Slashdot Mirror
Blippy Exposes Credit Card Numbers Through Simple Google Search
An anonymous reader writes "In an unfortunate data breach, social media site Blippy has left credit card numbers in clear text, searchable via a simple Google query. The results show the amount spent on a transaction, the location, and the full card number. As of this submission, the issue still hasn't been resolved."
The company's co-founder, Philip Kaplan, told the NY Times, "... when people link their credit cards to Blippy, merchants pass along their raw transaction data – including some credit card numbers – and the site scrubs that information to present just the merchant and the dollar amount spent. But several months ago, when Blippy was being publicly tested, that raw transaction data was present in the site's HTML code, where it was retrieved by Google. Mr. Kaplan said that early on, Blippy started disguising the raw transaction data behind the scenes, but it did not know about the breach until today."
As of this submission, the issue still hasn't been resolved
Not true. If I read the explanation carefully, what really happened is that some credit card companies sometimes add the CC number to the description of the purchased item. Bad! Which also means that on your printed statement for instance, your full CC number will appear. During beta testing of Blippy, they were not aware of that "feature", so they let through the full CC number of 4 beta testers. Once they figured it out, they easily added a filter.
If you were a beta tester for a service like Blippy, you can't be too shocked that this might happen. A better discussion would be what is Blippy really good for? I can see why I might like to browse other people's purchases once in a while, but why would I want to broadcast mine?
--
better than an internship in a startup: become a founder!
Or does the "normal" logic not get applied this time?
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
This issue seems to be resolved already. Maybe this incident was a Good Think (TM). People need to be aware that what they put on social media sites can come back to bite them. Most people shouldn't be putting near the amount of information on the sites as they already do, without even mentioning credit card numbers and recent purchases. If it takes a few people's credit history to make the point to a wider audience, maybe this sort of thing should happen more often...
Everyone should have single sign on!
If you have nothing to hide, then why not?
/sarcasm (see NYT article)
Every idiot knows this; you don't test with customer private data.
You may randomize/one-way-scramble the real data to anonimize it, but you never, ever use the actual data for tests.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
God, this twit talk is growing on me. Cracks me up.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Blippy exposed as existing.
I wonder if this company is F-cked. If there was only a web site that would tell me that...
Who cares about revealing credit card numbers. The bigger question is, why would I want to deal with a business or "social media" site which snitches all my transactions from the businesses, and (i'm presuming) somehow makes them public?
And WTF are the businesses giving the full credit card number to the social media site at all? That just seems, umm, stupid?
Test your net with Netalyzr
Most bank offer single-use or single-merchant "virtual" card number, which allow for only single use or for use within the same merchant. In the statement, it will show the name of the merchant, along with which "virtual" card number you used.
Even if you picked up one of these numbers, there is no use.
New Economic Perspectives
Use them. Don't *ever* use a 2yr+ plastic #!
Citibank has this feature, other cards must nowadays also.
The same Philip Kaplan that ran F*ckedcompany.com?
Is he related to Clippy, the paper clip we all know and love? Hey, what are you doing %^$%^$%^$% NO CARRIER
sounds like a real baaad idea to me.
This brings up a point that needs to be looked in to a bit further as our personal information becomes digitized: at what point do you just let go of trying to hide personal numbers (such as credit card and social security) and make them as public as possible and force the system to make sure that YOUR numbers are really your numbers? Honestly, if the banking systems that we use for credit transactions notified me EVERY TIME that my SS# went through their systems , then I would know when it is being used and wouldn't worry so much about someone "stealing" my identity. It's a 9 digit number that will NEVER be reissued as long as I live; credit card numbers are 16 digits long and are 'throw-away'. As soon as the systems are in place that link me directly to my SS, I won't be worrying about trying to hide these numbers.
I'll be worrying about Big Brother watching my every move...
It just goes to show that if you put information somewhere online, anywhere, it's as good as writing it on bits of confetti and throwing it to the wind. Some will land in mud or in the grass, bushes and trees and be obscured, others may land in the garbage and be ignored or thrown out, but if anyone wants to look hard enough, they'll be able to find it, and some may even come across it without any pretense or forethought. Computers can help people, especially by aggregating large amounts of data, and the more data you put in, the greater the benefit can be to streamlining things for you and helping you discover the best opportunities. But that can also be turned against them since the data is somehow somewhere available.
Twinstiq, game news
Now google has censored the results but you can still find more data by using a slightly different search term.
site:blippy.com +"CARD#"
Google, if you got nothing to hide, why hide it, right?
Coincidentally, the Times is running a a story today about this new generation of "social" media sites like Blippy. Not only does Blippy want to compile a list of your purchases, they'd like to read your e-mail, too, if you don't mind. From the article:
Sigh....
Blippy blew big bloopers before the bankruptcy blues...
Why to broadcast your purchases: Reputation
I'm not going to defend this as a good or a bad idea, but by having a separate authoritative channel, they've basically made it possible to verify that someone who posts a review of a product actually owns the product, rather than just being a troll or a shill.
This effectively addresses head on the recent issues that "Yelp" has had in terms of offering paid advertising, using predatory or unethical sales practices, and so on. This is akin to using the getpeername/gethostbyaddr/gethostbyname verification that most SMTP servers do these days to verify that the ARIN IP address delegation agrees with the DNS delegation. By having two independent authorities to provide a countercheck, spoofing your gethostbyaddr doesn't get you anywhere because they can verify that you are really coming from one of the machines you say you are coming from.
Like I said, I don't know if it's a good idea. It's probably not even technically social networking. But it could have a useful application.
-- Terry
There's an incoming generation (and here I'm thinking of kids just entering their teens) who may not buy into the same privacy fears you and I might share. "Why bother with privacy," they think. "Why do I need to be private?" I'm not sure if the change in philosophy is a generational shift to accomodate a wholly different social culture, or if, darkly, it represents an entire generation mindswiped by consumer overlords. Either way, it's troubling.
"He's using a quantum encryption scheme! That'll take hours to break!"
Can't wait until I am treated with suspicion for wanting to protect my privacy. I hate my generation.
'Political power grows out of the barrel of a gun.' - Mao Tse-tung
Do you want me to click that link? Or pull it?
Try this:
1) Pull a credit card out of your wallet and look at the 16 digit number with format "wwww xxxx yyyy zzzz"
2) Google the first two groups together in double quotes like this "wwww xxxx"
3) ???
4) Profit!
CG Pin-Ups?
That's the idea that's sold to the public.
Blippy's real idea? Direct marketing tied to an individual.
"We may engage certain trusted third parties to perform functions and provide services to us, including, without limitation, hosting and maintenance, customer relationship, database storage and management, and direct marketing campaigns. We will share your personally identifiable information with these third parties, but only to the extent necessary to perform these functions and provide such services, and only pursuant to binding contractual obligations requiring such third parties to maintain the privacy and security of your data."
Yeah, that's right, that cool new "social networking" bullshit is the same thing as signing up to receive a f*cking catalog only with a more personal twist. It's the same as when Radio Shack, etc. asked you for your phone number and home address, just a little more detailed.
God knows, I'm not being sold to enough, sign me up for more!
Google still has the cache of them as of 1:24 AM "card site:google.com"
Sites such as bulletin boards frequently get somebody being stupid and posting their credit card number. The mods fix it, but the Google spider gets there first.