Searching For Trouble With Google

Nothing wrong with this... by Cytlid · 2004-09-01 00:13 · Score: 2, Funny

...it's called natural selection. Survival of the fittest... if people are that dumb to put stuff on the internet, so be it.

--
FLR

Re:Nothing wrong with this... by stromthurman · 2004-09-01 00:16 · Score: 5, Informative

This may be seen as a nitpick, but it's actually an important point. It's survival of the "fit", not fittest. Evolution is about being *good enough*, not the best.

--
I have discovered a truly remarkable sig which this margin is too small to contain.
Re:Nothing wrong with this... by psyklopz · 2004-09-01 00:19 · Score: 5, Insightful

It often has very little to do with *you*.

It quickly becomes your problem if you have done business with someone else and *they* are stupid enough to leave stuff in plain view.

It would be nice if we knew that everyone we did business with was intelligent enough not to do this, but realistically we probably can't
Re:Nothing wrong with this... by Scoria · 2004-09-01 00:25 · Score: 2, Insightful

I realize that this was intended to be a joke; however, it is likely that many of these credit card numbers were derived from a malicious application. Although one might argue that anybody inexperienced enough to execute a malicious application is also "deserving," I have often observed that those individuals are -- perhaps ironically -- averse to conducting electronic transactions.

--
Do you like German cars?
Re:Nothing wrong with this... by xQx · 2004-09-01 00:26 · Score: 1

Actually Darwin called it "Survival of the best fit", not the fittest.
Re:Nothing wrong with this... by nial-in-a-box · 2004-09-01 00:28 · Score: 4, Interesting

Yea except these are the idiots that will also sue Google and try to take them down because of their own mistakes. If you're in some sort of struggle with an idiot, you'll be ok, but may God help you if that idiot has a halfway decent lawyer.

--
I am feeling fat and sassy
Re:Nothing wrong with this... by HeghmoH · 2004-09-01 00:31 · Score: 5, Insightful

It would be nice if we could switch away from totally unverified financial transactions like the current credit card systems, and start using something that at least requires a PIN. That way, instead of having to trust every single company with which I do business, I only have to trust my bank.

--
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
Re:Nothing wrong with this... by itsme · 2004-09-01 00:32 · Score: 2, Informative

none of the links found are from people who purposely put it online them selves, all you find are irclogs/hacker boards, where people exchange stolen card numbers.
Re:Nothing wrong with this... by pjt33 · 2004-09-01 00:33 · Score: 1

This is why I don't use my credit card on the Web. I'd rather be paranoid and have to buy everything in shops than try persuading my credit card company that I didn't make those purchases totalling whatever my current credit limit is.
Re:Nothing wrong with this... by WIAKywbfatw · 2004-09-01 00:33 · Score: 4, Interesting

I'll second that. A little over a month ago, a letter was sent to me but went missing in the post. That letter contained my full name, address and National Insurance number (similar to a US Social Security number).

That lost letter contains more information than I'd give out to anyone who's not an authorised government official (policeman, doctor, etc). Through no fault of my own, and despite my vigilance (I shred and burn every bit of correspondence that has my name and address on it, let alone financial or other personal details) that information is now potentially in the hands of someone unscrupulous.

If anything untoward were to happen, I have virtually no recourse, as it would be nigh on impossible to actually prove where my details were obtained and (as far as I know) it's impossible to get a new NI number: I'm stuck with the one that's issued to me at 16 until the day I die.

--

"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Re:Nothing wrong with this... by Raven42rac · 2004-09-01 00:36 · Score: 1

The fact is that people didn't put that there, it is merchants or others putting other people's information out there in the open. And mods/admins, how responsible is it to post specific numbers like that that easily lead to links of names and addresses. I certainly would not want my personal information out there like that. That is very wreckless, never something I thought I would see from such smart people.

--
I hate sigs.
Re:Nothing wrong with this... by chrish · 2004-09-01 00:37 · Score: 5, Funny

c.f. Microsoft's success in computer software.

--
- chrish
Re:Nothing wrong with this... by lachlan76 · 2004-09-01 00:37 · Score: 2, Insightful

I've accidently put my IM logs on the internet. Sometimes it can be easy enough to make a mistake (ie. deny,allow rather than allow,deny). A shitload of private stuff got out to everyone I know (I'm 14, so I have to be with these people a lot of the time), and now I use GnuPG with a 4096-bit key, and digest authentication.

You don't have to be dumb to make mistakes like this, a single typo can do it. Being dumb just helps.
Re:Nothing wrong with this... by Short+Circuit · 2004-09-01 00:44 · Score: 1

You mean like my debit card? It uses's Mastercard's infrastructure, and asks for a PIN.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:Nothing wrong with this... by Yorrike · 2004-09-01 00:46 · Score: 4, Insightful

Ask your bank for a second Credit Card with a few hundred dollar limit. Use that to buy stuff online, and if someone steals it, it won't cost you that much.

--
Looks can be deceiving. Or CAN they?
Re:Nothing wrong with this... by Short+Circuit · 2004-09-01 00:47 · Score: 1

That's a risk Google takes by being a search engine.

Actually, that's a risk any business takes when they get as much attention as Google does.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:Nothing wrong with this... by theLOUDroom · 2004-09-01 00:51 · Score: 1

It often has very little to do with *you*. It quickly becomes your problem if you have done business with someone else and *they* are stupid enough to leave stuff in plain view. It would be nice if we knew that everyone we did business with was intelligent enough not to do this, but realistically we probably can't

This is why the credit card system should be scrapped ASAP.

The technology exists to do MUCH better. Imageine not having to trust a pizza place with access to your credit card fot the next N years! Imagine not having to worry what they do with their records.
Sounds sensible doesn't it?

--
Life is too short to proofread.
Re:Nothing wrong with this... by $raim_n_reezn! · 2004-09-01 00:58 · Score: 2, Informative

They already did. http://www.omaha.bbb.org/news_phonyorders.html

--
All straight things must come to a bend
Re:Nothing wrong with this... by ePhil_One · 2004-09-01 00:59 · Score: 3, Insightful

It would be nice if we could switch away from totally unverified financial transactions like the current credit card systems, and start using something that at least requires a PIN. That way, instead of having to trust every single company with which I do business, I only have to trust my bank.
And then you give the PIN to the business to complete the transaction and now they have that. Exactly how does this improve security when you transact business with a company? It might improve security if someone were to steal your wallet, but without some complicated and difficult to verify one time hash scheme. Which has been done and tried (Amex gave me a smart card reader, Visa has tried 1-time CC numbers picked up their site.

--
You are in a maze of twisted little posts, all alike.
Re:Nothing wrong with this... by SarahAnnAlien · 2004-09-01 01:02 · Score: 1

One of my ISP's has their server a bit misconfigured, which I discovered when, by chance, I came across my .bash_history on a Google search! I don't use that particular account often, and there was nothing in the history that would compromise security, thank goodness. But I'm going to cancel the account anyway.
So, yes, your information can be exposed when someone else goofs up. How often do you check whether the contents of your home directory have found their way onto Google?
As far as why this happened, it may be related to the fact that the small ISP has been sold about three different times since I opened the account back in the mid-90's.
This ISP was, at some point in the past, also subject to a brute-force search of email addresses, obvious by the look of the spam that started to come in, and in the last couple years, it has gradually become 100% spam. So they weren't watching the SMTP server or the HTTP server, apparently.
Hopefully I'll be able to find a new ISP with more diligent and paranoid sysadmins.
Re:Nothing wrong with this... by the+unbeliever · 2004-09-01 01:04 · Score: 1

Er, no.

Look on the back of the debit card. You'll see the debit systems your bank has authorized to process transactions using your card number and PIN, it has nothing to do with Mastercard's infrastructure, and is all about the debit card system, which has been in place since long before mastercard/visa swipe terminals.
Re:Nothing wrong with this... by Enigma_Man · 2004-09-01 01:04 · Score: 1

First off: "reckless"... Second off, it was in the public domain anyway. Now that many more people know of that info, it's probably not just the "bad guys" that know about it, so those people are better off having that information linked to many people.

-Jesse

--
Nothing says "unprofessional job" like wrinkles in your duct tape.
Re:Nothing wrong with this... by the+unbeliever · 2004-09-01 01:07 · Score: 4, Informative

Most terminals that are sold to merchants that have PIN pads encrypt the pin on the pad, then send it to the bank for authorization, or depending on your card, compare it to the hash written on the mag stripe. The merchant never knows your PIN, unless the clerk has a photographic memory and observes you entering it. Even then, it doesn't do them any good without your card.
Re:Nothing wrong with this... by AnwerB · 2004-09-01 01:07 · Score: 5, Insightful

It would be nice if we could switch away from totally unverified financial transactions like the current credit card systems, and start using something that at least requires a PIN. That way, instead of having to trust every single company with which I do business, I only have to trust my bank.

You do realize that to do business on line, you would still have to give them your pin, right?

It would be up to them if they wanted to store that info or not, but at some point, you will have to enter your pin into a web page.
Re:Nothing wrong with this... by oweneck · 2004-09-01 01:08 · Score: 1

isnt this whats happening in the UK now?
Re:Nothing wrong with this... by Raven42rac · 2004-09-01 01:13 · Score: 1

First off, I realised I misspelled it about 2 seconds after I wrote it, BFD, make that a post script next time.
I didn't say it wasn't public domain, I just said it was not very cool to just willy nilly post people's information.
Why didn't the mods post their own if they are trying to make a point?

--
I hate sigs.
Re:Nothing wrong with this... by extra+the+woos · 2004-09-01 01:14 · Score: 2, Informative

It wont cost you anything (or $50) if someone steals your cc and uses it to buy shit.. your best protection is to keep up to date on your banks site with what you have and haven't boughten, and investigate and report anything you didn't do immediately.. you wont be liable.

--
replacing it with NEW Folger's Crystals! (lets see if they notice the difference)
Re:Nothing wrong with this... by gkelman · 2004-09-01 01:16 · Score: 1

Or just use your normal credit card and if any transactions turn up that you didn't make, you report it, and they're immediately refunded.
The company then sends you a form listing recent transactions and you tick the ones you made and sign the form. You get your money back very easily.
Been there, done that. Not lost a penny.
Re:Nothing wrong with this... by BorgDrone · 2004-09-01 01:17 · Score: 4, Insightful

Evolution is about being *good enough*, not the best.
Agreed, and to further narrow it down, it's being *good enough* at only 1 thing: reproduction.

Unfortunately, this doesn't usually have a lot to do with intelligence.
Re:Nothing wrong with this... by Short+Circuit · 2004-09-01 01:17 · Score: 1

*looks at the back*

Huh...then why would my debit card have Mastercard's symbol on it?

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:Nothing wrong with this... by the+unbeliever · 2004-09-01 01:17 · Score: 2, Interesting

It's also not stored. :P
Re:Nothing wrong with this... by Jetboy01 · 2004-09-01 01:18 · Score: 1

and you get locked out of the account after the 3rd incorrect attempt (on most good accounts)
Re:Nothing wrong with this... by micromoog · 2004-09-01 01:19 · Score: 1

In the U.S. at least, the laws related to credit fraud are all heavily slanted towards the consumer (I know it's a rare case these days, but that's how it currently is). Basically, you just have to say you didn't buy the stuff and the company has to reverse the charges.
Re:Nothing wrong with this... by skaffen42 · 2004-09-01 01:21 · Score: 5, Insightful

You know, I really wish the paranoia about using credit cards on the internet will go away.

Think about this as somebody with some technical background. What is more secure?
1. Giving your credit card to the waiter at Mafia Pizza, who takes it into a back room before he brings it back to you.
2. Providing your credit card number to Amazon.

So here is a better idea. Get one credit card and use it for everything. Watch your statement carefully. Complain loudly if you see any charges you didn't make.

I'd still avoid buying anything from Mr. Mbuthu at Nigeria Exports, but other than that why allow paranoia to keep you from the convenience of the internet? Remember, you are NOT liable for any fraud losses on a credit card other than the first $50. The bank takes risk in return for the fees the merchant pays and because they want you to run up a huge debt and pay them loads of interest.

--
People couldn't type. We realized: Death would eventually take care of this.
Re:Nothing wrong with this... by Colonel+Cholling · 2004-09-01 01:21 · Score: 1

Actually, it is "survival of the fittest," and the phrase was originated by Herbert Spencer, not Charles Darwin.

--

I am Sartre of the Borg. Existence is futile.
Re:Nothing wrong with this... by Short+Circuit · 2004-09-01 01:21 · Score: 1

That makes a lot of sense, except for one thing I'm not clear one. How do two subspecies of, say, horses, become incompatible to breed? When does "being the fittest" mean "being incompatible with other breeds?"

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:Nothing wrong with this... by Shimbo · 2004-09-01 01:23 · Score: 4, Informative

isnt this whats happening in the UK now?

No, what is happening in the UK today is that the cards are being upgraded to smart cards, and the PIN is replacing the signature which is frequently not checked well.

Folks by and large understand the "never give away your PIN" rule. Disclosing your PIN to a web site other than your banks would completely subvert this.

It does not address "cardholder not present" fraud.
Re:Nothing wrong with this... by the+unbeliever · 2004-09-01 01:23 · Score: 4, Informative

So you can use it like a credit card, rather than a debit card, at places that don't take debit. (such as most online purchases)

You should also note that Debit transactions will typically show up instantly, and "credit" ones will take 2-3 business days, if you have an online method of checking your statement.
Re:Nothing wrong with this... by hendridm · 2004-09-01 01:24 · Score: 2, Interesting

It would be nice if we could switch away from totally unverified financial transactions like the current credit card systems, and start using something that at least requires a PIN.

Perhaps this is an area where the likes of third-party merchant services such as 2checkout.com, Paysystems, and iBill can really shine. Ignoring the problems these specific merchant services have had, the model of passing the user to a secure page provided by a "trusted" company to enter credit card details could be a good marketing gimmick.

Let's say you're shopping at <insert your favorite pricewatch merchant here>. You're tempted to make a purchase because their price is so much lower that your usualy merchant of choice. Would you prefer to enter transaction details directly on their web site and trust them to store your information in a secure way, or would you prefer a system where you are passed to visa.com or citibank.com to enter the transaction details, which are never given to the merchant, just a check in the mail every 2-4 weeks?

Just like how web sites plug their SSL cert seals with a verification image and link ("Secured with Thawte 128-bit encrypted - click here to verify"), perhaps the site could advertise something like, "For your protection, we do not store your credit card information anywhere on our servers. You will be passed to a secure page at Citibank.com and your transaction details will not be viewable by anyone but you. Click here to verify our partnership with Citibank.com". Okay, that sounds lame, but you get the idea. To me, it's reassuring that my transaction is being handled by a company whose best interest is in avoiding fraud versus passing them to a1discount-computer-parts.biz or whatever to store them as cleartext in their MySQL database...
Re:Nothing wrong with this... by SpaceLifeForm · 2004-09-01 01:25 · Score: 1

It's called cash. HTH. HAND.

--
You are being MICROattacked, from various angles, in a SOFT manner.
Re:Nothing wrong with this... by B3ryllium · 2004-09-01 01:30 · Score: 1

I think horses are a bad example ... As far as I know, they're fairly interbreedable ... I think even with the zebra. I guess a bigger difference would be between deer and horses, or horses and lions.
Re:Nothing wrong with this... by troc · 2004-09-01 01:32 · Score: 3, Funny

That's rather unfair, Mr. Mbuthu, who is a GOD-FEARING person, has asked me to look after $25,000,000 which his poor lamented grandfather's adopted goat left in an account when they were brutally slain in a TERRIBLE UPRISING. The poor guy has been through hell, apparently they won't even let him leave the country - I have wired him some cash but it was not enough for all teh bribes and things, not to mention the administration. He is sending a TRUSTED FRIEND to meet me tomorrow where I will give him my bank details.

Poor guy, life must be terrible in the Nigerian banking insustry.

Troc.

--
Troc's dubious podcast and blog: http://www.trocnet.net
Re:Nothing wrong with this... by HeghmoH · 2004-09-01 01:33 · Score: 2, Insightful

You do realize that to do business on line, you would still have to give them your pin, right?

It would be up to them if they wanted to store that info or not, but at some point, you will have to enter your pin into a web page.

No, I do not realize this. You are not using your imagination.

During the checkout phase, you get a code. You log on to your bank/credit card/whatever account, paste that code into a field to authorize the funds, and get an order confirmation from the place where you bought your stuff.

There are probably a ton of other ways to make this work, too. It is not a requirement that you feed an online business enough information to make purchases using your credit card, that's just how it happens to be set up now.

--
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
Re:Nothing wrong with this... by ricotest · 2004-09-01 01:39 · Score: 1

The closest we have to this are the Verified by Visa and MasterCard SecureCode. I can't be certain, but these may well be verified in the form of pop-ups from Visa/MasterCard's servers so that the business doesn't get that information.

I'm getting an online store off the ground and we redirect to HSBC to collect credit card details via their Secure ePayments service. Customers feel more secure with the HSBC logo and the guarantee that we don't collect any details ourself. If you encounter a similar service (WorldPay, PayPal) where the shop itself doesn't collect details, you can shop safely in the knowledge that the company you're doing business with has no access to your card details.
Re:Nothing wrong with this... by stephanruby · 2004-09-01 01:42 · Score: 2, Interesting

In France, I've seen a system that protects consumers from giving out their real credit/debit card numbers to online merchants. Instead, the consumer would first have to go to his own bank's web site, he would have to enter the amount (or the range of the amount) he was about to charge, and then the bank would generate a unique one-time only credit card number. It was pretty nifty -- the online merchant would have no idea that you were giving him a one-time only credit card number.
One drawback was that this additional service came at an extra service charge of a few dollars per month (can't remember the exact amount). If anyone hears of an American bank doing this, either online or in California, please let me know. I've heard of American banks having a similar service for preauthorizing checks (via fax), but what I saw in France is taking it quite a step further.
Re:Nothing wrong with this... by flibuste · 2004-09-01 01:46 · Score: 1

Well, the good thing in this is that survival used to depend on your physical fitness and muscular strenght.
Being a skinny developer, I can only rely on my knowledge and what lies in the box on top of my neck.

Good to know I can make it in the long run!
Re:Nothing wrong with this... by julesh · 2004-09-01 01:48 · Score: 1

Doesn't help. Many merchants leave it up to 2 days before charging your card, so that they can check they have what you ordered in stock, etc.
Re:Nothing wrong with this... by phoenix_orb · 2004-09-01 01:49 · Score: 1

American Express does this

Too early to look for a link, but I have used it before

--
Blah Blah Blah.
Re:Nothing wrong with this... by nolife · 2004-09-01 01:49 · Score: 1

Whoa.. It is not hard at all to dispute a cc charge.
All you have to do is call the CC company and tell them what charges are bogus. At that point, the charge is placed in a hold status and you can go about your business as usual. It is now up to the merchant that charged you to prove you bought some service from them. I would guess in a true fraud case, you are done at that point as I doubt a real bogus charge could be proven. This is no different for an online or offline purchase.

--
Bad boys rape our young girls but Violet gives willingly.
Re:Nothing wrong with this... by MikeDX · 2004-09-01 01:49 · Score: 2, Informative

We have this in a few uk banks, certainly the one I use called Cahoot webcard which is an online tool, you login into your online banking account, and request a card valid for 1 month with the amount you specify. Ive never had a problem with this and its perfect for online sales and even telephone credit card orders as they cant screw your account over and over for more money.
Re:Nothing wrong with this... by danheskett · 2004-09-01 01:52 · Score: 4, Insightful

I don't even think it needs to be that high tech. How about this:

You bank sends you in the SNAIL MAIL a sheet monthly of longish letters/numbers that represent an authorization to spend money. In fact, each one could be rated for a certain amount of money, say, up to $100 or $250, or something like that. That, in combination with a number on the back of your card (what are they called, CCV2 or something), forms a use-once key for an online purchase. That way you have to have the card present, plus your statement of authorization codes, to purchase goods online. The e-tailer never needs to know your card number, and the codes are only good for a single use. Even if a cracker got a hold of the site database, the CCV2 code would not be usuable for anything unless the cracker also got a hold of your randomly generated, time-sensitive, preset codes.

Something like this would cost practically nothing to implement, be very easy to maintain (you gotta send bank statements monthly anyways), easy to regulate - for example, pass a regulation saying that these can only be sent through the USPS or private carrier, never electronically or ever given out over the phone), and greatly improve security.

On top of that, it'd be great for people without regular banks or bank accounts. An intrepid consumer could easily sell pre-paid authorisation numbers on little scratch-loto style tickets.

On the processing side all we would need is a strong central party (or number of them), like Visa, Mastercard, or AmEx to recieve valid authorisation numbers from banks and hitch that into the POS and online processing systems.

In fact, even a strong libertarian, it makes me cringe to think how much trust and financial power we place into the hands of Visa, Mastercard, and their ilk. It might make sense at some point to expand the mission of the Federal Reserve or the Treasury to handle the verification and routing of authorisation numbers like I've described.
Re:Nothing wrong with this... by Jimbobbob · 2004-09-01 01:55 · Score: 1

Which is too bad for the people with a PIN of 1111..1113
Re:Nothing wrong with this... by Oddly_Drac · 2004-09-01 01:56 · Score: 3, Informative

"than I'd give out to anyone who's not an authorised government official"

A GP isn't an authorised government official, and you'd be scared if you saw the state of the records routinely passed around in the health service. BTW, the NI number is no longer used as a 'real' form of ID, requiring a better intersection of one or more pieces of ID. Again, it's not proof of your identity despite being asked for on some forms.

"information is now potentially in the hands of someone unscrupulous."

More unscrupulous than the home office? Seriously, you can't escalate an NI number to anything other than paying taxes or finding out that your national insurance contributions are up to date, specifically it's tied to your address, name and earnings. It can be used to claim benefits, but the address would be redflagged if there are tax inputs using it.

"If anything untoward were to happen, I have virtually no recourse"

See above. Generally speaking there isn't a lot that can happen that wouldn't result in someone getting in contact with you.

"it's impossible to get a new NI number:"

It's difficult, not impossible. You have to attend a one-on-one interview and prove who you are, although it's not generally necessary because it's not an important piece of information except for tax records.

--
Oddly Draconis
Too cynical to live, too stubborn to die.
Re:Nothing wrong with this... by Jimbobbob · 2004-09-01 01:59 · Score: 1

I guess I'll correct myself before someone else does. 0000 to 0002.
Re:Nothing wrong with this... by Zerbey · 2004-09-01 02:01 · Score: 1

If anything untoward were to happen, I have virtually no recourse, as it would be nigh on impossible to actually prove where my details were obtained and (as far as I know) it's impossible to get a new NI number: I'm stuck with the one that's issued to me at 16 until the day I die.

No, it's not impossible if your identity has been stolen (but you will have to prove it, of course). It's possible but very inconvenient.
Re:Nothing wrong with this... by DesertJester · 2004-09-01 02:06 · Score: 1

I have been doing that since i started shopping for stuff on-line..back when ebay was still new...i have one credit card for my on-line items and another for every thing else. It works great because I keep the credit limit at $500.00 for the one i use on-line, it keeps me from spending too much and should someone get the card number they wont be able to buy much with it..

--
Everyone has a photographic memory, some just don't have film.
Re:Nothing wrong with this... by pjt33 · 2004-09-01 02:08 · Score: 1

I don't do #1 either. Cash and ATMs are more secure than either #1 or #2 and I don't find them particularly inconvenient since I pass an ATM on the way to work each morning.
Re:Nothing wrong with this... by Luminari · 2004-09-01 02:11 · Score: 1

Yea except these are the idiots that will also sue Google and try to take them down because of their own mistakes. If you're in some sort of struggle with an idiot, you'll be ok, but may God help you if that idiot has a halfway decent lawyer.

Anyone suing Google over this would lose for the same reason you can't sue a rental car company if you left your credit card sitting face up on the dashboard of the car for all to see when you parked it.
Re:Nothing wrong with this... by ePhil_One · 2004-09-01 02:20 · Score: 3, Insightful

Ok, Since the article context was Credit Cards on the web, I was replying in the context of web merchants, who I expect are grabbing all the data via web-forms for prossessing, since embedding forms from another web site should set off all sorts of security alarms.
However, "Even then, it doesn't do them any good without your card" is flat wrong, cards can be forged, magnetic stripes rewritten (Ever see a cashier verify the numbers that got approved are the numbers on the card? They rarely confirm the signature, and I've even used other peoples Photo Visa's).
Also, video cameras can record pin numbers, electronic eavesdropping tricks could "hear" the PIN number, etc. Heck, what guarantee do you have walking into any store that the CC terminal is legitimate, and not a fake designed to capture your CC number and PIN before passing it on to a legitimate machine in the back? Dig around for ATM fraud to see what is actively going on.

--
You are in a maze of twisted little posts, all alike.
Re:Nothing wrong with this... by Xugumad · 2004-09-01 02:23 · Score: 1

Which is why I make a policy of paying by cash are restaurants. Now, I do buy things on the Internet, but I try to research companies before I buy from them. Just Googling for a companies name can frequently tell you a lot, not to mention the customer review sites out there. I also try to avoid companies who store my credit card details between transactions.

Oh, also, I'd suggest having two credit cards, of different types (one Visa, one Mastercard, for example). I've had one refused for random reasons (thier reader won't read it, some part of the network is down, etc.), and having a backup card is reassuring.
Re:Nothing wrong with this... by bryhhh · 2004-09-01 02:31 · Score: 1

During the checkout phase, you get a code. You log on to your bank/credit card/whatever account, paste that code into a field to authorize the funds, and get an order confirmation from the place where you bought your stuff.

You are describing the reverse of this !
Re:Nothing wrong with this... by the+unbeliever · 2004-09-01 02:36 · Score: 1

Only use your credit card at well known, large merchants. Mom & Pop stores still get cash or check from me. =P
Re:Nothing wrong with this... by caveat · 2004-09-01 02:37 · Score: 1

well, at my bank (Fleet), 'credit' transactions show up immediately but are listed as "Pnd Crd Trns"; the Available Balance is adjusted accordingly, then the Actual Balance updates a few days later when the transaction clears. Ditto ATM deposits - I get $100 available immediately and my actual balance updates, then it all falls into line a few days later.

--

Facts do not cease to exist because they are ignored. - Aldous Huxley
Re:Nothing wrong with this... by JaxGator75 · 2004-09-01 02:38 · Score: 1

Yep! Bank of America's online system is awesome. My lunchtime purchases are usually already shown by the time I get back to my desk. It makes keeping and balancing a checkbook almost unnecessary.
Still keep the old mental calculator going to be safe, as sometimes the charges will drop off after initially posting, only to return after a business day. I used to be able to explain why, but I've lost interest...

--
Come and see the violence inherent in the system!
Re:Nothing wrong with this... by feargal · 2004-09-01 02:45 · Score: 3, Informative

"what are they called, CCV2 or something"
For the record, I looked this up when doing a shopping system once.

Visa uses the term Card Verification Value (CVV2), Mastercard calls it Card Verification Code (CVC2). I don't know what the "2" refers to, one assumes there was once a CVV and CVC. Some websites claim the initial "C" in both stands for "Credit Card", but the system is used for debit cards too, so it appears the authors in question were being stupid.

Amex has a Card Identification (CID) which is a four digit number that appears on the front of the card.

It annoys me when I see online forms providing options of Visa, Mastercard, and Amex, and then ask exclusively for the CVV2. Almost as much as the sites that insist I tell them what city I live in, ignoring the 50 odd percent of people who don't live in one.

The term Card Security Code (CSC) is used as a catch-all label, and it's what I use when building shop sites.

--
"A goldfish was his muse, eternally amused"
Re:Nothing wrong with this... by WIAKywbfatw · 2004-09-01 02:51 · Score: 1

The Home Office isn't likely to use my details to commit identity, credit or other types of fraud, which is what I'm concerned about.

As for the possibility of getting a new NI number, well, I've spoken to someone on the NI Helpline in the last 24 hours and he said that getting a new NI number wasn't possible. Frankly, I'm always skeptical when I speak to any hotline operator (no matter what the organisation) because I've learnt from experience that what they say isn't always accurate.

I'd be interested (and grateful) if you could provide me with any further details as to how a replacement number can be obtained, because I'd rather err on the side of caution when it comes to this sort of data.

--

"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
Re:Nothing wrong with this... by Short+Circuit · 2004-09-01 02:52 · Score: 1

I mostly use it as a credit card. Purchases show up the next day when I check the balance on the ATM.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:Nothing wrong with this... by tepples · 2004-09-01 02:56 · Score: 1

Almost as much as the sites that insist I tell them what city I live in, ignoring the 50 odd percent of people who don't live in one.

Unlike with the CVV2/CID/CSC, I don't see any alternative to asking for which city's Post Office delivers your mail.
Re:Nothing wrong with this... by OmniVector · 2004-09-01 02:58 · Score: 1

you know what i've always wanted? one time credit #s. go to [insert credit card company site] and login, then generate a one-time valid credit card number that only works with the company foo.com. why is this too much to ask? it would virtually eliminate the ability to get anything useful from a credit card number besides a receipt.

--
- tristan
Re:Nothing wrong with this... by fugas · 2004-09-01 03:00 · Score: 1

My bank (Citibank Belgium) offers this - and they even do it online. Really nice! https://www.internetnumber.citibank.com/belgium/co nsumer/english/index.htm
Re:Nothing wrong with this... by semafour · 2004-09-01 03:06 · Score: 1

Verified by Visa does just this. I believe other CC companies will be following suit, so within a few years requiring a password for online credit card transactions will probably be common-place.
Re:Nothing wrong with this... by flibuste · 2004-09-01 03:08 · Score: 1

That works by protecting the encryption algorithm, and thus, prevents from anyone being able to make a dictionnary.
That is the same idea as if you would send your RSA public key AND be stupid enough to also send your private key to the same instance (which you would be amazed how much people do, such as SSH newbies...)
Re:Nothing wrong with this... by bloo9298 · 2004-09-01 03:19 · Score: 1

I'd rather they had my credit card number than a check with my account number, bank, and address...
Re:Nothing wrong with this... by CableModemSniper · 2004-09-01 03:19 · Score: 1

cahoot.com ?

--
Why not fork?
Re:Nothing wrong with this... by jrexilius · 2004-09-01 03:22 · Score: 2, Insightful

You are correct from a consumers point of view only in the context of th transaction.

The cost, however, is passed onto the consumer as the merchants have to charge premiums for fraud in an insecure system, as do the banks, and everyone else along the chain that has to support fraudulent transactions.

This is no small thing, the very large bank I worked at had to spend a great deal of money around this and online-billpay activity.

The credit card is an unfortunate half-breed trying to be somewhere between cash and a check. Historical reasons and trying to gain usage and market acceptance have pushed it into this rols perhaps, but where its at now is broken.
Re:Nothing wrong with this... by alobar · 2004-09-01 03:46 · Score: 1

I know my MBNA credit cards have this feature. You sign into their webpage and you can generate 1 time use credit card #'s with a preset limit as well as a preset expiration. No additional charges either. Works great with things with hidden recurring charges, like those offers where you have to pay 1 dollar for something, only to find out they charge you 60 bux a month later.
Re:Nothing wrong with this... by professorhojo · 2004-09-01 03:50 · Score: 1

>You do realize that to do business on line, you
>would still have to give them your pin, right?

not at all.

the technology would be set up so that the merchant would NEVER see the pin. the only way this would work as a secure authorization system would be to completely remove the merchant as the middle man.

interesting article i just found today on all this: http://www.acsa.net/ccuat.org/creditcards.htm

---
Re:Nothing wrong with this... by Red+Alastor · 2004-09-01 03:51 · Score: 1

There would be another easy way to do it for web transactions. You go to your bank and creates a kind of temporary account with the amount of money you wish from your main account. You give the number of this account on a web transaction and they can get the money in it. You don't fear that they use it again, there is not money anymore in it.

Credit card company could also let you create this kind of account usable only once by people to which you give it for a the maximum amount that you chose.

I wonder why it doesn't exist, I can't imagine I'm the first one to imagine a system like this.

--
Slashdot anagrams to "Sad Sloth"
Re:Nothing wrong with this... by Anonymous Coward · 2004-09-01 04:02 · Score: 1, Funny

"Agreed, and to further narrow it down, it's being *good enough* at only 1 thing: reproduction. Unfortunately, this doesn't usually have a lot to do with intelligence."
Of COURSE! (smacks forehead) THAT explains why rabbits rule the planet.
Re:Nothing wrong with this... by HawkingMattress · 2004-09-01 04:12 · Score: 1

Furthermore, most internet shops now redirect you to a bank to enter you credit card number. The only thing the site should know is if you made the transaction with the bank, and how many.
I know all the shops (even very little ones) we had to code at my place work that way, we absolutly can't know the credit card number of any transaction, all we have is a tracking number.

Still, one could be redirected to a spoofed bank page, and the casual user probably doesn't know what to check apart the little lock icon...
Re:Nothing wrong with this... by pfleming · 2004-09-01 04:24 · Score: 2, Insightful

Actually it's more like survival of the most adaptable. Anything that can't or won't change dies. That which does adapt to the "new" conditions will survive and live on.
Re:Nothing wrong with this... by skiflyer · 2004-09-01 04:29 · Score: 1

Ah, if it were so simple. Once the charges get over a certain amount they start requesting things like police reports, and other information basically designed to prove your honesty.

Am there, doing that. Looks like I won't lose a penny, at least not in direct dollars, but as far as aggravation and time spent running around and arranging paperwork I've lost a bit.
Re:Nothing wrong with this... by JawFunk · 2004-09-01 04:39 · Score: 1

Advice to fellow consumers:
I am a stickler about checking receipts whenever I make purchases using my credit card/debit card. Looking at the receipt, one will wither see a 4982**************, or the actual credit card number followed by exp. date. While I shred the receipts I don't need tht have the full info, my finances are only as safe as the store I just bought from. I have been forewarned that people go through garbages looking for receiptswith the info necessary to dig up 25 numbers with full info.
In response, there should be a law against systems that publish the credit card number on paper, since it is increasingly difficult to track the culprit when two years later you lose $2000 to fraud.

--
[Please sign here]
Re:Nothing wrong with this... by peatbakke · 2004-09-01 04:39 · Score: 2, Interesting

In the United States, a lot of credit card companies are issuing single purchase numbers. I think a few of them allow you to set the amount available, than use the generated number to make the purchase. I think it's an excellent solution to online CC transactions, that doesn't require overhauling the whole transaction system.

I'm in Germany at the moment, and we have a pretty good system for transactions don't involve cash currency. Most people here don't use credit cards or cheques; they use bank issued debit cards, and bank transfers.

The debit card can only be used in person. You have to supply the card ... there's no cheating by just providing the number or anything like that. Can't really use it for online transactions, but it's not meant for that. Cashiers are usually pretty meticulous about checking your signature, so you have relatively good physical security.

There's a surprising number of bank transfers ... you use it for almost everything: rent, utilities, regular bills, paying your friends back, paying for things online, and just about anything except for general shopping.

For every bank transfer you make, you have to supply a transaction authorization number (TAN). When you open an account, you're given a sheet with a couple hundred of these numbers, and you have to use them in sequence. When you want more, you go to the bank, present a valid ID of somesort, and get another sheet.

It's a pretty good system, very convenient, but would require quite a bit of infrastructure changes in the US ...
Re:Nothing wrong with this... by Ryosen · 2004-09-01 04:42 · Score: 1

What's happening there is that the funds are frozen pending reciept of the credit claim from the merchant where you used your card. "Pnd Crd Trns" merely means "Pending Credit Transaction" and is done to prevent you from over-drawing your account. In the event that the merchant does not file his claim to the credit (typically 14 days), the transaction is voided and the funds are re-allocated to your account. The reason that your account balance is debited a few days later is that the credit claim has been received and processed. All banks work in this manner regarding check/debit cards.

--

Ryosen
One man's "Troll, +1" is another man's "Insightful, +1".
Re:Nothing wrong with this... by BP9 · 2004-09-01 04:44 · Score: 1

American express did do this, they cancelled it as being too expensive mid last year. It was great and I used it a lot. The only problem was the numbers they generated always had an expiration date of the current month and sometimes next month (if it was near the end of the month), many merchant banks rejected these as 'expired'.
Re:Nothing wrong with this... by Thuktun · 2004-09-01 04:48 · Score: 2, Insightful

Agreed, and to further narrow it down, it's being *good enough* at only 1 thing: reproduction.

I disagree. It also includes avoiding being killed before reproducing.

Unfortunately, this doesn't usually have a lot to do with intelligence.

Avoiding predators and other dangers may not require intelligence, but it requires instincts. Being conspicuously careless--to bring this somewhat back on-topic--is not usually a good survival trait.
Re:Nothing wrong with this... by BorgDrone · 2004-09-01 04:53 · Score: 1

I disagree. It also includes avoiding being killed before reproducing.
If you get killed before reproducing, you're not good at reproducing yourself, because you've clearly not reproduced.
Re:Nothing wrong with this... by los+furtive · 2004-09-01 04:55 · Score: 1

Avoiding predators and other dangers may not require intelligence, but it requires instincts.
Nope. Tape-worm doesn't require instinct, neither do a lot of creatures that have managed to scrape by without any predators. Another technique is to reproduce so quickly and prolificaly that it doesn't matter if ya get killed 'cause the first thing ya did after you hatched (or whatever) was have a sh*tload of kids yourself.

--
I'm a writer, a poet, a genius, I know it. I don't buy software, I grow it.
Re:Nothing wrong with this... by los+furtive · 2004-09-01 04:59 · Score: 1

Wrong again. There's plenty of stuff that hasn't adapted much in millions of years but has survived just fine, it boils down to reproduction and more specifically the speed and ease which something can reproduce.

--
I'm a writer, a poet, a genius, I know it. I don't buy software, I grow it.
Re:Nothing wrong with this... by superman53142 · 2004-09-01 05:04 · Score: 2, Funny

Agreed, and to further narrow it down, [Evolution] is about being *good enough* at only 1 thing: reproduction.

It's pretty good at email, too.
Re:Nothing wrong with this... by kabloom · 2004-09-01 05:06 · Score: 1

Is it possible that they use some other information (like the card number) as a salt to make it harder to perform the dictionary attack?
Re:Nothing wrong with this... by outernet2 · 2004-09-01 05:20 · Score: 1

I realize that in this day and age everyone is a little skittish about electronic data security, fraud over the internet and the such (rightfully so) but what you're suggesting seems like 5 steps in the wrong direction. Implementing a 2 step process where two independent numbers are combined to create a valid authorization code is a great idea. Sending them vai Snail Mail however, is not. My first thought is that now, anyone who has access to your postmail box has access to your authorization codes. if that someone happens to be a "friend" or someone else who could potentially gain knowledge of your credit card verification number then has a free shopping spree. A way to secure this would be to require activation of these numbers, much as they currently do with atm cards or credits sent in the mail themselves.

--
This .sig is a .fig of your imagination
Re:Nothing wrong with this... by RWerp · 2004-09-01 05:23 · Score: 1

What about a virtual card? You get a VISA-like number, but they can charge it only as much as you put on the card.

This said, I do most of my online shopping in Poland by simple bank transfers (via online bank).

--
"Long run is a misleading guide to current affairs. In the long run we are all dead." (John Maynard Keynes)
Re:Nothing wrong with this... by bob65 · 2004-09-01 05:26 · Score: 1

During the checkout phase, you get a code. You log on to your bank/credit card/whatever account, paste that code into a field to authorize the funds, and get an order confirmation from the place where you bought your stuff.
But isn't that essentially the same as a continually changing (1 time use) credit card number, but with more (or pretty much the same amount of) hassle?
Re:Nothing wrong with this... by realdpk · 2004-09-01 06:17 · Score: 1

Verified by Visa is one of the biggest hassles ever. Nothing is actual verified by Visa - it's a lie - they're all verified by third-party verifiers.
Re:Nothing wrong with this... by pfleming · 2004-09-01 06:18 · Score: 1

Wrong again. There's plenty of stuff that hasn't adapted much in millions of years but has survived just fine,
But the giraffe adapted to higher food sources, humans (and other species) adapted to use tools to extend their reach, leverage, etc.
it boils down to reproduction and more specifically the speed and ease which something can reproduce.
Elephants gestate for ~24 months yet have survived. It has to do with more than just how fast something procreates, otherwise the only thing left would be one celled organisms.
Re:Nothing wrong with this... by Angostura · 2004-09-01 06:18 · Score: 1

I disagree. In a population competing for limited resources, it is the fittest that have the best chances of survival and reproduction.
Re:Nothing wrong with this... by Frizzle+Fry · 2004-09-01 06:28 · Score: 2, Insightful

Yes, but the point is that intelligence can be very helpful towards the goal of staying alive. And since, as you say, staying alive is part of being successful at reproduction, this means that being smart does help your evolutionary chances (although of course other things can help too, and sometimes enough to offset lack of intelligence). The fact that humans evolved from fairly unintelligent life (at least if you go far enough back) is pretty good evidence of this.

--
I'd rather be lucky than good.
Re:Nothing wrong with this... by afidel · 2004-09-01 06:35 · Score: 1

It involves a hell of a lot more than just reproduction and surviving to achieve it. Long term survival rates and population densities among primitive hominids particularly and long maturing species in general often corelates strongly with survival of grandparents. This makes sense because a lot of information necessary for survival is carried by the older more experienced members of the species. For instance herd survival of African elephants where the matriarch is killed is reduced significantly. This is because the Matriarch will remember the wattering hole that the herd used 30+ years ago when the last great drought came. Without access to that information some or all of the herd dies during a particularly bad drought year. This shows where basic biology as taught in high school falls far short of modeling reality, just as high school economics does.

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Re:Nothing wrong with this... by Thuktun · 2004-09-01 06:54 · Score: 1

Nope. Tape-worm doesn't require instinct, neither do a lot of creatures that have managed to scrape by without any predators.

Avoiding predators doesn't require instincts because tapeworms don't require instincts and don't have any predators?

Another technique is to reproduce so quickly and prolificaly that it doesn't matter if ya get killed 'cause the first thing ya did after you hatched (or whatever) was have a sh*tload of kids yourself.

You would soon find your population limited by the prevailing resources or newly-arisen predators as other species compete for the same resources.
Re:Nothing wrong with this... by mla_anderson · 2004-09-01 07:41 · Score: 1

I don't have Quicken on this computer so I wasn't able to look at any of the QDF files, but MNY files (Microsoft Money) are easy to look at with a text editor.

And if you're Rick B***r from Moses Lake you might want to remove your financial data from your personal website. Also ease off on the snuff it causes mouth cancer, and explore Linux programming as well as Windows programming. BTW your account numbers, address, children's names, etc are all in there.

--
Sig is on vacation
Re:Nothing wrong with this... by gregeth · 2004-09-01 08:06 · Score: 1

There's one thing to that, though. You have to be dependent on how secure your home mailbox is.

I've already learned the hard way to never trust important incoming mail to my mailbox, and it even requires a key. I used to receive bank statements, including written checks for the previous month, but one day it was stolen, and I had to go through a hassle of identity theft.

Luckily the person was caught, and it turned out had been doing the same thing throughout a large portion of the area. I now go to the bank to pick up any printed material, and do the same for other things as well. That way I have to at least identify myself with ID, and they even know me there.

What I would like to see is more use of things like smart cards in combination with PINS(maybe even RSA ones that change every minute), and then your number.
Re:Nothing wrong with this... by danheskett · 2004-09-01 08:13 · Score: 1

You need access to the post office PLUS your credit card. And even then, the codes are dollar amounted limited (like, you could order 10 a month of under $50, 5 a month under $10, 1 a month over $250) and time limited.

A simple phone call with an automated system from a set of listed phone numbers adds an additional layer of security: now a person would have to intercept your mail, steal wallet, break in your home and make a phone call, then go on an online shopping spree. Compared to now where all they have to do is steal your wallet, that's a big step up in my mind.. plus in my idea you dont have to worry about crappy vendors having your number stolen..
Re:Nothing wrong with this... by danheskett · 2004-09-01 08:15 · Score: 1

There's one thing to that, though. You have to be dependent on how secure your home mailbox is.
Not really. The codes are useless without the physical presence of your card. I agree that things like PINS are attractive, but in fact, I find them to be less secure as people just tend to set them to 0000's, etc.

With what I am proposing it requires physical posseion of two items, plus use within a specified time period plus the fact that you'd have the various codes dollar limited. With that combination you are hard pressed to lose.
Re:Nothing wrong with this... by EvilSporkMan · 2004-09-01 09:06 · Score: 2, Insightful

s/rabbits/bacteria/;

--
-insert a witty something-
Re:Nothing wrong with this... by TheoMurpse · 2004-09-01 09:52 · Score: 1

but 'fittest' is used meaning a group of people who comprise a percentage known as 'the fittest'

'good enough' is relative to how everyone else stacks up, hense, being part of the percentage known as 'the fittest'

'survival of the fittest' does not mean the one fittest being
Re:Nothing wrong with this... by BorgDrone · 2004-09-01 09:58 · Score: 1

true, however, we have evolved to a point where there is no longer a strong selection pressure on being smart, since everyone is 'smart enough'.
If I look around me, the number of offspring seems inversely proportional to the intelligence of the parents.
Re:Nothing wrong with this... by SnprBoB86 · 2004-09-01 11:46 · Score: 1

I say we excellerate this process.

After finding people so dumb they publish their quicken data. We extract their addresses from the document and order an execution.

--
http://brandonbloom.name
Re:Nothing wrong with this... by Halfbaked+Plan · 2004-09-01 13:02 · Score: 1

It's not wether you are 'dumb' enough to put it on the Internet. It's wether some ecommerce site you frequented one day is 'dumb' enough to do so, with your number and info.

--
resigned
Re:Nothing wrong with this... by caveat · 2004-09-01 15:34 · Score: 1

yeah, i know that's how it works - i was pointing out that the parent post wasn't entirely accurate in saying that credit transactions take a few days to show up in your online statement; mine show up in minutes. i'm a bit of a pedant that way sometimes :)

--

Facts do not cease to exist because they are ignored. - Aldous Huxley
Re:Nothing wrong with this... by feargal · 2004-09-01 22:34 · Score: 1

What?

I'm sorry, but if you live in a fictional small town Little Pebble, Ohio which is 200 miles from Big City, does the US Postal System really require that you use "Little Pebble, Big City, Ohio" as your address? Surely that's what your ZIP system is for?

The fields I use for addresses, if they have to be broken down into individual fields are:

Address 1, Address 2, Town/City, County/Province/State, ZIP/Postal Code, Country.

Required fields will be Address 1, Country, and any one of of Town/City, County/Province/State, ZIP/Postal Code.

Trying to avoid being an insensitive clod.

--
"A goldfish was his muse, eternally amused"
Re:Nothing wrong with this... by Technonotice_Dom · 2004-09-01 23:03 · Score: 1

Perhaps this is an area where the likes of third-party merchant services such as 2checkout.com, Paysystems, and iBill can really shine. Ignoring the problems these specific merchant services have had, the model of passing the user to a secure page provided by a "trusted" company to enter credit card details could be a good marketing gimmick.

I agree - WorldPay is a good one in my experience too. I'm planning to use it on a new site as I've used it elsewhere to pay for all sorts of things, including subscription payments.
Re:Nothing wrong with this... by Technonotice_Dom · 2004-09-01 23:12 · Score: 1

Chip + pin will work well in shops I'm sure, but what about websites? I've seen a couple Flash demos for Verified by Visa and so on, but it looks tremendously easy to fake especially for your average user. I haven't seen it in person though.
Re:Nothing wrong with this... by ODD97 · 2004-09-01 23:50 · Score: 1

Also MasterCard SecureCode. Discover and AmEx are both setting up similar systems, but SecureCode is also in place.
/works e-commerce

--
The emperor is naked.
Re:Nothing wrong with this... by Emperor+Igor · 2004-09-02 01:47 · Score: 1

By "you", I meant "you, as a human". It wasn't a personal insult... ...stupid asshole moderators.
Re:Nothing wrong with this... by nzhavok · 2004-09-02 02:38 · Score: 1

During the checkout phase, you get a code. You log on to your bank/credit card/whatever account, paste that code into a field to authorize the funds, and get an order confirmation from the place where you bought your stuff.

Here in Germany there's a system called überweisung, basically it's nothing more than bank transfer, except that people use it religiously. If you want to make an online purchase usually you will be given a reciept with an order number, you then make a bank transfer to the business's account using this order number. The business doesn't need to know any of you account details at all.

Now there's nothing special about this system, we had a similar system in New Zealand. The main difference is social, most people prefer to use it instead of credit cards. Banks also have machines for making the transfer, usually sitting next to ATM machines so you don't need a PC to use it (of course you can do it manually at a teller as well). It's also useful for person to person transactions instead of just person to business.

As examples, I've used this several times this month: to pay for ebay items, to order a CD from www.buch.de, to pay my rent to the landlord, cellphone bill, food money to my girlfriend, and paying car rental to a collegue.

--

He who defends everything, defends nothing. -- Fredrick The Great
Re:Nothing wrong with this... by nzhavok · 2004-09-02 02:44 · Score: 1

You do realize that to do business on line, you would still have to give them your pin, right?

[already posted this elsewhere in the thread, but thought you might be intersted in it]

Here in Germany there's a system called überweisung, basically it's nothing more than bank transfer, except that people use it religiously. If you want to make an online purchase usually you will be given a reciept with an order number, you then make a bank transfer to the business's account using this order number. The business doesn't need to know any of you account details at all.

Now there's nothing special about this system, we had a similar system in New Zealand. The main difference is social, most people prefer to use it instead of credit cards. Banks also have machines for making the transfer, usually sitting next to ATM machines so you don't need a PC to use it (of course you can do it manually at a teller as well). It's also useful for person to person transactions instead of just person to business.

As examples, I've used this several times this month: to pay for ebay items, to order a CD from www.buch.de, to pay my rent to the landlord, cellphone bill, food money to my girlfriend, and paying car rental to a collegue.

--

He who defends everything, defends nothing. -- Fredrick The Great
Re:Nothing wrong with this... by ShieldW0lf · 2004-09-13 14:59 · Score: 1

Evolution is about being *good enough*, not the best.

Agreed, and and to further narrow it down, it's being *good enough* at only 1 thing: reproduction.

Unfortunately, this doesn't usually have a lot to do with intelligence.

So you're saying all six billion of us can stop applying our intellects to our problems, go back to hunting and fucking, and we'll be all right?

Cool!

--
-1 Uncomfortable Truth

this was on cryptome by jabella · 2004-09-01 00:13 · Score: 5, Informative

This was on bugtraq a week or two ago:

Check it out and there was a discussion of it a few days later.

Someone actually has a whole forum dedicated to finding things you can do with google here.

Apparently this was even a DEFCON speech subject.

Re:this was on cryptome by Anonymous Coward · 2004-09-01 00:28 · Score: 3, Informative

Someone actually has a whole forum dedicated to finding things you can do with google here.
Another good site is searchlores.org
It doesn't limit itself only to Google.
Re:this was on cryptome by Anonymous Coward · 2004-09-01 01:49 · Score: 1, Interesting

Bwaa. So trivial. So I just invented one myself:
mpdsecret
Who would beleive that it would get this back ?

I blame the Google Toolbar for a lot of this by twoshortplanks · 2004-09-01 00:14 · Score: 5, Informative

It used to be the case that If you put something temporarily in a directory on your webserver (that didn't have indexes turned) on you could simply give the URL of the file to a couple of people to have a quick look at and not have to worry about putting a password on the file. Because it wasn't linked from anywhere unless someone could guess the URL then no-one else wouldn't be able to find it.

This is no longer the case. The Google toolbar reports home to Google about sites people visit. Within a couple of minutes of someone viewing a URL that was private and only meant for them with a browser with the google toolbar installed the googlebot will come along to the site and grab the file for indexing. Nasty if you're not expecting it.

--
-- Sorry, I can't think of anything funny to say here.

Re:I blame the Google Toolbar for a lot of this by makapuf · 2004-09-01 00:16 · Score: 4, Insightful

Which in the long run is a good thing, because people will then use real security, and if it is not easy enough to set up, some solutions will emerge.

In the long run, thus, we'll have real security and ease of use.
Re:I blame the Google Toolbar for a lot of this by Max+Romantschuk · 2004-09-01 00:17 · Score: 5, Informative

The Google toolbar reports home to Google about sites people visit. Within a couple of minutes of someone viewing a URL that was private and only meant for them with a browser with the google toolbar installed the googlebot will come along to the site and grab the file for indexing. Nasty if you're not expecting it.

Nasty? Yes.

But then again, as far as I know Google does respect robots.txt. It's not hard to make a robots.txt file to exclude whatever dir you wish to use for temporary private viewing.

And it's not that hard (on Apache servers) to make an appropriate .htaccess file either.

--
.: Max Romantschuk :: http://max.romantschuk.fi/
Re:I blame the Google Toolbar for a lot of this by Roofus · 2004-09-01 00:18 · Score: 1

Did you try the Google search? Most of the sites listed there were actually forums where people were posting lists of credit card numbers/personal information.

And even before the Google toolbar, putting up sensitive information on an unlinked page was never a smart thing to do. Just use an .htaccess file and password protect it for christ sakes.
Re:I blame the Google Toolbar for a lot of this by halowolf · 2004-09-01 00:20 · Score: 1

Its certainly not a new problem. The poor design of the shared directory selection in Morpheus and other P2P apps certainly led more than a few people to share their entire hard drives.
Many internet users don't seem to understand what risks they have on their computers in exposing sensitive information. Hopefully education and a few high profile blunders will make people realise was risks they may have and take appropriate action.
More and more it looks like people really should get a license before using the internet :)
Re:I blame the Google Toolbar for a lot of this by jsebrech · 2004-09-01 00:26 · Score: 4, Informative

This is no longer the case. The Google toolbar reports home to Google about sites people visit. Within a couple of minutes of someone viewing a URL that was private and only meant for them with a browser with the google toolbar installed the googlebot will come along to the site and grab the file for indexing. Nasty if you're not expecting it.

If you want to share something without google indexing it, there are many strategies you can use, all outlined on google.com itself.

Google does not index anything you have not allowed it to.

The problem is people putting private information in a public forum, not someone indexing that private information.
Re:I blame the Google Toolbar for a lot of this by RsG · 2004-09-01 00:29 · Score: 5, Interesting

Not to troll, but "real security and ease of use"? That's a contradiction in terms. Any system thats easy to use is almost certainly easy to crack (hint, the crackers have as easy a time as the user). Any secure system usually requires long passwords, encryption keys or something equally challenging. If your users keep their passwords the same for all systems, or have accessable copies to remind them, then the system isn't secure (remember last week when Gabe Newall's forum accounts got hacked because he used the same friggin password and it was easy to guess?)
If you mean security through obscurity then you're describing the current situation on the net, but the article states that Google is removing the obscurity aspect by making the entire net accessible. We no longer have any kind of assurance than a given nook or cranny is too obscure to bother with.
I agree that people shouldn't leave their personal data lying around, but to simply assume that the general public can adopt security measures that we, the /. crowd, consider adequate and easy to use is silly. What we need is internet education (the do's and do not's for the clueless).

--
Erotic is when you use a feather. Exotic is when you use the whole chicken.
Re:I blame the Google Toolbar for a lot of this by xQx · 2004-09-01 00:33 · Score: 5, Informative

The only problem with that is that hackers have a tendency not to respect robots.txt .. in fact, it's a great index of stuff to have a look at on public websites.
Re:I blame the Google Toolbar for a lot of this by TheViciousOverWind · 2004-09-01 00:33 · Score: 2, Interesting
The same problem actually exists with lots and lots of files...

Try out these searches on Google:
Lots and lots of people is reckless with their data.
--
My <1000 UID is with a hot chick
Re:I blame the Google Toolbar for a lot of this by Ancil · 2004-09-01 00:34 · Score: 3, Funny

srv1(~)% cat /var/www/html/robots.txt User-agent: * Disallow: / srv1(~)#
Re:I blame the Google Toolbar for a lot of this by Sepodati · 2004-09-01 00:41 · Score: 1

But then you just google for the robots.txt file and have a looksee at what people are trying to hide!! :) ---John Holmes...
Re:I blame the Google Toolbar for a lot of this by WoofLu · 2004-09-01 00:45 · Score: 5, Funny

whoa, your `cat` utility seems to get you to a root shell ^^

maybe it's a new security hole? q:
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 00:45 · Score: 1, Informative

But do hackers have access to the information snitched by the Google Toolbar? If not, then there might be no easy way to crawl to those pages. (No links from visible pages, no dir listings.)
Sure, the page is still there and accessible, but there's a difference between groping for it in the dark and having Google spotlight it.

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by 5E-0W2 · 2004-09-01 00:47 · Score: 3, Funny

The rest of your security is still pretty bad though. By the looks of your prompt you just got a root shell by catting your robots.txt.
Re:I blame the Google Toolbar for a lot of this by It'sYerMam · 2004-09-01 00:47 · Score: 1

"That's a contradiction in terms."
Well, not really. If you think about it, the whole point of a password, which is very easy to use as long as you remember it, is that it's not easy for a cracker to get hold of it. Sudo is easy to use, but you still can't use it without enabling it, which requires the root password.
Ease of use is relative. Having to log out and log in as root to perform the tiniest administrative task is not ease of use, but it's no more secure than using su.

--
im in ur .sig, writin ur memes.
Re:I blame the Google Toolbar for a lot of this by JimDabell · 2004-09-01 00:56 · Score: 1

Because it wasn't linked from anywhere unless someone could guess the URL then no-one else wouldn't be able to find it.

Classic security through obscurity. Is it really wise to blame other people for this kind of screw-up?

The Google toolbar isn't the first, and won't be the last method of discovering unpublished URLs. For instance, web statistics packages are commonly available from http://www.example.com/stats and will list popular URLs. Or, if the "secret" resource is an HTML page, you'll be transmitting the URL in your Referer header when you click on any of the links (or even just by visiting the page if your browser is doing pre-caching, or if it contains inline images etc residing on an external server).

The bottom line is that if something is secret, you shouldn't give it to anybody who asks.
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 01:03 · Score: 1

Yeah, I'm hiding a big directory called jack. Now what? Google got a tip-off from their toolbar to jack/TerrificCoffee.html, but when their crawler comes to take a look, it checks robots.txt first and stops. All you know is jack. ;)
It's still a bad idea to leave unprotected files. At least slap a low-level security access password on the directory. (Which won't stop a malware toolbar that collects keystrokes.)

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by Dorothy+86 · 2004-09-01 01:10 · Score: 1

so put the meta tags in that stop the googlebot

--
Game Overdrive - Gaming News
Re:I blame the Google Toolbar for a lot of this by Yer+Mom · 2004-09-01 01:17 · Score: 1

Can you say "robots.txt"?

--
Never mind Spamassassin. When's Spammerassassin coming out?
Re:I blame the Google Toolbar for a lot of this by Sepodati · 2004-09-01 01:18 · Score: 1

Yeah, that's all Google knows. I however, search Google for your robots.txt file, see you have a folder jack/ you don't want indexed, so I pull up domain.org/jack/ to see what you're trying to hide. Might be worthless, might not be.

---John Holmes...
Re:I blame the Google Toolbar for a lot of this by rixster · 2004-09-01 01:21 · Score: 1

Ok I found that funny, but no mod points (since the thread of death) so please consider this a virtual +1 from me .

--
Two wrongs may not make a right, but three ....
Re:I blame the Google Toolbar for a lot of this by Lev13than · 2004-09-01 01:39 · Score: 2, Interesting

The same problem actually exists with lots and lots of files...

Nice links. In the same vein, try variations of this:

"company confidential" filetype:ppt

--
When you have nothing left to burn you must set yourself on fire
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 01:39 · Score: 1

The robots.txt will stop Google. No dir listings or links from elsewhere will stop spiders from other search engines. Spyware and crooked mail servers or pwned boxes will still work, so don't give the URL to anyone who uses them. ;)

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by Neil+Watson · 2004-09-01 01:50 · Score: 4, Insightful

The problem is people putting private information in a public forum, not someone indexing that private information.
People still 'hide' house keys under their doormat. Try explaining to them why they shouldn't do it on the Internet.

--
UNIX/Linux Consulting
Re:I blame the Google Toolbar for a lot of this by mors · 2004-09-01 01:53 · Score: 1

A related problem sites that have their logs available for anyone to see. If they log the referer, your "secret" site will show up as a link, which Google will follow.
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 01:54 · Score: 1

You get a nice 404 and still know jack because I turned off dir listing for that directory. If anyone wants to try a brute force search, I'll probably notice and might slip them a server that generates an infinite maze of twisty sub-directories all slightly different.

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by Sepodati · 2004-09-01 01:59 · Score: 1

Well, then... I guess you're doing it the right way. :) I know others are not...

---John Holmes...
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 02:10 · Score: 1

Yeah, it needs a "don't try this at home, I'm a trained paranoid" disclaimer. :) Ah heck, think about how many Win XP home users there are who don't even know that they're running a web server (and for Pro, a FTP server, SMTP server ..)

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by Sepodati · 2004-09-01 02:18 · Score: 1

Well, I put "please don't look at this if you're a bad guy" on my website, so I'm safe.

---John Holmes...
Re:I blame the Google Toolbar for a lot of this by sdo1 · 2004-09-01 03:58 · Score: 1

Google does not index anything you have not allowed it to.
Not quite.
Google indexes everything you have not denied it to.
There's a difference.
-S

--
--- What parts of "shall make no law", "shall not be infringed", and "shall not be violated" don't you understand?
Re:I blame the Google Toolbar for a lot of this by Blakey+Rat · 2004-09-01 04:04 · Score: 2, Informative

What's the problem here? If you don't want it indexed, say so in a robots.txt file... Google respects those if they're present.

--
Comment of the year
Re:I blame the Google Toolbar for a lot of this by iabervon · 2004-09-01 04:05 · Score: 1

Actually, a lack of ease of use is the most common source of security vulnerabilities. Requiring long passwords (or frequently changed passwords) mostly causes people to reuse them or write them down. If a security-related program is complicated or difficult to use, there is a higher chance that the users will screw it up and not actually be secure.

People's web spaces could have support for making a list of email addresses that could get a document. This would work by looking up the domain's public certificate (ideally out of a local cache of public certificates from previous interactions with the particular users; don't trust VeriSign), and requiring the client to use a client certificate with the right distinguished name signed by the domain. Other users would, when they logged in, go to their domain's CA web site and get a client certificate by supplying their password. Easy to use, real security. None of this "send a reuseable authentication token to somebody else's system" junk.

The problem is not so much that the clueless don't understand security as that there isn't really a secure system available which is sufficiently comprehensible to explain to them such that they can use it successfully.
Re:I blame the Google Toolbar for a lot of this by tepples · 2004-09-01 04:12 · Score: 1

Google indexes everything you have not denied it to. There's a difference.

Except the default state of information that a fellow generates is still "denied." It takes an overt act of publishing something online, such as uploading it to a web server before uploading robots.txt, to change the state to something other than "denied."
Re:I blame the Google Toolbar for a lot of this by Squonk01 · 2004-09-01 04:34 · Score: 1

Even without the Google toolbar, others can still detect the URL of something temporarily in a directory. If I check out the link you sent me and then move onto my favorite site, I'll be recorded in the referrer log of the second site. Since some of those logs are public, all the URLs listed there can eventually be spidered.
Re:I blame the Google Toolbar for a lot of this by Eivind · 2004-09-01 04:37 · Score: 1

This ain't nessecarily so at all. It is true that *sometimes* there's a trade-off between security and ease of use, but it's no natural law like you pretend.
An example; When you meet your spouse, within a fraction of a second both of you have securily identified eachothers. The identification is very secure, totally effortless, and still pretty darn hard for an attacker to spoof.
Similarily, having a security-guard at the door who happens to *know* the dozen people working in an area is *not* much of a burden to those people working there, and still quite secure.
Having a system where you need to insert a usb-key and type a 5-digit pin to use a system is *also* very secure, assuming it's done rigth. It is also *easier* to use that the typical current-day username+cryptic password thing.
I could give dozens more examples, but I don't think it's needed. Better security should mean *smarter* security, not only "let's require 16 character randomly generated passwords" (that'd only make people write them down anyways)
Re:I blame the Google Toolbar for a lot of this by Q+Who · 2004-09-01 05:23 · Score: 1

Learn to read, genius.
If Google Toolbar respects robots.txt, then that's it.
Re:I blame the Google Toolbar for a lot of this by Photar · 2004-09-01 06:26 · Score: 1

"company confidential" filetype:xls

--
He who knows not and knows he knows not is a wise man. He who knows not and knows not he knows not is a fool.
Re:I blame the Google Toolbar for a lot of this by $raim_n_reezn! · 2004-09-01 07:15 · Score: 1

Canadians leave their doors open so we have no precedents unlike some southern neighbours we know...

--
All straight things must come to a bend
Re:I blame the Google Toolbar for a lot of this by Phanatic1a · 2004-09-01 08:36 · Score: 1

'cause they have 3 billion neighbors instead of only 5.
Re:I blame the Google Toolbar for a lot of this by Crispy+Critters · 2004-09-01 10:26 · Score: 1

"it's a great index of stuff to have a look at on public websites."
I for one would like to know why the robots.txt at www.whitehouse.gov is blocking access to directories like /kids/teeball/iraq. Is there some national security implication that I am missing? Or /national-anthem/text. Can't allow people to get the words to the national anthem! Who knows what fool ideas they'll come up with.
Re:I blame the Google Toolbar for a lot of this by RedWizzard · 2004-09-01 11:10 · Score: 1

But do hackers have access to the information snitched by the Google Toolbar? If not, then there might be no easy way to crawl to those pages. (No links from visible pages, no dir listings.)
Sure, the page is still there and accessible, but there's a difference between groping for it in the dark and having Google spotlight it.

The problem is that you have to have a robots.txt listing the private parts of your site if you don't want the GoogleBot in there. So all a malicious intruder needs to do is look at robots.txt and they'll have a very good idea of where to find the private data. They won't be groping in the dark.
Robots.txt is not the answer. If you want to control access to pages in your site then you need to use access control. It's a simple as that.
Re:I blame the Google Toolbar for a lot of this by AndroidCat · 2004-09-01 13:27 · Score: 1

So they know a directory name. It won't get them much since asking for http://example.com/dirname/ will get them a big fat 404. They'll still be fishing in the dark for the actual file names. (Of course I'll turn off dir listings for that directory.)
Access controls are better, but you could still be burned by someone with malware that captures his password keystrokes or id information and then phones it home.

--
One line blog. I hear that they're called Twitters now.
Re:I blame the Google Toolbar for a lot of this by BACbKA · 2004-09-03 23:11 · Score: 1

I am reading your comment with the following random (?!) quote inserted by the slashcode right beneath: "Virtual" means never knowing where your next byte is coming from.

--
VKh

Quicken files by Space+cowboy · 2004-09-01 00:14 · Score: 4, Insightful

I feel sorry for 'Haley' and others with their Quicken files being shown to all of /. and presumably friends etc. I wonder what the 'reach' of the slashdot crowd is when it's a "You're not going to believe this!" story...

Simon

--
Physicists get Hadrons!

Re:Quicken files by ImaLamer · 2004-09-01 00:40 · Score: 2, Funny

What I'm wondering is....

Can I mirror these files on my web site?

I've downloaded a few but don't plan on doing anything dirty. Maybe I'll send out a few letters telling people that they should watch what they post on-line

I can see the reponse:

"Honey, do you know anyone named 'ImaLamer'?"

"No dear"

"Well, he or she claims that your bank information is online"

"Must be some sort of scam sweetie, toss it"

--
Get your Unix fortune now!
Re:Quicken files by johnkoer · 2004-09-01 09:26 · Score: 1

No it would be more like:

"Send him our Account # and PIN to verify it is really is our account."

--
Johnkoerner.com

FBI use? by SynKKnyS · 2004-09-01 00:14 · Score: 4, Insightful

Looks more like Google found forums where people were swapping credit card numbers.

Re:FBI use? by wobblie · 2004-09-01 13:14 · Score: 1

nah - probably some used the forum to post credit card numbers as a throw way "catcher". Since it's not english there might be a chance it would stay up longer.

like
fake paypal email points to cracked web server
cracked web server posts results to forums that allow anonymous posting across the world

Priceless by Killjoy_NL · 2004-09-01 00:16 · Score: 4, Funny

Good thing I've got a Mastercard then :)

--
This is the sig that says NI (again)

Re:Priceless by EdZ · 2004-09-01 00:39 · Score: 1

It works for mastercard too. Just replace Visa with Mastercard in the search.
Re:Priceless by ralmeida · 2004-09-01 00:57 · Score: 1

While you're at it, search Google for "sense of humor".

--
This space left intentionally blank.
Re:Priceless by interiot · 2004-09-01 01:26 · Score: 3, Informative

Visa and MasterCard use different prefixes though... so you have to change the number range to 5000000000000000..5699999999999999.

What I'm more surprised by by suso · 2004-09-01 00:16 · Score: 4, Interesting

is that you can search for ranges of numbers like that in google. That's pretty neat.

Re:What I'm more surprised by by dr_labrat · 2004-09-01 00:28 · Score: 1

Its so "neat" and surprising that Google even document it!

http://www.google.com/help/refinesearch.html

Cool!

--
The secret of success is honesty and fair dealing. If you can fake those, you've got it made. (Marx)
Re:What I'm more surprised by by phreakv6 · 2004-09-01 00:29 · Score: 5, Informative

That feature has been here for sometime.If you want a list of all such obscure features
of google check this

--
fifteen jugglers, five believers
Re:What I'm more surprised by by ceeam · 2004-09-01 01:24 · Score: 1

At least it's documented. OTOH "filetype:xxx" I cannot find in their docs. Anything else we've been missing? ;)
Re:What I'm more surprised by by moonbender · 2004-09-01 01:35 · Score: 1

It's documented all right.

--
Switch back to Slashdot's D1 system.
Re:What I'm more surprised by by cymen · 2004-09-01 04:05 · Score: 3, Informative

I don't see the number range listed on that page. Am I missing something?
Re:What I'm more surprised by by RedWizzard · 2004-09-01 11:20 · Score: 1

I don't see the number range listed on that page. Am I missing something?
No, it's not mentioned on that page. It is mentioned on the page about search operators though.

Googledorks by tb()ne · 2004-09-01 00:16 · Score: 5, Informative

I think there was a similar /. article a while back. Do a google search for "googledorks" to find out what additional kinds of data are accessible.

Liability by usefool · 2004-09-01 00:18 · Score: 5, Interesting

Is Google liable for harvesting and publishing sensitive information? If neighbour's window wasn't closed, it doens't mean you can take his naked photo and put it on the website?

Also, maybe those numbers are traps to catch people? Surely you need those goods to be sent to an address and someone has to eventually pick it up.

--
Uselessful technology (Air-Charged

Re:Liability by Anonymous Coward · 2004-09-01 00:23 · Score: 1, Informative

They are not publishing anything. It was already published. Google just found it. Google should have NO liability whatsoever.

This does make it easier for me to search for MY credit card. I would never put my own in the search engine bar as the search would be cached in someone's computer. Now, I just put the range in to see if I am on some Russian mafia's list...
Re:Liability by DZign · 2004-09-01 00:30 · Score: 1

Can't answer on the liability issue..

However back in the day when Altavista ruled, they had a nice guide about this, linked to from their main page. Although it wasn't about cc numbers but sensitive corporate information. I remember reading a whole instruction page about searching for 'companyname confidential' and strings like that so you could find if they indexed something they shouldn't have and what to do about it.

--
Learn about pinball machines on www.flippers.be
Re:Liability by tb()ne · 2004-09-01 00:33 · Score: 2, Insightful

Is Google liable for harvesting and publishing sensitive information? If neighbour's window wasn't closed, it doens't mean you can take his naked photo and put it on the website?
If a google search finds it then google is not publishing it; rather, google is simply providing a link to something that is already published. IANAL but, cacheing aside, all they are doing is providing a link to something that is already publicly accessible, so I don't see how they could be liable. The situation may be more complicated if the data were illegally published, later pulled from the web site, but remain in google's cache.
Re:Liability by swillden · 2004-09-01 02:50 · Score: 2, Insightful

If neighbour's window wasn't closed, it doens't mean you can take his naked photo and put it on the website?
Bad analogy. A better one: If the neighbor posts his naked photo on a public bulletin board, does that mean you can show other people where it is?
Stuff that's on the web is there because someone put it there, i.e. they published it. The fact that they may not have *meant* to publish it doesn't change the fact that they did. If you place an ad in the newspaper, but screw up and give the paper a steamy letter to your secret gay lover instead of the blurb about the 1998 Camaro you want to sell, are they liable for the damage done to your reputation when they publish it? (Assuming, of course, that you consider it more damaging to be 'outed' as a closet homosexual than as a Camaro owner).

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Liability by Indras · 2004-09-01 03:01 · Score: 1

Also, maybe those numbers are traps to catch people? Surely you need those goods to be sent to an address and someone has to eventually pick it up.

Not if what you're purchasing isn't physical, like the registration to a porn site.

--
The speed of time is one second per second.
Re:Liability by Abcd1234 · 2004-09-01 04:31 · Score: 1

Bad analogy. This is more like: if your neighbour took a naked photo of himself and then taped it to his window, are you allowed to look at it?
Re:Liability by glass_window · 2004-09-01 04:35 · Score: 1

Ask the Paparazzi. IANAL but I'm pretty sure as long as you are taking the picture from a public location (i.e. a public street) you can actually do this legally. It's their responsability to maintain their own privacy, and anything that can be seen publically is public.
Re:Liability by syukton · 2004-09-01 04:50 · Score: 1

I think it boils down to intent. If you have a web camera outside your house that does a sweep of your sideyard/neighbor's house every hour and updates it to a website and your camera happens to catch her with the windows open and the blinds up totally dripping wet, then I guess you're just lucky. If you have a camera pointed AT the window and you're hoping to get a sneak peek, then you're a voyeur and you'll probably be caught and charged.

I like the idea of the numbers being traps though. makes me laugh.

--
Reinvent the wheel only at either a lower cost, greater effectiveness, or your own personal enrichment and satisfaction.

Try phpMyAdmin by Anonymous Coward · 2004-09-01 00:20 · Score: 5, Interesting

Very popular is the search for "Welcome to phpMyAdmin".

This will give you some nice databases to browse through.

Re:Try phpMyAdmin by phreakv6 · 2004-09-01 00:36 · Score: 1

that was a good try... but these people werent completely dumb though since there is a sweet authentication page which shows up here,here,here,hereandhere:))

--
fifteen jugglers, five believers
Re:Try phpMyAdmin by Repton · 2004-09-01 12:55 · Score: 1

Yeah ... You could try adding "root with no password" to the search string.

--
Repton.
They say that only an experienced wizard can do the tengu shuffle.

How many of you... by curne · 2004-09-01 00:20 · Score: 5, Funny

How many people dug out their own visa cards and googled for the number ? :-) I managed to stop
myself.

--
All interpreted languages are abstractions over Lisp

Re:How many of you... by MasterDirk · 2004-09-01 00:29 · Score: 1

I must admit, I came pretty close before my own right got to its senses and smacked me in my forehead.

Ah, the dangers of drunk surfing...

--
"Programming is like sex: one mistake and you have to support it for the rest of your life."
Re:How many of you... by Dr.+Hok · 2004-09-01 00:48 · Score: 5, Funny

If you are worried about privacy, give me your visa number and I google for you. This will hide the connection between your name and the number.

--
Say out loud: I'm an Aspie and I'm somewhat proud, I guess. Uh. Can I write an email in all caps instead? Hm...
Re:How many of you... by noselasd · 2004-09-01 01:02 · Score: 2, Interesting

I did that some weeks ago. Now, what would be the harm of that,
given one erases the browser history rather quick ?
Google stores all searches somewhere ?
Re:How many of you... by maxwell+demon · 2004-09-01 01:17 · Score: 1

Google stores all searches somewhere ?

How do you think can they find out the most common search requests, if not by saving the search requests?

--
The Tao of math: The numbers you can count are not the real numbers.
Re:How many of you... by curne · 2004-09-01 01:35 · Score: 1

...now I'd be really bummed out if my Visa card number was on Google's most common search request :-)

But seriously, that info is handed of to all kinds of third parties, for instance any page that does turn up (if any) will get the card number in the HTTP_REFERER URL.

--
All interpreted languages are abstractions over Lisp
Re:How many of you... by JayJay.br · 2004-09-01 01:43 · Score: 1

I wouldn't say exactly your own number, but you could do a search just like that one in the post, but using your first 4 numbers and grep for your number in the results. Just to make sure some shithead didn't post _your_ number anywhere.

Now you know _I_ did it.

Yeah, I know your post was a joke, even made me giggle :) Just wanted to point that out, though.
Re:How many of you... by julesh · 2004-09-01 01:44 · Score: 2, Interesting

for instance any page that does turn up (if any) will get the card number in the HTTP_REFERER URL.

But, given that they must already have your card number in order to turn up on the list, this isn't actually a problem.
Re:How many of you... by pi+radians · 2004-09-01 01:59 · Score: 1

Google stores all searches somewhere ?

Yup. Everything you search for is recorded.

--

sin(6cos(r)+5A)
Re:How many of you... by drtomaso · 2004-09-01 02:55 · Score: 1

Some people objected to giving me their number to do a search for them, so I had them give me the number before and after, sequentially, so I could do a "range" search. They were happy to learn their number was secure.

Oh...also... anyone know if they throw in free floor mats on Jaguars?
Re:How many of you... by br0ck · 2004-09-01 03:01 · Score: 1

Unless it's just a page listing 10,000 digits of pi.
Re:How many of you... by sabNetwork · 2004-09-01 06:23 · Score: 1

There's a (slightly) more secure way to do it.

If your number is 1234567890123456, google:

1234567890000000..1234567890999999 --
Re:How many of you... by buck_wild · 2004-09-01 10:47 · Score: 1

What I don't get is...even if I have a credit card number that I've found in the internet, how exactly could I order goods with it?

I mean, if I order a new drive or something, now they have my address. Most places will not deliver to a PO box, right?

--
If all you have is a hammer, everything looks like a nail.
Re:How many of you... by Dr.+Hok · 2004-09-01 22:05 · Score: 1

No need to give away an address. My mother-in-law's visa card was charged for a lot of CDs she allegedly bought in a shop (of the physical kind) in New York. She could prove that she was on the other side of the Atlantic at the time.
Don't know how they did it.

--
Say out loud: I'm an Aspie and I'm somewhat proud, I guess. Uh. Can I write an email in all caps instead? Hm...
Re:How many of you... by buck_wild · 2004-09-02 10:50 · Score: 1

Interesting. Sorry to hear about that...

--
If all you have is a hammer, everything looks like a nail.

This is supposed to be wrong? by Epistax · 2004-09-01 00:20 · Score: 2, Insightful

Having google blocked (presumably from google's end) from this is just security through obscurity. Well it's not even that really, it means there is (1) stuff available in plain text which is a part of a website's (2) public access AND (3) for one reason or another has searching enabled. The problem is part 1 and/or 2, the symptom is 3. Cure the problem, not the symptom.

Re:This is supposed to be wrong? by truz24 · 2004-09-01 00:30 · Score: 1

You are 100% correct. But I think the general consensus here is that Google should cover their tracks so they do not get in trouble, or get hassled. In my opinion, they should keep tabs on data exploits like these and remove them. But I do agree, the people that have this data should be responsible. I mean hell, all they have to do to keep google out is use robots.txt...
Re:This is supposed to be wrong? by multimed · 2004-09-01 06:49 · Score: 1

I expected the article to sensationalize things and blame Google but the author didn't remotlely do this. He made it explicitly clear:
Of course, there's no problem here with Google. There's a problem with users and administrators putting sensitive data out where Google can find it.
However, I think it would be a good thing for Google to choose to block certain search features like blocking the number range feature for numbers that clearly are credit card numbers or turn off the ability to search for quicken files. They should be able to do it in such a way that they can make things more secure without taking away legitimate usage. Does this solve the problem? Most certainly not, as you say the problem is that private information is publicly available--Google only makes it easier to find which is only a symptom. The thing is--making the information easier for people to find and do bad things with doesn't do anything to fix the problem either. By all means, try to fix the real problem, but there's nothing wrong with addressing the symptoms too--so long as every is clear that they are just symptoms.

--
Vote Quimby.

Address by Satertek · 2004-09-01 00:20 · Score: 1

If you google your (or someone elses) phone number, you can search for your address.

Was kinda scary the first time I trired it.

Re:Address by Anonymous Coward · 2004-09-01 00:31 · Score: 1, Interesting

But Google provides a link to remove your number and address info. And it works.

N.O. has a nice article on google searches also. by generalbeard · 2004-09-01 00:21 · Score: 2, Interesting

Not getting just credit cards, but other nice little things.. New Order

Same for SSNs by bcarl314 · 2004-09-01 00:21 · Score: 4, Informative

Just tried google for a SSN search as well. Same thing, you get a list of results within that social security number range, along with names, and addresses.

I just can't figure out why people would be victim to identity theft.

Re:Same for SSNs by attam · 2004-09-01 01:19 · Score: 1

whew! i just googled for my SSN and got "-2453"
Re:Same for SSNs by JavaPriest · 2004-09-01 02:13 · Score: 2, Funny

You mean you found a nuclear submarine ?
Re:Same for SSNs by pyros · 2004-09-01 02:15 · Score: 1

I just can't figure out why people would be victim to identity theft.

It's not as calculated a crime as you might think. There are three pieces of information to identify you: name; date of birth; and social security number. When some service company asks for your social security number there's no verification on the information you provide. So people can just make up a number, run up a big bill and leave it unpaid. This happened to me. When signing up for new service, I received a letter stating I owed them seeral thousand dollars. I called to report I never lived at the address on the letter, and the guy I spoke with noticed (not sure why the computer didn't) that the name/date of birth were different and cleared me in their system. I ended up calling local police, secret service (i forget who told me to call them think it was the local police), social security (in case the guy was making claims using my SS#) and the credit bureaus. Remarkably, my credit report was unaffected. Frustratingly, none of the government offices had any real reaction.

The problem with identity theft is that it's rediculously difficult to clear your name in 'the system.' I know someone who's record will forever have prostituion and drug charges due to her sister constantly giving cops her name instead. It's at the point where it's easier to get a new identity than it is to clear yours.
Re:Same for SSNs by caveat · 2004-09-01 04:34 · Score: 1

yeah, but it's just a fast attack sub. the boomers with all the cool nuclear weapons are SSBNs.

--

Facts do not cease to exist because they are ignored. - Aldous Huxley
Re:Same for SSNs by El · 2004-09-01 05:31 · Score: 1

Hmm... apparently my SSN is a valid telephone number in Italy!

--
"Freedom means freedom for everybody" -- Dick Cheney

Politics will be very different in twenty years... by Short+Circuit · 2004-09-01 00:22 · Score: 1

...as a result of blogs. The stuff I've posted in my various blogs would pound me to a paste in any sort of political election.

For now, it'll only be the foolish adult politicians who say things in their blogs that will come back to haunt them in their careers. Combine kids and blogs, and you'll have a public record of your childhood behavior.

--
tasks(723) drafts(105) languages(484) examples(29106)

Time to join the 21st Century by WallaceSz · 2004-09-01 00:22 · Score: 5, Insightful

Information on the internet is publicly available. Google simply makes it easier for people to find publicly available material. Same for third party apps like Google Alert that allow you to search on a regular basis for certain terms.

Obfusacation may have allowed people to be sloppy with their data exposure until now. But that is no excuse for people being lax with their own data security.

The Internet is built by it's users. The responsibility for protecting data lies squarely with the users at the edges.

W00t! by tgd · 2004-09-01 00:22 · Score: 5, Funny

Just ordered a computer that can actually play Doom 3!

Thanks Slashdot!

Re:W00t! by anticypher · 2004-09-01 05:24 · Score: 2, Funny

You mean you found a screen where the brightness control goes up to 11?

the AC

--
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on

Comment removed by account_deleted · 2004-09-01 00:23 · Score: 4, Insightful

Comment removed based on user account deletion

on the google link in this article... by generalbeard · 2004-09-01 00:23 · Score: 2, Interesting

Check out the cached version of the third link and look in the text box. Hopefully it's not any of you... google link

Re:on the google link in this article... by Launch · 2004-09-01 01:05 · Score: 1

Wouldn't it be nice if someone called each of these people to let them know their creditcards and private information have been comprimised on the internet. I'd do it but our phone system is down right now.

--
Your mammas flamebait.
Re:on the google link in this article... by SomeoneGotMyNick · 2004-09-01 01:41 · Score: 1

I'd do it but our phone system is down right now

That phrase was probably meant as a funny comment. Even if it wasn't, the honest and nice thing to do would be to take time out and let the person know. Unfortunately, since the "Good Samaritan" idea is now all but completely ignored. you'd get caught in the middle after the person panics and calls authorities. If you can't explain to them the issue from a security point of view, you might get blamed for putting the stuff up yourself for whatever illegal purposes the authority's minds can conjure up (blackmail, etc.)

Maybe a long but well documented letter (almost a lesson in internet security with real life examples) to the person would serve best if you are still willing to be the good samaritan.

Terrifying by corby · 2004-09-01 00:24 · Score: 5, Interesting

I had trouble believing this, so I downloaded one of the .QDF files from the referenced link. I am feeling completely sick. This guy's checking account number, credit card number, and meticulously-maintained transaction history are sitting on my computer.

It's way too late to warn these people about the files. Their current identity is toast. So is their credit for the next seven or so years.

Is there anything we can advise these people to do to minimize the damage at this point?

Re:Terrifying by flossie · 2004-09-01 01:09 · Score: 1

It's way too late to warn these people about the files. Their current identity is toast. So is their credit for the next seven or so years.
Nevertheless, e-mailing the files back to them might help them to learn. Bank and card numbers can be changed before they do any damage if done soon enough. As for the transactions, their best bet would probably be to but up lots of falsified files to reduce the signal to noise for anyone trying to read them.

--
flossie
Write now. Defend liberty
Re:Terrifying by zoeblade · 2004-09-01 01:15 · Score: 3, Insightful

Is there anything we can advise these people to do to minimize the damage at this point?

That's a nice thought, but how can you word it so it doesn't sound like you're either threatening them or selling them something? People have been called illegal hackers for trying to help other people out by pointing out blatantly obvious security holes before.
Re:Terrifying by ishark · 2004-09-01 01:22 · Score: 1

Actually, I was surprised to see that the QDF file search only gives 24 hits. I had expected at least 100 times more.....
Re:Terrifying by stupid_is · 2004-09-01 01:35 · Score: 1

a) This is scary for those poor ignorant fools
b) slightly better is the knowledge that the main sites with this info have now been slashdotted so the info is *slightly* better protected now :-)
c) unfortunately they will now suffer a barrage of well-meaning emails/phone calls informing them that their info is insecure and will end up having their emails & phones slashdotted (do we slashdot phones?)
I'll do my bit and not inform them

--
-- Intelligence is soluble in alcohol
Re:Terrifying by Epistax · 2004-09-01 01:48 · Score: 1

Tip #1: Don't go "Hey Bob, look what this guy has!"
Re:Terrifying by hugesmile · 2004-09-01 01:48 · Score: 2, Interesting

Here's an idea:
Notify them via a phone call, using the Relay phone system for the deaf.
Not exactly a good use of the service that we all pay for, but it's fairly anonymous, and you can be non-threatening.
Re:Terrifying by Just+Some+Guy · 2004-09-01 05:38 · Score: 1

Anonymously, of course.</plug>

--
Dewey, what part of this looks like authorities should be involved?
Re:Terrifying by MrScience · 2004-09-01 05:48 · Score: 1

Years ago, I scanned for local open ports on my network segment (I was trialing a microwave "broadband" system in AZ). Finding a few, I came across a password-protected share named "C" with the description "John's Drive". The password was, of course, "John". (duh?)

I printed a sheet of paper on his (also shared) printer saying "Just an FYI: You really need to pick a better password for your shared drive."

--
You quitting proves that the karma kap worked. The most annoying of the whores shut up. --CmdrTaco
Re:Terrifying by hicksw · 2004-09-01 06:09 · Score: 1

I tried a range that matched the start of my gold card. Some of the original pages have been pulled, but the data is still available in the google cache.

Terrifying indeed.

check this out ! by phreakv6 · 2004-09-01 00:24 · Score: 1

Hoping to find thousands of results i did this ;)

--
fifteen jugglers, five believers

A couple more fun examples: by Anonymous Coward · 2004-09-01 00:24 · Score: 5, Funny

Don't publish this on ... hey!

Who needs P2P?

Re:A couple more fun examples: by strider44 · 2004-09-01 01:30 · Score: 1

Thanks for the second one - my bandwidth will be full tonight!
Re:A couple more fun examples: by wikdwarlock · 2004-09-01 01:32 · Score: 1

More importantly... pr0n!

--

"I must not fear. Fear is the mind killer." -Bene Gesserit Litany Against Fear
Re:A couple more fun examples: by zoeblade · 2004-09-01 01:33 · Score: 2, Informative

"index of mp3 parent directory" may be a bit more accurate, as the phrase "parent directory" appears on FTP sites being rendered as HTML. Of course, the same applies to ROMs and pr0n0r as well :)
Re:A couple more fun examples: by zoeblade · 2004-09-01 01:38 · Score: 3, Informative

Ah, perfected :)

"index of mp3" "Parent Directory" -filetype:html -filetype:asp -filetype:php -filetype:htm -filetype:shtml

It works quite well :)
Re:A couple more fun examples: by RabidMonkey · 2004-09-01 06:55 · Score: 1

looks to me like the sun.

kind of cool actually .. good find.

--
We emerge from our mother's womb an unformatted diskette; our culture formats us. - Douglas Coupland
Re:A couple more fun examples: by ogewo · 2004-09-01 10:46 · Score: 1

I much prefer "index of mpg" "asian directory"

Sweet! by sigaar · 2004-09-01 00:25 · Score: 1

Now I can afford that new notebook after all!

--
sigaar

I've always liked this one... by ImaLamer · 2004-09-01 00:26 · Score: 1

I believe it was covered on Slashdot before...

However search Google for cool stuff like:

"Index Of" "My Documents" "Last Modified"

You can see plenty of people's documents, about 1300 or so results.

Linux is less fun:

"Index of" "/etc" "Last Modified"

What can you do with this though?

--
Get your Unix fortune now!

Re:I've always liked this one... by ImaLamer · 2004-09-01 00:29 · Score: 1

Found a cool "guide" to these types of things:

http://gray-world.net/etc/passwd/googletut1.txt

(BTW, the last link I posted above is a honey pot for those of you still trying to do something... he he)

--
Get your Unix fortune now!
Re:I've always liked this one... by colinleroy · 2004-09-01 00:49 · Score: 1

What can you do with this though?

Not much:
This is the honey pot ..or honey page.
Thanks to this paper author for the honey page idea.
Thanks to Google developers for the query string into the HTTP Referer field.
Learn more about google hacking at johnny.ihackstuff.com.

--
blah
Re:I've always liked this one... by ImaLamer · 2004-09-01 01:33 · Score: 1

I know...

--
Get your Unix fortune now!

Comment removed by account_deleted · 2004-09-01 00:27 · Score: 1

Comment removed based on user account deletion

Comment removed by account_deleted · 2004-09-01 00:27 · Score: 2, Informative

Comment removed based on user account deletion

The funniest part... by Fortress · 2004-09-01 00:27 · Score: 4, Funny

of the VISA/Google search is that VISA is a sponsored link. Kind of like Microsoft advertising on a website that bashes it for its security holes...wait a minute...

Re:The funniest part... by JFMulder · 2004-09-01 00:49 · Score: 1

The funniest part
Kind of like Microsoft advertising on a website that bashes it for its security holes

Actually no. It's pretty clever. They know there are a lot of people who are in the industry who read slashdot. Not all of them are Microsoft haters and work exclusively on Linux, so there's a market opportunity for that.
Re:The funniest part... by Fortress · 2004-09-01 01:01 · Score: 1

True, true. Ther's also the fact that you don't convert anyone by preaching to the choir, only by going out among the heathens. At the very least, the Microsoft ads will grate on the anti-MS zealots every time they load Slashdot. If I were an MS advertising exec (I'm not) that would make me smile.
Re:The funniest part... by flossie · 2004-09-01 01:19 · Score: 1

At the very least, the Microsoft ads will grate on the anti-MS zealots every time they load Slashdot. If I were an MS advertising exec (I'm not) that would make me smile.
Anti-MS zealots won't be using Internet Explorer and so, in most cases, won't even see the ads.
Are there any other browsers left which don't make blocking ads simple? It is certainly very unusual for me to see ads on the net (browsing with Firefox+adblocker) and I certainly never see them on sites I visit repeatedly!

--
flossie
Write now. Defend liberty
Re:The funniest part... by Nazmun · 2004-09-01 06:28 · Score: 1

If only everyone used adblockers, small and large webpublishers be damned.

--
Hmmm... Pie...

Re:only few matches by sigaar · 2004-09-01 00:32 · Score: 3, Interesting

Only some of us are fortunate enough to learn from other people's mistakes. The rest of us has to be the other people....

--
sigaar

try this by circletimessquare · 2004-09-01 00:34 · Score: 4, Informative

convert 29 fahrenheit to celsius

or

pi=

or

define: hubris

google's got neat tricks

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it

Re:try this by beaverbrother · 2004-09-01 00:52 · Score: 1

Get rid of the space... PHP Admin Pages Still pretty bad tho.
Re:try this by adavidw · 2004-09-01 00:59 · Score: 2, Interesting

Don't forget "answer to life the universe and everything"

Try it!

-Aaron
Re:try this by maxwell+demon · 2004-09-01 01:08 · Score: 4, Funny

But I didn't find documentation of this at google.

--
The Tao of math: The numbers you can count are not the real numbers.
Re:try this by Spy+Hunter · 2004-09-01 18:32 · Score: 1

I like this one.
I wonder how many other little features Google has hidden away? Their documentation is good, but it doesn't list everything.

--
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}

Google auto index? by Sharp+Rulez · 2004-09-01 00:34 · Score: 1, Funny

I sought for my credit card number on Google.. Is Google indexing our search key words?? Doh!! Now everybody can find my creditcard!

Re:Google auto index? by colinleroy · 2004-09-01 00:51 · Score: 1

Your CC number may now end up on someone's belt buckle... what an horrific thought, isn't it?

--
blah

You just KNOW... by ScytheBlade1 · 2004-09-01 00:35 · Score: 1

From the google search linked, there's a reason that those forums are crawling. Actually, mine is still trying to connect to the server.

Lot of /. geeks gotta get their pr0n, after all.

The sad thing... by Sinistar2k · 2004-09-01 00:38 · Score: 4, Insightful

The sad thing is that now people will be Googling for their credit card numbers to be sure they're 'safe', but doing so means their credit card number will show up in the list of things people are Googling.

Re:The sad thing... by TheLink · 2004-09-01 00:57 · Score: 2, Insightful

The other sad thing is people actually think it's such a big risk to cardholders.

Without the signature a cardholder can repudiate the transaction. So if you didn't buy the stuff, just tell the Issuing Bank that you didn't and just don't pay for that transaction.

Then either the Merchant loses or the Bank loses. You, the cardholder don't unless you use a crappy card company that charges you to reissue a new card. Of course there's the inconvenience of being short of one usable credit card. But it's not as big a disaster to cardholders as some people make it.

In short with credit cards, if anything happens it's mainly SOMEONE ELSE's money involved NOT yours. Whereas cash, debit cards, cheques are riskier. Coz if anything happens - it's YOUR money.

So many people are ignorant of this and say stuff like "Buying stuff online with your credit card? Is that safe?".

It's selling stuff online that's risky. You ship goods, cardholder says "nope not me", and EVEN if cardholder screws up and forgot, you LOSE.
--
- Too many replies beneath your current threshold
Re:The sad thing... by ralphb · 2004-09-01 01:05 · Score: 1

Shouldn't be a problem for the cautious. You can use the range search feature to narrow the search to, say, the first 8 digits. i.e., "5398600600000000..5398600699999999". This will still protect your number.
Re:The sad thing... by Paulrothrock · 2004-09-01 01:37 · Score: 1

This will still protect your number.
Yeah, until someone tries all 100,000,000 numbers and finds a few that work! Never underestimate the determination of a script kiddie who want's a 1337 PC.

--
I'm in the hole of the broadband donut.
Re:The sad thing... by mailseth · 2004-09-01 01:43 · Score: 1

The sad thing is that now people will be Googling for their credit card numbers to be sure they're 'safe', but doing so means their credit card number will show up in the list of things people are Googling.

So google for half of the number. The other half will be impossible for anyone to find if it isn't already out there.
Re:The sad thing... by Eccentrica+Galumbits · 2004-09-01 01:56 · Score: 3, Funny

no probs, I just googled for 5454178568431210..5454178568431212. Anyway, this thing expires the end of next month. Anyone know what that 481 on the signature strip is for?

--
A N Other.
Re:The sad thing... by ibennetch · 2004-09-01 02:09 · Score: 2, Informative

It's some sort of extra protection measure that isn't encoded in the magnetic strip and therefore needs to be entered manually...not used all of the time but when it is used it prevents someone from using a magnetic cardswipe to steal your number...the credit card company knows that number and sometimes requires it for authorization
Re:The sad thing... by Electrum · 2004-09-01 02:14 · Score: 2, Insightful

Then either the Merchant loses or the Bank loses.

No, the merchant loses. The bank never loses.
Re:The sad thing... by Idarubicin · 2004-09-01 04:18 · Score: 1

Then either the Merchant loses or the Bank loses. You, the cardholder don't unless you use a crappy card company that charges you to reissue a new card. Of course there's the inconvenience of being short of one usable credit card. But it's not as big a disaster to cardholders as some people make it.
In short with credit cards, if anything happens it's mainly SOMEONE ELSE's money involved NOT yours. Whereas cash, debit cards, cheques are riskier. Coz if anything happens - it's YOUR money.
Two points--first, the direct loser is the merchant. The bank (almost) never eats a fraud-related loss, because the merchant (supposedly) should be doing a better job of verifying the identity of the purchaser.
Second, except in extreme cases the merchant doesn't just suck up the loss and declare bankruptcy. It comes back to the rest of us in the form of higher prices. All the rest of us using that product or service get screwed because the original cardholder didn't bother to protect his card. The original cardholder may not even be on the hook, if the fradulent purchase is of something the cardholder doesn't ever use. It's related to the tragedy of the commons--in this case, the cardholder enjoys protection from fraud despite having made little effort to secure his information, but a large portion of society has to suck up the loss.

--
~Idarubicin
Re:The sad thing... by ibennetch · 2004-09-01 07:50 · Score: 1

Don't have much of a sense of humor, do you?
Well, Mr. Coward, I'll shamefully admit that I didn't get the joke until after you pointed it out to me...I've been had, and now my embarassment will live forever in the slashdot archives. Fortunately I haven't lost the ability to make fun of myself even though I seem to be a bit humor impaired today.
Re:The sad thing... by TheLink · 2004-09-01 14:05 · Score: 1

" It comes back to the rest of us in the form of higher prices."

Over here most PC shops charge 2 or 3% more if you use credit cards. I can accept that - selling PC stuff = low margins, but that shows that the "higher prices" bit isn't really that high (there's already high fraud in my country) - enough transactions are good to not make them charge 10% more.

Whereas if they introduce PINs (or more "secure" systems), do you think they're going to make prices 2 or 3% cheaper?

It's bullshit. The card companies are still going to take their 2-3% cut. And there'll still be fraud, but this time the card company and banks are going to insist it's your fault (or the Merchant's).

They're just trying to con the masses into believing the present system is ultra dangerous etc etc, so that the masses will play right into their greedy hands. Just like the RIAA conning the public into thinking copying = stealing.

They're already screwing the Merchants anyway - often the Merchant can't do a better job coz the entire card is a good fake - signature, photo etc. But the Issuers say the signature on the receipts don't match their records and say it's the Merchant's fault.

With "better systems" they'll start screwing the Cardholders as well.
--
- Too many replies beneath your current threshold

Free music by Mr_Silver · 2004-09-01 00:39 · Score: 1

Don't tell the RIAA but searching for:

"Index of" mp3

gives you access to rather a lot of files. You can also replace mp3 with various other suffixes for added fun.

Don't forget that removing the filetype and including "site:yourdomain.com" will allow you to quickly check if any of your folders are visible to the world that shouldn't be.

--
Avantslash - View Slashdot cleanly on your mobile phone.

on the right track, except for... by ecalkin · 2004-09-01 00:41 · Score: 1

A lot of people can't/won't learn. I cross paths with people who don't want to know a damn thing about computers, they just want you use them.

I think the future model that works is that people will have to get 'experts' to do the tough stuff. Security, performance, reliability, etc. Everything the saleweasel said was automatic.

eric

Re:on the right track, except for... by RsG · 2004-09-01 00:50 · Score: 2, Insightful

Well that gets us back to the free market correcting itself. I would ask you though if that's necessarily a good thing.

Remember Microsoft? Corporate giant, kinda unethical? Their producs are notoriously unsecure, and yet people still use Windows/IE/Outlook. Why? Because free market economics don't work in a corporate dominated environment. We don't have free market capitalism, we have corporate monculture, and it's notoriously unreliable for producing good, solid, honest products. Instead we get salesweasels shovel^H^H^H^H selling producs that don't work as advertised. Better alternatives are quashed, or relegated to the open source community (which is good, but lacks an R&D budget). I think you're being overly optimistic.

--
Erotic is when you use a feather. Exotic is when you use the whole chicken.

eBooks by upside · 2004-09-01 00:42 · Score: 2, Interesting

Another good one is searching for copywrite phrases found on front pages of eBooks such as O'Reilly CD Bookshelves. People seem to put up their eBooks for their own convenience. OTOH publishers seem to be doing a bit of Googling of their own, as they tend to be taken down pretty soon. Nothing that a quick WGET won't handle...

--
I'm sorry if I haven't offended anyone

Re: additionally by BitterAndDrunk · 2004-09-01 00:42 · Score: 2, Informative

A post like the grandparent highlights the gap between tech savvy and those who aren't.

Guess what - someone who isn't a /. reader is:

Probably the ones most vulnerable to Google mining (for lack of a better term)

The ones least likely to know what a robots.txt is, what it does, and how to utilize it to prevent stuff like this.

/. readers for the most part are paranoid and cautious enough to minimize their risk of exposure on the net (even without robots.txt) - it is the group of users (increasing every day mind you) who are semi-literate and don't have the time or inclination to become well versed in security on the net. And really, who can blame them? Most of them don't embrace computers the way many here do and view them as a necessary evil that can occasionally help them find pornography.

--
You better watch out, there may be dogs about . . .

Introducing... by Gleng · 2004-09-01 00:45 · Score: 4, Funny

Norton DumbWall 2004

Featuring:

VisaBlock: Keep your credit card information off of the Internet
NoShare: Safeguard your banking details and MP3s from prying eyes
PackAway: If you're deemed to be too stupid to own a computer, Norton DumbWall 2004 will format your hard drive and arrange for one of our qualified technicians to come over to your house and take your computer away. It's for your own good.

Order now and get a free drool-bib.

--
"Proudly Posting Without Reading The Article"

Dammit! by beaverbrother · 2004-09-01 00:47 · Score: 5, Funny

Thats my credit card number!

Re:Dammit! by Anml4ixoye · 2004-09-01 02:19 · Score: 5, Funny

Thats my credit card number!
-------

Get a free ipod! [freeipods.com]

Thanks! Just did!

--
Random Musings

My favourite.. by Haydn+Fenton · 2004-09-01 00:49 · Score: 4, Funny

"index of /admin" site:.gov

Pwned!

Re:My favourite.. by Placido · 2004-09-01 01:37 · Score: 3, Funny

You should have put a link to the results up. All you do is put that search into the google search box, hit enter and copy the url from the.... hold on there's FBI cars outside and someone's knocking on my door. I think my neighbour is getting busted. brb.

--

Pinky: "What are we going to do tomorrow night Brain?"
Brain: "I would tell you Pinky but this 120 char limi
Re:My favourite.. by vinlud · 2004-09-01 04:44 · Score: 1

What do you think of "index of /admin" nuclear site:.mil ?

--
Repeat after me: We are all individuals
Re:My favourite.. by Reziac · 2004-09-01 10:18 · Score: 1

Your search - "index of /admin" nuclear site:.mil - did not match any documents.

Now look, you broke it! ;)

--
~REZ~ #43301. Who'd fake being me anyway?
Re:My favourite.. by Cow+Jones · 2004-09-02 04:08 · Score: 1

Your search - "index of /admin" nuclear site:.mil - did not match any documents.
... Did you mean nucular?
scnr

--

Ah, arrogance and stupidity, all in the same package. How efficient of you. -- Londo Mollari
Re:My favourite.. by Reziac · 2004-09-02 05:17 · Score: 1

That must be it... them durn hifalutin' words no one knows how ta spell, much less pernounce..

(Speakin' o' fancy words, is the Cow Jones the commodities index? :)

--
~REZ~ #43301. Who'd fake being me anyway?

try this by bunburyist · 2004-09-01 00:50 · Score: 1

http://www.google.ca/search?hl=en&ie=UTF-8&q=Welco me+to+phpmyadmin&spell=1

This could be good by phoey · 2004-09-01 00:50 · Score: 2, Informative

This could be good in finding websites that illegally publish this content.

With this search in google:
Mastercard 5000000000000000..5999999999999999

I found this russian site that published American credit card information with expiration dates, names and addresses:

http://kupi-cc.0golf.com/halyva.htm

Scary stuff. I would prefer google to find this information so that I can type in a simple query and see where my information is being wrongly published then not knowing at all.

Re:This could be good by pclminion · 2004-09-01 04:57 · Score: 1

I would prefer google to find this information so that I can type in a simple query and see where my information is being wrongly published then not knowing at all.
You mean you'd type your credit card number into Google? Are you insane? Now you've sent your CC number in the clear over the Internet. To Google, which has a big scrolling display of searches in its corporate headquarters. I think I'll head over to the Google lobby and wait to see your CC number scroll past.

what an attitude by Anonymous Coward · 2004-09-01 00:53 · Score: 2, Informative

I'm surprised at how easily you guys assume other net users are simply so dumb? Let's be a bit more humble and take any news/comment with a grain of salt. If you try the search suggested, you'll see some sites were russian forums exchanging credit card numbers they illegally obtained.

Besides, who would ever take the time to post one's own credit card numbers on the net? It's dumb to assume someone did that by themselves, frankly. I can only imagine someone might got card lost and the number got into those illegal forums, or someone put the number in an email to CS representative and the email got put into FAQ, or scenarios like that.

P2P is Worse by deebaine · 2004-09-01 00:54 · Score: 5, Interesting

On a lark, I've tried searching P2P (in this case, Kazaa), for things that people have inadvertently made available. The things I found were jaw-dropping. Beyond the expected credit card and finance information, I found patent applications, doctoral dissertations, corporate documents, etc.

I'm pretty laissez faire on this one. If you leave your keys in the car and car running, the insurance company won't cover its theft (or at least, so goes the lore). Same principle applies here, I think.

-db

Re:P2P is Worse by Zebbers · 2004-09-01 01:24 · Score: 1

If you leave your keys in, the car running and TELL them so...they won't cover it.

If you tell them, then you deserve the loss.
Re:P2P is Worse by Slayer · 2004-09-01 03:08 · Score: 2, Interesting

First: If you steal a car which has the key left in it and which is running, it's still punishable by the law.

Second (just a detail): If I had P2P running on my home PC, I'd post my doctoral thesis. It is published anyway (just check out your favourite universities' library), I don't earn money from selling it (in fact, you can find it online), so why not use P2P to distribute it. Hey, that's supposedly the official justification for P2P, not illegal MP3s!
Re:P2P is Worse by Ogre332 · 2004-09-01 03:41 · Score: 1

First: If you steal a car which has the key left in it and which is running, it's still punishable by the law.

here in Maryland, leaving your keys in the ignition is also punishable by law. They figured the best way to crack down on Auto Theft was to fine the owners of vehicles for making it easier and more tempting for theivesto steal.

--
Shut up brain or I'll stab you with a Q-Tip. - Homer Simpson
Re:P2P is Worse by xmpcray · 2004-09-01 03:44 · Score: 1

I'm pretty laissez faire on this one. If you leave your keys in the car and car running, the insurance company won't cover its theft (or at least, so goes the lore)

...but, you stealing the car is still a crime.

--

--
I refuse to answer that question on the grounds that I don't know the answer.

Suppositions by AviLazar · 2004-09-01 00:54 · Score: 3, Informative

This person uses a lot of (paraphrase) "I haven't seen it myself, but I am sure real numbers are there."

Unless this person can site a real case then all he did was show us test files (as he claims he has seen)

--

I mod down so you can mod up. Your welcome.

Re:Trouble by smooth+wombat · 2004-09-01 00:54 · Score: 1, Informative

NOT WORK SAFE!

NOT WORK SAFE!

NOT WORK SAFE!

Gah! And I here I thought I wouldn't be so stupid as to not realize what kind of link that would be.

(pounds head on desk repeatedly)
(no one notices since it's part of my job requirement)

--
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower

Really? by Jon.Laslow · 2004-09-01 00:54 · Score: 1

When you install the Google Toolbar, you have the option to disable the tracking options. Check out Google's Privacy Statement for the Toolbar

Within a couple of minutes of someone viewing a URL that was private and only meant for them with a browser with the google toolbar installed the googlebot will come along to the site and grab the file for indexing. Nasty if you're not expecting it.

But if you read everything like you're supposed to when installing something, you won't need to be surprised by it.

Re:Really? by AndroidCat · 2004-09-01 01:13 · Score: 1

But if you read everything like you're supposed to when installing something, you won't need to be surprised by it.
But did the good friend that you passed the URL to (for his eyes only) also read the instructions when installing the Google Toolbar? (And did he clean off any Gator-like spyware that is also going to snitch?)
Three men can keep a secret ..

--
One line blog. I hear that they're called Twitters now.

Next Generation Shopping Cart Software by wackysootroom · 2004-09-01 00:55 · Score: 1, Funny

This doesn't have to be a bad thing. Imagine the positive applications of this knowledge in the area of web forms. Most membership/shopping cart sites have a link that you can click to retreive your password in the event that you forget it. Soon, shopping carts will have a link that you can click if you forget your card number and it'll look like this:

Forgot your credit card number? Click Here

Re:Next Generation Shopping Cart Software by Colonel+Cholling · 2004-09-01 01:31 · Score: 1

The security problems inherent with this are legion: if I can retrieve my own "forgotten" credit card number, I can retrieve someone else's. But then that's about what I'd expect from someone who advertises a pyramid scam in his .sig.

--

I am Sartre of the Borg. Existence is futile.

Some of them plants? by tekiegreg · 2004-09-01 00:55 · Score: 5, Insightful

At this point if I were someone looking for a free credit card, I'd probably go at least a few down in the results, I'd like to think that the top 20 or so are plants by law enforcement by now...at least I'd hope...

--
...in bed

Re:Some of them plants? by hackstraw · 2004-09-01 01:40 · Score: 1

At this point if I were someone looking for a free credit card, I'd probably...

go through the trash at a restaurant or gas station and look at the receipts. Its a little more blue collar, but I'm guessing its safer and easier than "finding" the same information that billions of people have easy access to.
Re:Some of them plants? by pipingguy · 2004-09-01 02:45 · Score: 1

Good observation. If I were a cop that's what I'd do.
Re:Some of them plants? by multimed · 2004-09-01 03:01 · Score: 1

I was going to say that this is why they don't print the full credit card number on receipts anymore but a quick audit of my wallet shows that of the dozen or so receipts I had, 3 printed the full credit card number on the receipt. Bad bad bad. There's really no reason for that.

--
Vote Quimby.
Re:Some of them plants? by rfc1394 · 2004-09-01 03:39 · Score: 1

I was going to say that this is why they don't print the full credit card number on receipts anymore but a quick audit of my wallet shows that of the dozen or so receipts I had, 3 printed the full credit card number on the receipt. Bad bad bad. There's really no reason for that.
I wrote an order processing system for a local building concierge company to replace the DOS-based one they have. When it prints out the receipt, if they use a check or money order it prints the full number, but if they use a credit card it only gives the card name and the last 4 digits. The clerk can read it on screen if they need to verify it but it won't print out anything but the last 4 digits.
Also, some U.S. states mandate that receipts for credit cards only include last 4.
Some places are simply printing a transaction number and bar code on the receipt, which then allows the system to look up the original transaction, and as a result they don't even need your old credit card to issue you a refund if you bring something back. And it knows whether you paid cash, by credit card, stored card or gift card. Home Depot does a nice job with their system. Now that is an example of a good use of storing personal information, where it gives the customer MORE privacy, since even the clerk doesn't see or know the customer's credit card number, only the database does.

--
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.

Aye, Robots by WateryGrave · 2004-09-01 00:57 · Score: 1

I hope everyone knows that google (and other spiders) can be blocked rather easily.

See the URL below for a robots.txt tutorial:
http://www.searchengineworld.com/robots/robots_tut orial.htm

It is still possible to share files on a web server without search engine exposure.

MySQL by Fuzzums · 2004-09-01 00:58 · Score: 1

Looking for

Welcome to phpMyAdmin x.x.x

MySQL x.x.x-log running on localhost as root@localhost

or parts of it can also be fun.

I'm not sure about legal stuff, but if you were not supposed to have access, there would be a password, I'd think...

--
Privacy is terrorism.

Re:MySQL by ajs318 · 2004-09-01 04:14 · Score: 1

That's normal. You should protect your phpmyadmin with a .htaccess file. Of course, for .htaccess to work, you also have to modify your httpd.conf, because it most probably has "AllowOverride none" turned on globally.

"root" and no password is misleading. It is in the default configuration for mysql, but it only works from localhost.

Much less secure is a situation I encountered on a site with a certain hosting company who will not be named and shamed here. A friend of mine set up a site with them before I could warn him off. Well, basically they have a separate SQL server than their web servers, but the mysql usernames and passwords are the same as the linux usernames and passwords. And not only that, but I was able to connect to their server from my own machine! While it was nice to be able to work on his DB with my own phpmyadmin, it's more than a little worrying that their firewall doesn't block off 3306. Especially as the same company also offers MS hosting packages, and if they're as sloppy with those as they are with their linux ones .....

The password coincidence is deeply worrying, because all you need to do is get a hosting account on their server; then it's trivial to read any other user's files, including their mysql passwords -- which are the same as their linux paswords.

--
Je fume. Tu fumes. Nous fûmes!

good uses... by polyp2000 · 2004-09-01 00:59 · Score: 1

I have recently found google to be great for finding .torrents

eg
red-hat torrents

or

fonts

other filetype's that work .mp3, .pdf --- just about anything you can think of in fact..

--
Electronic Music Made Using Linux http://soundcloud.com/polyp

DoH! by Programmer_In_Traini · 2004-09-01 00:59 · Score: 1

DoH! didn't think about that ....

ehhehehe

actually, I didn't input the entire number, I omitted the last four.

--
If you look like your passport photo, you're too ill to travel. - Will Kommen

Re:DoH! by Jugalator · 2004-09-01 01:04 · Score: 2, Informative

actually, I didn't input the entire number, I omitted the last four.

In that case you won't find it even if it was there. Google uses exact matches, so 1234 won't match 123456789.

--
Beware: In C++, your friends can see your privates!
Re:DoH! by Programmer_In_Traini · 2004-09-01 01:45 · Score: 1

Heh, then I'll call it a close call, its better not to find partial matches than one exact match.

--
If you look like your passport photo, you're too ill to travel. - Will Kommen
Re:DoH! by Abcd1234 · 2004-09-01 04:41 · Score: 1

Unless, of course, he read the article, in which case he would use a range search of "12340000..12349999", and then start browsing...

Oh man... by Jugalator · 2004-09-01 01:00 · Score: 1

This one was just crazy!

--
Beware: In C++, your friends can see your privates!

AVS by barcodez · 2004-09-01 01:02 · Score: 2, Informative

Any website that accepts credit card payments worth using will require an AVS number and address.

As for coding these numbers on to other cards and using them in bricks and mortar shops, you would hope that the shops check that the embossed number matches. If they have checked all this, under UK law anyway, the CC company is liable.

With chip and pin cards being introduced across Europe CC numbers are becoming more and more useless to criminals now.

--

----

robots.txt by Anonymous Coward · 2004-09-01 01:03 · Score: 1, Insightful

Hasn't anyone heard of using a robots.txt to block web spiders? If people are stupid enough not to, then their hidden data is just asking to be found by anyone. Thats my 2 cents.

Re:robots.txt by pclminion · 2004-09-01 04:54 · Score: 3, Insightful

Hasn't anyone heard of using a robots.txt to block web spiders? If people are stupid enough not to, then their hidden data is just asking to be found by anyone.
I can't tell if you're being ironic or just stupid.
You're suggesting that you "secure" you sensitive information by listing where it is in robots.txt? I think I want to have a look in your robots.txt, now.
The purpose of robots.txt is not to secure your information, it is to avoid getting eaten alive by bandwidth-hogging search spiders, and to prevent spiders from indexing irrelevant or out of date information.
If you want your information to be secure, here's a hint: don't put it on a fricking web server.

Using Google by zoeblade · 2004-09-01 01:05 · Score: 1

Try this one, for "Visa 4366000000000000..4366999999999999'

What a great idea, now I can read the cached version of the article while the original gets Slashdotted :)

LOL by circletimessquare · 2004-09-01 01:05 · Score: 1

that's pretty funny, i never knew that, thanks ;-)

i see they got Douglas Adams fans at google! ;-P

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it

Re:Politics will be very different in twenty years by VDM · 2004-09-01 01:06 · Score: 1

Not only blogs. I'm sometimes surprised for what is still available on Usenet archives... I found some post of me back to 1996, by searching with google on groups.

We need to have the right to sue... by Nick+Driver · 2004-09-01 01:10 · Score: 1

...into complete financial oblivion, any 2nd or 3rd party who is careless with our sensitive data.

Mod parent up by beugh · 2004-09-01 01:11 · Score: 1

I guess I don't have any mod points...

Wow /. sure is quick on the uptake by Christianfreak · 2004-09-01 01:12 · Score: 1

This has been talked about on blogs, on the Security Focus mailing lists and at several conferences, at length, for months now.

In fact the searches don't really even work anymore because the results all return articles, stories etc. about how easy it is to find this stuff.

--
The Anti-Blog

There is much more than that... look up for Johnny by CodeMaster · 2004-09-01 01:13 · Score: 1

This has been fairly known and Johnny had great presentations in the last Blackhat and DefCon that really shook you up if you were not aware of the "Power of G"...

Very cool, a lot of very stupid people (from the myPHPAdmin, to the WebDAV-Frontpage passwords, all the way to nessus and ISS scan results...).

get a free ipod! This really works. (Free gmail invite to the ones using this referal and completing the offer!)

Exactly by BlackMesaResearchFac · 2004-09-01 01:14 · Score: 1

Although there may certainly be some egregious privacy issues found by Google search, he provides little solid evidence.

It seems he was far more concerned with making his 5 cents per word than providing a compelling case.

--
-- Scientist: You aren't going to leave me here, are you? Boagh! Thump...

And why it isn't a big deal.. by random_culchie · 2004-09-01 01:15 · Score: 3, Insightful

Yes and they also mentioned that this wasn't as big a deal as people think.
For one the the valid credit cards numbers will be rapidly be made useless as 3rd parties use them and they are cancelled. The bottom line is very few customers will be liable for any of these fraudulent transactions.
The majority of the credit card numbers are on semi underground script kiddy sites. Where they are posted to gain cred or access to pr0n. I'd like to bet that most of these are invalid or the product of a credit card number generator.
Lastly this article implies (and a number of posters here) that the credit card numbersfound are the result of carelessness by credit card holders on the web and therfor it is their own fault. This is not the case. Google did not expose any mass stupidity by internet users, it simply exposed some of the sites that havest credit card numbers.

Gmail by sudotcsh · 2004-09-01 01:17 · Score: 2, Funny

Unfortunately there isn't a good way to search for URL strings like this:

http://gmail.google.com/gmail/a-e00073f786-289e2 6b 40f-c8a84ba388

But once someone figures out a way ... EVERYONE will have Gmail!

--

Until then, five of you can hit me up at kevinomara at gmail.

it's all relative anyway by headblur · 2004-09-01 01:19 · Score: 1

yesterday i walked by an atm machine just seconds after a guy left it - his card was still in the machine and it was at the screen where you can either quit (and get your card back) or carry on another transaction. as i have a guilt complex the state of utah, i got his card out and chased him down the sidewalk.

point being: debit/credit cards are insecure in the real world, too!

Summary by hamlet2600 · 2004-09-01 01:21 · Score: 2, Interesting

Seems that everything, except the personal information posted by a third party, can be summed up by a simple common acronym: RTFM. Ignorance of the law isnt a defense -- neither should be not reading the manual.

--
Sometimes I wish computers were less friendly.

St. Simeon Bot by nigel_atkinson · 2004-09-01 01:22 · Score: 1

It would be nice to think that the smart guys at Visa/MC/Amex/et al have bots crawling search engines for CC numbers and that they immediately cancel any compromised cards.

Watch that blogging by qray · 2004-09-01 01:23 · Score: 1

I happened to run across a guy discussing his career moves and some other somewhat sensitive items. I had put in a couple of company names in Google and up popped his blog.

One should try and be a bit more anonymous or general when blogging.

TWO WORDS!!!!!! by spidergoat2 · 2004-09-01 01:34 · Score: 4, Interesting

"Parent directory". That Google search is the most fun you can have with your clothes on.

Re:TWO WORDS!!!!!! by Zareste · 2004-09-01 02:22 · Score: 1

OMG a lot of people are gonna be mad after I've surfed all their picture indexes. Can't believe I didn't of that.

--
I am NOT a number! I am a - oh wait, I'm number 761710. Look! 761710!
Re:TWO WORDS!!!!!! by Jon+Abbott · 2004-09-01 09:01 · Score: 1

Hey, thanks for the idea... I just found some neat videos of sun flares... Check them out here.

--
Slashdot's first reaction to VMware

So what if there are card numbers on the web... by mrjb · 2004-09-01 01:34 · Score: 4, Informative

There are banks offering special 'web credit card' services. They issue credit card numbers that are valid only for a single transaction. After the transaction has taken place, the number expires. Even if a site would have serious security issues, allowing someone to see all the credit card numbers they ever received from people, these single-transaction numbers would be worthless to anyone finding them. Of course ultimately a website shouldn't ever receive credit card numbers, but instead relay credit card payment to a bank and then communicate with that bank to see if all went well, but that is another issue.

--
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book

I hear you by T-Kir · 2004-09-01 01:40 · Score: 1

The problem is also people who share their entire hard drive contents... email inbox files anyone?

When I used to use Kazaa, I deliberately left two text files in my share directory called 'mastercard details.txt' and 'visa card details.txt', with some colourful language contained within (so they weren't zero byte size)... not surprisingly I got quite a few downloads too! plus I got the satisfaction of them reading my little message (maybe I should have given them some goatse ascii art!).

--
Are you local? There's nothing for you here!

hahaha! by manavendra · 2004-09-01 01:41 · Score: 1

First googleon the link in the article points to a news article on eWeek. The date on the eWeek article ? August 30, 2004

Um... news?

--
http://efil.blogspot.com/

Re:Keys in the ignition by jm2morri · 2004-09-01 01:48 · Score: 2, Interesting

Actually, at least here in Canada, the insurance companies have to cover you even if the keys are in the ignition--theft is theft. I know this because my father just went through getting his truck stolen after leaving the keys in the ignition.

The insurance companies will try to bully you into thinking that they don't have to cover you, but they do. However if they can convince you that they don't have to and you just go away then they don't have to pay you. This is the usual course of action.

Luckily my father has a good insurance broker who knows the law and wouldn't let his client be bullied. Its astounding what insurance companies can get away with.

This of course after them pleading poor to the Canadian government only to report record profits a couple of months later. What's $2.6Billion among friends? Now that is in Canadian funds but it still works out to about $100US or so :)

One-time numbers are key by swb · 2004-09-01 01:48 · Score: 2, Interesting

Which has been done and tried (Amex gave me a smart card reader, Visa has tried 1-time CC numbers picked up their site.

I'd like to see more of that kind of thing, preferrably all of the following as options:

One-time credit card numbers
One-time PIN numbers
Region lock in and lock out, with 'region' being defined as geographically tight as possible and discontiguous region mapping allowed (eg, MN yes, Africa No, with "undefined=no" being the default). And yes, I know this would be tough to guarantee.
Merchant/bank lock-in and lock-out -- either limit to specific merchants or ban specific merchants or banks. My grocery store OK, Paypall not OK
"Good everywhere all the time, with no control at all" just seems like a bad idea. But since banks either shit on the consumer or the merchant when it comes to fraud, they have little incentive to secure the system. When they pass the new bankruptcy bill in congress, even shoddy lending practices will be given a pass as well.

Re:One-time numbers are key by TheRealMindChild · 2004-09-01 02:18 · Score: 1

Unfortunatly, it isnt always that simple. I have had several places that refuse to take one time use numbers... these are places such as Ebay (not exactally Ebay, but give it time), where possible debt can later accumulate, so they have a means to deduct the later fees etc.

How do they do this? Charge whatever you are buying/paying for in two transactions.

--

"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Re:One-time numbers are key by EtherMonkey · 2004-09-01 03:17 · Score: 5, Informative

Actually, American Express used to have (until April of this year) something like a one-time-use account number. It was called Private Payments, and you could generate a new, temporary account number from their secure website. Although it wasn't truly one-time use, it was only valid for 30 days and could be cancelled at any time by the cardmember.
I used it religiously for all on-line, telephone and mail-order purchases until it was discontinued. If a merchant didn't take Amex I'd shop elsewhere.
Now that PrivatePayments has been discontinued, I purchase Visa Gift Cards (pre-paid Visa cards) and use them for my small/medium-ticket on-line purchases. For major purchases I use a Visa card with fraud protection and check the account activity on-line at least once a week.

But in any event, you should never be liable for a fraudulent credit card transaction. That doesn't mean you can be careless with your account information, but if there is a fraudulent charge you're not out any money if you pay attention and dispute the charge within the specified period of time.

The real danger is ACH (Automated Clearing House) transactions against your bank accounts. Any person or organization that has the ability to perform ACH transactions (and there are plenty of third-party processors with low scruples and high tolerence of unethical behavior) can suck money DIRECTLY from your bank account. All they need is your bank routing number and bank account number. They don't need your name, address, phone number or any password or PIN (they are supposed to get your written authorization first, but there's no mechanism to check or enforce this before the fact). There is no verification or fraud protection system for ACH, as there is on most credit cards. The merchant simply asks and he receives.

And unlike credit card disputes, where you don't pay until the dispute is settled, ACH immediately withdraws the money from your account and you have to wait for the dispute to be settled before getting your money back (if ever). Since there are no limits on ACH withdrawals, (other than having sufficient funds for payment), one fraudulent charge can lead to bounced checks, overdraft fees, returned check fees and more, increasing your loss by hundreds of dollars.

There's no mechanism to opt-out of ACH or limit transactions to only approved merchants. Once a fraudulent charge is made you may be able to block further transactions by that merchant, but possibly only for a limited time and with payment of a stop-payment processing fee. The only real relief is to close the account and open a new one (resulting in administrative hassles and costs for new checks and forms).

How hard it is for a bad guy to get your bank routing number and account number depends on how use your checks. The routing and account numbers are required on the bottom of each check. It takes a few seconds for a dishonest cashier, clerk or other employee to copy this info down and sell it later. The lock-box services used by large creditors often convert paper checks to ACH transactions themselves, then discard the paper checks; depending on how discarded checks are handled, they might be subject to unwanted access. Your own handling of unused and cancelled checks also comes into play.
Between credit-card fraud and ACH fraud, its the latter that scares me the most. I've been a victim of unauthorized ACH transactions twice: once through a mistake made by a merchant and just recently through outright fraud. I am still waiting for the return of $100 due to the most recent fraud, and it will cost me more than that by the time I'm done switching to a new checking account.

--
--- A man with a briefcase can steal more money, than any man with a gun. [Don Henley]
Re:One-time numbers are key by Lordrashmi · 2004-09-01 05:31 · Score: 1

Have you considered not using checks then? You can get money orders from the post office using your debit card. Yeah it is somewhat of a pain, but it could give you more security.

I only write one check a month, and that is for my power bill since they don't accept online payments. Everything else I can pay electronically and goes to my credit card which I monitor.
Re:One-time numbers are key by kev82 · 2004-09-01 06:10 · Score: 1

What about just some online merchant like paypal... or even just visa... someone you trust at least (well,maybe not paypal then).. But there you could enter your visa card, amount and everything, and have a visa number generated for you that you could use for your one-time purchase. Especially neat if you are dealing with someone you don't completely and such

--
http://leenks.com check it :)

Hardware vendor accounts (Cisco, Enterasys) by telemonster · 2004-09-01 01:49 · Score: 2, Funny

A while ago SOME GUY ON IRC personal Cabletron switch puked out, so SOME GUY ON IRC needed a new firmware image. Low and behold, SOME GUY found an account via google. Some school posted theirs online. (Cabletron makes overpriced gear sold to gov't mainly, you can generally get enterprise level huge switches on ebay for $5, since it doesn't carry the Cisco name.). Oh that was a lucky find, since hardly anyone uses Cabletron (now Enterasys) equipment, it is hard to find unlike Cisco CCO accounts.

Google rocks! Don't forget to google for your FLEXLM license files for your Solaris and similar systems, or your crusty Digital licenses for VMS, OSF/1, etc.

--
Southeastern Virginia REPRESENT!

Here's more problems... by alexandre · 2004-09-01 01:58 · Score: 1

A security focus article with many other ideas and a complete web site about google hacking. Happy searching :)

My favorite l33t 'sploit by freality · 2004-09-01 01:59 · Score: 1

Search for "C:\Documents and Settings" on Google's Uncle Sam sub-search, here.

Mod up +1 interesting. by Ayanami+Rei · 2004-09-01 02:00 · Score: 1

This is sort of like what eBay did through paypal. Well, at least until they _bought_ them. I guess that sort of relationship worked out (other people still use paypal as an external transaction processor).

But whoever steps up to the plate is going to have to offer a more compelling offering then whatever current credit authorization services can provide.

It's got to provide realtime feedback as to account status and such (for the vendor), or something.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Will Visa numbers get slashdotted? by atomic-penguin · 2004-09-01 02:06 · Score: 5, Funny

Soon enough all valid Visa numbers will be slashdotted by orders at ThinkGeek.

--
/^([Ss]ame [Bb]at (time, |channel.)){2}$/

Re:Real security and ease of use by Moirke · 2004-09-01 02:20 · Score: 1

"real security and ease of use"? That's a contradiction in terms. Any system thats easy to use is almost certainly easy to crack (hint, the crackers have as easy a time as the user).

I completely disagree. While the implementation of a secure system maybe incredibly complex, it does not necessarily follow that the system will be difficult to use.
The secure shell protocol maybe complex, and require a good understanding of communications and encryption algorithms to develop, but I have no problem using putty! -- Grouper --

same thing with peer to peer by blanks · 2004-09-01 02:28 · Score: 1

I'm always finding files on p2p networks that people either didn't know were available to the public, or had no idea what was in them.

next time your on a p2p search for access files, excel, QuickBooks, .sql, also simple things like "phone" "password" "address work too.

Same thing really as with google where people had no idea what they were doing, and gave access to sensitive information to the public unknowingly.

--
TruePunk | Games

conundrum. by alazar · 2004-09-01 02:29 · Score: 1

suppose I wanted to check to see if my vital info was release by some careless or malicious person(s). I might consider going to google and doing a search. BUT, I'd have to use that private data for the search. Once that is done the data is has been released, and possibly stored in some, in-the-clear, query history,

So how might I be proactive and research the issue, without revealing the info?

--
True friends are hard to come by... I need more money. - Calvin

Re:conundrum. by SharpFang · 2004-09-01 07:44 · Score: 1

Mangle/damage your data. Use ranges like the other poster said (maybe a closer range), part of your address... anything that will possibly bring up false positives (to be analyzed "manually") and won't provide enough info to obtain -your- data when intercepted but enough to hint the search engine that it's you.

--
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2

Unless your PIN... by caveat · 2004-09-01 02:34 · Score: 4, Funny

...is the price of a cheese pizza and a large soda at Pinnuci's!

--

Facts do not cease to exist because they are ignored. - Aldous Huxley

From the article: by caveat · 2004-09-01 02:46 · Score: 1

Some of the files I saw appeared to be on users' member sites for their ISP accounts. I suppose this is supposed to be a poor man's remote-access method, in that they can get to important files through the Web page. Oy, what a bad idea!

Sometimes other net users, specially those who just learned to use ProntPage, really ARE that dumb. Hanlon's Razor...

(for those of you who don't know, the Razor states "Never attribute to malice that which can adequately be explained by stupidity.")

--

Facts do not cease to exist because they are ignored. - Aldous Huxley

Re:Real security and ease of use by RsG · 2004-09-01 02:52 · Score: 1

Well, read the end of my post. I was refering to average or below average computer users, not geeks or the computer literate. Undoubtably most of the Googlable* private info came from the Joe public crowd, and these people have a hard time with data security. My disagreement with the gandparent was over the implementation of widespread or universal security (of course I may have misunderstood his point, but mine still stands).

*I have no idea whether "Googlable" is a word, and my spelling is bad enought with normal english, but I think I spelled that right

--
Erotic is when you use a feather. Exotic is when you use the whole chicken.

Mazafaka.ru site seems to be real info by John+Harrison · 2004-09-01 02:57 · Score: 1

I don't read Russian so I don't know what the context is, but the Mazafaka site that comes up in the Google results seems to have info on real people in it. At least I am able to find them through Yahoo people search and get the same addresses. Perhaps the credit card numbers are real as well?

--
Lasers Controlled Games!

Wow, what a revelation! Not. by cyranoVR · 2004-09-01 02:59 · Score: 1

That search yields ust 6 hits, one of which is an eWeek article on the same topic - "do a search for #### visa on Google."

Navel-gazing, anyone?

Or maybe it was a slow news day, so they created their own story...

Try doing a search for password type:*.txt. The results are a bit more interesting.

Re:Wow, what a revelation! Not. by OverlordQ · 2004-09-01 05:11 · Score: 1

I think you mean
password filetype:txt

--
Your hair look like poop, Bob! - Wanker.
Re:Wow, what a revelation! Not. by cyranoVR · 2004-09-01 13:03 · Score: 1

Yeah, that'll do the trick

Just Call Them and help them out. by freality · 2004-09-01 03:15 · Score: 5, Interesting

I just called all the people on one of the lists linked here and either left a msg or explained the situation. Took about 30 minutes. The clearest way I found of convincing them was to tell them how to do the Google search themselves. For most of them, their name in quotes and the word "MasterCard" or whatever brought up 1 page, the page with their info on it. I got many answering machines and disconnected numbers, but a few thanks as well.

That depends... by LordPixie · 2004-09-01 03:18 · Score: 4, Funny

Anyone know what that 481 on the signature strip is for?

It actually depends on what the name is on the front of the card. It has different meanings for different names.

Yours would be.... ?

--LordPixie

Interesting Stuff by Anonymous Coward · 2004-09-01 03:25 · Score: 1, Interesting

I once found some very interesting stuff using Google. Basically, it was all to do with the fact that customers of an online service (which my place of work used to use) were trying to use client-side scripting to do something that should have been done by server-side scripting; so their web sites were full of JavaScript (which some people still think is secure). The sites also necessarily linked to the central server, and were giving away information in cleartext that really was not meant for public consumption. Because there were these links to the central server script -- complete with the variable names and values in the query string -- on several pages on the clients' sites, Googlebot found them and indexed them. (THE PROPER WAY would have been to bury the variables which dealt with authentication in a local CGI script, which would then call the central CGI script. Authenticating to the local script is left as an exercise for the reader. At any rate, damage is inherently limited because the attacker does not gain the actual authentication tokens; only the chance to do whatever limited acts the site's programmer has chosen to allow.)

I am not saying any more. My boss told them what they had done, they know who we are and there could be repercussions. But anyway, I'll google for the same information again in a few months' time and see if it's there. If so, I might do a write-up. In my book, if you leave your valuables lying around where you know there are thieves, you deserve to be taught a lesson -- and you should be glad with knowing that your valuables are being taken care of by someone like me, rather than broken by some of the thugs out there.

Also try searching for outlook databases by fluor2 · 2004-09-01 03:29 · Score: 2, Insightful

"outlook.pst" filetype:pst

Discover card has a solution by dotslasher_sri · 2004-09-01 03:31 · Score: 1

Discover card has a solution to this problem. Their software sits on your desktop with your credit card information. When you want to pay anything online it creates a one time credit card number which can be used to pay to the merchant. Seems like a good solution. I think everyone should implement a solution like this.. here is the link by the way

https://www.novusnet.com/cardmembersvcs/personalpr ofile/pp/SafeOnline

Don't try it! by Doc+Ruby · 2004-09-01 03:50 · Score: 1

When you search Google for your own CC#, you associate it with your IP#, and therefore other traffic, that can be read by sniffers on the Internet. Even if Google didn't have your CC# in their index, you've now advertised enough info for a bad guy to clone your identity and rip you off.

--

--
make install -not war

I called all the people on this list. by freality · 2004-09-01 03:51 · Score: 1

I just called all the people on the list linked here and either left a msg or explained the situation. Took about 30 minutes. The clearest way I found of convincing them was to tell them how to do the Google search themselves. For most of them, their name in quotes and the word "MasterCard" or whatever brought up 1 page, the page with their info on it. I got many answering machines and disconnected numbers, but a few thanks as well.

Unique/one-time use credit card numbers by dstutz · 2004-09-01 03:54 · Score: 2, Informative

MBNA has ShopSafe
Citibank has Virtual Account Numbers
Discover has Discover Deskshop
even American Express...

This is *nothing* new

FTC/FBI/0golf by freality · 2004-09-01 03:56 · Score: 1

I filed a case with the FTC's fraud clearinghouse, filed a complaint with the FBI's fraud group, and called the guy who hosts it. At first he was like "yeah yeah.. send a msg to ...", then I told him there was a case filed with the FBI's consumer fraud group. The page was gone in seconds and is now 404. The page is still in google's cache, and i've put that search query in my fbi submission. LOL! Interesting morning.

I got over 10,000 pages of credit card listings! by rfc1394 · 2004-09-01 04:09 · Score: 4, Interesting

His example only selects cards belongng to one issuer (because the first 4 digits are the same), and only got 8 hits. Let' not be pikers and do the whole range of Visa Cards; the number 4 followed by 15 digits. And let's do Mastercard (50-53 followed by 14 digits) while we're at it, let's not discriminate!

For Visa, I did this one and got 2450 pages of listings of credit card numbers. Doing the same for Master Card returns only another 481 pages - not just card numbers, but web pages containing numbers - and some are test pages to demonstrate how LUHN codes work, but I don't think they all are. Oh, let's not leave home without American Express, where we can find a whopping 7,780 pages of listings!

I don't think they are all tests. Some include the number, expiration date, plus the name, address and telephone number of some people who apparently placed orders on-line. A great way to commit fraud or implement identity theft, wouldn't you say?

My guess is that if you called some of these people you would find out that yes, that is their credit card number and they had no idea it had been exposed.

Oh, I forgot to troll for Social Security Numbers. Now that returns 7 million pages, most being things like zip codes and such, but it wouldn't be hard to do that by redoing the search on an automated basis by inserting the '-' where appropriate and generating several thousand searches. At random I picked a range and tried all Social Security 301-01 numbers, and got 115 pages. Not only that, but the text ad from Google was for a company that offered on-line searches of social security information! Very helpful too!

Paul Robinson

--
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.

Yahoo! has even more neat tricks... by edsarkiss · 2004-09-01 04:13 · Score: 3, Informative

http://help.yahoo.com/help/us/ysearch/tips/tips-01 .html

* Airport Information
* Airline Registration Information
* Area Codes
* Calculator
* Dictionary Definitions
* Encyclopedia Lookup
* Exchange Rates
* Flight Tracker
* Gas Prices
* Hotel Finder
* ISBN Numbers
* Local Search[new]
* Maps
* Movie Showtimes
* News
* Packages
* Patents
* Sports Scores
* Stock Quotes
* Synonym Finder
* Time Zones
* Traffic
* UPC Codes
* VIN Number
* Weights, Measures and Temperatures
* Weather
* Zip Codes

--

SIGUSR1

Isolation isn't necessary by Chmcginn · 2004-09-01 04:17 · Score: 1

In fact, there wasn't isolation in the original example that inspired Darwin to pen 'The Origin of Species'. All of the finches on the Galapagos were assumed to come from the same original species, possibly as little as a few pair.

--
Have you been touched by his noodly appendage?

how to remove things from google's cache by sootman · 2004-09-01 04:22 · Score: 4, Informative

If you find something of yours that shouldn't be online, and you have access to the server, the best thing to do is put up an empty document with the same name.

Contacting google to remove their 'hit' on it could take a while, and remember--there *are* other search engines out there. If the doc just disappears, it'll stay in Google's cache (and who knows who else's) for who knows how long.

However, if a doc with the same name and same location still exists but has little, no, or bogus data, the engines will suck up this new worthless copy the next time they come 'round and the good copy in their cache will be overwritten with the new worthless copy.

--
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.

Re:how to remove things from google's cache by aputerguy · 2004-09-01 07:25 · Score: 1

While this protects against current search engine caches, it does nothing to protect against historical snapshorts or intenet archives, such as the Wayback machine http://www.archive.org/

Card Verification Number (CVN) by caveat · 2004-09-01 04:31 · Score: 1

shamelessly ripped from PayPal's website:

What is a Card Verification Number?

The Card Verification Number is a security feature placed on credit cards and debit cards to ensure that the person entering the card number online or over the phone has possession of the card.

--

Facts do not cease to exist because they are ignored. - Aldous Huxley

that's really weird by circletimessquare · 2004-09-01 04:46 · Score: 1

i got the same answer here

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it

Check your credit report lately? by sideshow · 2004-09-01 05:02 · Score: 1

That shows up bad on your credit report.

--

Hollow words will burn and hollow men will burn.

Debit cards by loqi · 2004-09-01 05:20 · Score: 1

Some of these may very well be debit cards. So I'm quite sure there are at least a few cardholders at risk here.

--
If other reasons we do lack, we swear no one will die when we attack

Now combine ACH with a substitute check... by mikelmoore · 2004-09-01 06:00 · Score: 1

I'm waiting for the full implications of the U.S.'s new substitute check policy that goes into effect on October 28, 2004....

See: Check Clearing for the 21st Century Act

Information Week raised some of the issues: Quality vs. Deception in Managing IRDs

--
I can be found @ 127.0.0.0

Re:Now combine ACH with a substitute check... by mikelmoore · 2004-09-01 06:09 · Score: 1

I left out that you won't be able to use the original check for proving forgery or alteration, since it may (read probably) will no longer exist!

--
I can be found @ 127.0.0.0

The bank takes no risk! by mrmike37 · 2004-09-01 06:23 · Score: 1

The merchant takes the risk when someone uses your card. When Joe Sixpack gives his card info out to a phisher, and said phisher orders from a merchant, guess who's left holding the bags? The merchant.

Signed,
An Internet Merchant

--
Really, I'm not trying to be clever with my signature.

Re:The bank takes no risk! by Veridium · 2004-09-01 07:36 · Score: 1

I'm an internet merchant too and there is one *extremely* good way to protect yourself. Only ship to the billing address of the credit card used. Our card processing service verifies this instantly for us.

We have had zero problems with credit card fraud since implementing this policy. The caveat would be that this is only helpful for merchants who ship tangible goods. There may be ways to conduct fraud around this, but I don't think the typical fraudsters do much more than grab card numbers and try to use them.

--
Think for yourself, destroy your television.
Re:The bank takes no risk! by mrmike37 · 2004-09-01 08:13 · Score: 1

Obviously you haven't been privy to the wave of AVS approved transactions from phishers changing the address on file. I actually sued CitiCards for negligence (and won) when they charged us back after proving delivery to the AVS address. Also, is it really worth alienating 10% of your customers to save 1% in chargebacks by forcing shipment to the billing address? Obviously that questions is best answered based on many factors, but considering most large companies ship to alternate addresses, I would bet your net profit is higher shipping to alternate address (with proper verification of course).

If the sheeple knew how credit cards really worked, we would be better off sending an invoice in the mail after shipping the product. Your only recourse if the card holder pushes the issue is suing them.

--
Really, I'm not trying to be clever with my signature.
Re:The bank takes no risk! by Veridium · 2004-09-01 12:10 · Score: 1

No, I wasn't aware of phishers changing addresses as I haven't had a problem with it yet. D'oh.

Also, is it really worth alienating 10% of your customers to save 1% in chargebacks by forcing shipment to the billing address?

If those are the numbers you're dealing with then I agree with you. Before we refused to ship to anything other than the billing address, 4 out of 7 transactions placed through our stores that were destined to an address other than the billing address were fraudulent. Of the 3 out of 7 that weren't, they comprised less than 4 percent of our total orders. This was based on the first 6 months of business online.

It would seem we have different dynamics at work in our respective markets. My online sales are largely jewelry and precious metals related. Our solution for customers that want items shipped to an alternate address is to use paypal. So far this has worked out fine for us.

Thanks for clueing me into the address changes.

--
Think for yourself, destroy your television.

Website that covers the p2p related issue by celerityfm · 2004-09-01 06:23 · Score: 1

http://seewhatyoushare.com/, as covered in Slashdot before has a pretty good round up of sensitive and sometimes CLASSIFIED documents found on P2P networks.

Interesting non?

--
...unfortunately no one can be told what The Mat^H^H^HGoatse is...they must experience it for themselves...

Re:Website that covers the p2p related issue by Nos. · 2004-09-01 08:41 · Score: 1

My site does the same thing....

about the SSN's... by avisdream · 2004-09-01 06:46 · Score: 1

After someone dies, their SSN is listed in the SSDI - Social Security Death Index. I googled SSNs, and I pretty much all that came up were genealogy entries; relatives enter the SSN just for idendification purposes. So that's fine.

Check yourself... by IronMagnus · 2004-09-01 07:06 · Score: 1

Handy to see if your card number is out there, search for a range in which your number is and your last name.

Re: additionally by multimed · 2004-09-01 07:20 · Score: 2, Insightful

All the stuff about most people not knowing about robots.txt and all that are true. It would be crazy to expect all internet users to understand all of the is and outs of security. BUT anyone who chooses to publish to the web, nat the very least needs to understand rule number one is "publishing on the world wide web means by default the world can see it." If they don't want the world to see it, they can choose to either not post it or learn about security.

One thing I don't think I've seen mentioned yet though, is that everyone is assuming that people choose to post the data in question. While this is probably true to a large part, it is by no means always the case. Some of the data may have been stolen due in no part to the victims (hacked website, disgruntled employee at a bank, etc) was then posted.

--
Vote Quimby.

Googledorking still works by smittyman · 2004-09-01 07:47 · Score: 1

try typing
intitle:index.of mp3 coldplay

things like cv.doc also give realy emberrasing results as still 4,770,000 sites still give nice browsable results.....

See http://johnny.ihackstuff.com/ for details

--
Message from god, Please logoff, rebooting the Universe

I don't need to read the eWeek article... by Da_Biz · 2004-09-01 08:26 · Score: 1

...I'll just wait for the astute "summary" from Roland Piquepaille (aka, F-ckyface). What a tool.

.htaccess? by Anonymous Coward · 2004-09-01 10:55 · Score: 1, Insightful

'nuff said.

Re:Now combine ACH with a substitute check... by rvw14 · 2004-09-01 11:02 · Score: 1

It is a completely voluntary program on the banks part:

The law does not require banks to accept checks in electronic form nor does it require banks to use the new authority granted by the act to create substitute checks.

Possession of stolen credit cards? by monkeyfarm · 2004-09-01 11:19 · Score: 1

I may be mistaken, but I could swear that possession of stolen credit card numbers is a crime. I "know" I've seen news stories about ID theft rings getting busted for the _possession_ of stolen credit cards and related info.

Now I do one of these Google searches, go to a page that has these numbers, names, addresses, etc. It's now in my browser cache of my laptop.

Some law enforcement person currently engaged in generating revenue for the city/state pulls me over for doing 45 in a 35 zone. As legally my car can be searched, they find my laptop and make me start it up. This guy decides to see what I've been looking at because of "kiddie porn" and stuff he's seen and he figures a +10 ticket is not enough to justify getting out of his cruiser on a 110 degree day in Arizona.

He discovers in my cache these "Stolen credit cards"

What happens then?

This may be tinfoil hat stuff, but maybe not. Kafka wasn't completely crazy.

--
What I don't know I just fake...

Not Very Good Examples by Anonymous Coward · 2004-09-01 11:29 · Score: 1, Insightful

Considering the examples the writer used, such as Visa numbers and Quicken files. Did you notice there were only about 22 results a piece? Now take that number from the total amount of web pages crawled (4,285,199,774), and you'll have a nice percentage that tells you exactly how many people include insecure web page content. ...not many

Re:Here's a search I find funny... by jmcmunn · 2004-09-01 11:30 · Score: 1

Yes, cleary a google search is offtopic in a thread about google searches. Dumb ass.

Re:Now combine ACH with a substitute check... by mikelmoore · 2004-09-01 11:45 · Score: 1

That will be an all or nothing proposition for the bank. Either they take them or they don't. It will not on be on an individual check level.

The point is moot anyway-I did some further digging through the Federal Reserve site & found out (buried in their regulations for implementing the law) that it can't be used with ACH, as it requires an original check to create a substitute one.

The Federal Reserve Board took comments from concerned parties in formulating the regulations (many of which were the same as my concerns about fraud and forgery) and specifically added regulations to address them. I don't know if they covered every possible huckster's scheme, but enough of them to (pardon the mixed metaphor) take enough wind out of my sail to get me off this hobby horse...

If anyone else out there has any curiousity: Check 21 Regulations & Comments as PDF

--
I can be found @ 127.0.0.0

Asking for Trouble! Zeitgeist by Steve+Cowan · 2004-09-01 11:53 · Score: 2, Interesting

I worry, now that it's on Slashdot, a certain Visa search will end up on Zeitgeist for sure!

Missing option... by FirstTimeCaller · 2004-09-02 07:06 · Score: 1

I wish one of them (Google or Yahoo) would allow typing in an IP address and getting the whois results.

--
Wanted: witty unique signature. Must be willing to relocate.

What a joke by hyc · 2004-09-02 11:32 · Score: 1

Sorry, this is completely off-topic, but when I pulled up this story the rotating ad landed on a Microsoft ad - here's a screen shot of what I'm talking about: Microsoft Ad

Is it just me, or does that whole concept seem ludicrous? I suppose it makes logical sense, in a twisted kind of way:

"At Microsoft, our programmers encounter security vulnerabilities each and every working day. Our experience with security is second to none! Not like those silly Linux dweebs who hardly ever see a security vulnerability. Who would you rather go to for security advice - a programmer who has never ever encountered a security hole, or seasoned programmers who run into security holes all day long, every day?"

That tag line should read "Go to microsoft.com today and get a free virus!"

--
-- *My* journal is more interesting than *yours*...

Slashdot Mirror

Searching For Trouble With Google

407 of 506 comments (clear)