chrome had dropped to 2.7%. It's as if this site is just coming up with totally random numbers.

I tried viewing the Capital One auto loans page with a program on one of my web sites which fetches and displays pages, refusing all cookies and removing all Flash, JavaScript, etc. The browser string sent is "SiteTruth.com site rating system"; it's not pretending to be a browser. This, of course, is a diagnostic service we run to see pages as our web crawler sees them. The only state information the site receives is the IP address, which is not changing. On successive tries, I received:

• 2.10%
• 3.10%
• 2.30%
• 3.10%
• 3.50% (in smaller type)
• 2.30%

So the rate returned is randomized.

I would question the legality of advertising random numbers as interest rates.

Microsoft is a company that cannot "let go" of anything. Take .NET for example -- it is a miserable failure that they won't let die.

A few web sites that use .NET technology:

Costco - http://www.costco.com/
Crate & Barrel - http://www.crateandbarrel.com/
Home Shopping Network - http://www.hsn.com/
Buy.com - http://www.buy.com/
Dell - http://www.dell.com/
Nasdaq - http://www.nasdaq.com/
Virgin - http://www.virgin.com/
7-Eleven - http://www.7-eleven.com/
Carnival Cruise Lines - http://www.carnival.com/
L'Oreal - http://www.loreal.com/
Remax - http://www.remax.com/
Monster Jobs - http://www.monster.com/
USA Today - http://www.usatoday.com/
ComputerJobs.com - http://computerjobs.com/
Match.com - http://www.match.com/
National Health Services (UK) - http://www.nhs.uk/
CarrerBuilder.com - http://www.careerbuilder.com/
Newegg http://newegg.com/
Geico http://geico.com/
Capital One http://capitalone.com/
Zecco http://zecco.com/

And that is just the tip of the iceberg.

Maybe you should tell all those sites that .NET is a miserable failure? Or if you were just (successfully) karmawhoring, I am sorry to interrupt the circle jerk on here.

I personally run/have run many huge enterprise apps on .NET. It's actually a pretty good platform if you know what you're doing.

Don't take my word for it, though.

When I googled for what you asked to google, I found this list of sites running ASP.NET.

Costco - http://www.costco.com/
Crate & Barrel - http://www.crateandbarrel.com/
Home Shopping Network - http://www.hsn.com/
Buy.com - http://www.buy.com/
Dell - http://www.dell.com/
Nasdaq - http://www.nasdaq.com/
Virgin - http://www.virgin.com/
7-Eleven - http://www.7-eleven.com/
Carnival Cruise Lines - http://www.carnival.com/
L'Oreal - http://www.loreal.com/
The White House - http://www.whitehouse.gov/
Remax - http://www.remax.com/
Monster Jobs - http://www.monster.com/
USA Today - http://www.usatoday.com/
ComputerJobs.com - http://computerjobs.com/
Match.com - http://www.match.com/
National Health Services (UK) - http://www.nhs.uk/
CarrerBuilder.com - http://www.careerbuilder.com/
Newegg http://newegg.com/
Geico http://geico.com/
Capital One http://capitalone.com/
Zecco http://zecco.com/

Maybe you should tell those sites that .NET is a unproven technology? Or will you try to argue that these are not huge enterprise apps? Just because you want something to be true(or maybe you were just karma whoring) doesn't make it true. C# is a better language than Java, though each one has it's strengths. And even conceding your point(I don't) that Java is faster, speed is not everything. Or we would all be coding in assembly or machine code.

This is why I train new users to look for the domain name at the bottom right of the status bar next to the lock in Firefox, because it's too hard to explain to a beginner how to parse an https URL and the browser takes care of all the tricks in extracting the domain name that you're connecting to.

Well, it's good to worry any time there is a mismatch. It can be easy to fake legitimate looking URL's using UNICODE characters and such.

Consider something that looks like like:
https://onlinebanking.capitalone.com/login/.tsdk.cn?login

The whole first part could be the host name: "onlinebanking.capitalone.com/login/" and the domain is actually "tsdk.cn". This would be using the UNICODE symbol for mathematical division that looks like a forward slash. It looks like a capitalone.com domain even though you're going through some scammer site. Marlinspike talked about this exact attack at Blackhat 09.

Consider something that looks like like:
https://onlinebanking.capitalone.com/login/.tsdk.cn?login

The whole first part could be the host name: "onlinebanking.capitalone.com/login/" and the domain is actually "tsdk.cn". This would be using the UNICODE symbol for mathematical division that looks like a forward slash

Which is why everyone should only use english with 7-bit ascii on the internets. Security is much better for everyone!

Something strange is going on here. Capital One's main site returns a certificate for the correct domain, but the certificate is invalid. This isn't a wrong-domain issue; the cert is bad. CN="www.capitalone.com", the dates are valid, the issuer is Verisign, but it won't validate in Firefox. Our own system, SiteTruth, which uses OpenSSL, also indicates it's no good. But neither Firefox nor OpenSSL is producing a useful error message. It looks like this certificate is either corrupted or bogus.

The location ("L") in the cert is Glen Allen, VA. Capital One has a facility in Glen Allen, according to Google, and it looks like a huge warehouse. So that's probably their data center, at 4871 Cox Rd, Glen Allen, VA - (804) 270-4104.

A traceroute ends at "capitalone-gw.customer.alter.net", which doesn't mean much one way or the other.

Their stock has dropped from 55 to 12 since September 2008. If you have any money in there above the FDIC insurance limits, get it out now..

The thing you should consider is whether your stock increases are out pacing inflation. If you have neither lost nor made anything in 10 years, your money that you invested has less value now. However, if you put that money in a high-yield savings account with no earning cap, chances are that the money will be worth more now than when you initially invested. For example, if you purchased $10,000 (US) in stock ten years ago, it would have to be worth $13,422.27 today to pace inflation according to http://www.bls.gov/data/inflation_calculator.htm. The savings account calculator at http://www.capitalone.com/directbanking/online-savings-account/calculator.php shows that, over 10 years (at today's APR of 3.55%) you would have approximately $14,169 in 10 years. You can imagine how that scales over the next 40 years. I say cash out your stocks now and put your money in a savings account if you want a sure thing.

• All-online access
• Electronic transfers to/from any checking account at any bank
• 5% interest rate
• Accounts are FDIC Insured up to $100k

How are we supposed to tell the difference between a legitimate email from a company and a phishing attempt when places like CapitalOne use skeezy companies like bfi0.com for sending email to their customers? A link that says "Click here to access your statement" that actually goes to http://capitalone.bfi0.com/T8RT044ABB6D98DEB357FB2 EDD4A80 makes me feel safe inside.

See, but a bank's web site could run on PHP

Very true

http://capitalone.com/indexn.php

And if you were to tell him that Capital One also uses PHP, he'd say they were exercising poor judgement as well.

It's exactly like religion or politics. You believe what you want to believe regardless of fact.

I wonder if he holds the same bias against, say, Python.

Unfortunately that only changes the HTTP USERAGENT reply that Mozilla sends. Some companies like Capital One use JavaScript to obtain the browser version, which Mozilla doesn't (yet?) allow you to spoof easily.

How does the Slashdot crowd find their banking support?

I find it very frustrating trying to do my online banking. In fact the only reason I keep a link to IE on my desktop is because my banks don't support Mozilla!. Of the two financial institutions I regularly attempt to work with online, zero of them allow me to use Mozilla. They are:

• Boeing Employees' Credit Union
• Capital One

Now, BECU is scheduled to have a brand new site out sometime in November. I can only hope that they decide to support my browser.

It's just frustrating!

• First Union
  
• Capital One
  

I have only had one problem. The Capital One site works, but if you try to login with Mozilla 1.0, you get a 'non-compatible browser' page that they created. Now, our company does the same thing, but only if your encryption is below 128 bit.

I fired off a friendly email to them suggesting that maybe they should update the HTTP_USER_AGENT they check, and their response was basically a friendly 'nuts to you, we will fix it later if we feel like it' message.

Oh well...I tried....

you accidentally hit the shift key when you pressed 1

Grandparent was probably trying to type a Capital 1. Or was that "cap it alone"?