How Effective is Credit Card Information Theft?

[Hornbein]

The brute force "try every password" attack was completely solved decades ago. (Just disallow more than one attempt per second.). All these giant untypeable unmemorizable O0Il| sensitive passwords are just bad security experts passive aggressively punishing users, and finding ways to blame users for bad product design.

Yes, I have for years thought those big passwords are silly. You have to record them somewhere, and that record is then a security risk.

Realize though that the true goal isn't to make the the user safe. The goals are to make the user feel safe and make sure someone else gets the blame if something goes wrong. There is also a big pressure for conformity. If everyone else goes to big passwords and you don't then in court you can be accused of laxity. An effective defense is to show you did what everyone else was doing.

 

[Hornbein]

You don't think that more powerful computers will be able to create problems that will be hard to solve for that same computer? (I know I said encryption, but it may be some other method still unknown because there is no need - or no mean - for it.)

"Computers are useless. They can only give you answers."" -- Pablo Picasso

 

[PeroK]

What has changed now?

It's more difficult to steal a million physical credit cards, than the electronic details of a million cards from one computer hack.

 

[jack action]

It's more difficult to steal a million physical credit cards, than the electronic details of a million cards from one computer hack.

Without getting caught and being able to use this information? Are you sure about that? Why aren't there more people doing it then?

 

[f95toli]

Without getting caught and being able to use this information? Are you sure about that? Why aren't there more people doing it then?

Lots of people are! This literally happens on on a daily basis. Of course it is not always credit card information; usually it is just stolen password files that are then decrypted and the information used to access peoples e-mail and social media accounts (because people tend to re-use usernames and passwords). This is how many targeted phishing attacks are done.

 

[jedishrfu]

Without getting caught and being able to use this information? Are you sure about that? Why aren't there more people doing it then?

When one learns of the dark web ways, @PeroK is correct. Some hackers steal the information and then put it up for sale on the dark web. Other folks buy it and begin the process of actual theft. This makes it near impossible to track down the original hacking group.

Also this is how the pwn websites work to help you determine if your password/identifying info was stolen and should be changed.

 

[jack action]

Lots of people are! This literally happens on on a daily basis. Of course it is not always credit card information; usually it is just stolen password files that are then decrypted and the information used to access peoples e-mail and social media accounts (because people tend to re-use usernames and passwords). This is how many targeted phishing attacks are done.

They steal the info, but how do you know if they are using it?

Where I live, a few years ago, there's been a major data breach from the largest financial institution in my province: personal information of 2.9 million accounts. including business accounts. We're 8 million people, do the math, pretty much anyone in the province was affected, including me.

Big panic at the time. Lots of blame thrown around. Free credit-monitoring protection was offered by the financial institution (which was a big mess for people trying to get it). Personally, I did nothing. Like many I guess.

How skilled was the hacker? An ordinary employee just downloaded the info and sold it over a period of 15 months. Apparently, the buyers were small financiers trying to find potential clients.

Years later, not only has the effects of this data breach hasn't made the news in any way shape or form, but I never heard of a single person being victimized. Easy to get the info, not so easy to use it.

The true victim? The institution itself which had to deal with the fear and panic of its clients. Contacting every member personally to reassure them. And the public relations nightmare! The institution's president was in the news every day for days, if not weeks. A class action was even launched against them. How much do you think it all cost them? And for what? A small [unethical] marketing stunt to find potential clients?