…During all this monitoring, I wasn’t anywhere near the rider. I didn’t even need to see them with my own eyes. Instead, I was sitting inside an apartment, following their movements through a feature on a Metropolitan Transportation Authority (MTA) website…
If they allow access without any other form of authentication, I wonder what kind of protections they have against brute forcing credit card numbers.
You could pick up a receipt, use the first and last digits and hammer away.
Receipts usually only show last 4 digits. That leaves 12 more digits to brute force through. only 999,999,999,999 (basically, 1 trillion combinations). You’ll find lots of positive matches for other valid cards in that range, so you still wouldn’t know which one belongs to your mark.
This is a security flaw for sure, but it’s not nearly as serious as the article makes it out to be. You have to know the person you are targeting, you have to know which credit card they used to pay for their subway credits, and then you have to know the credit card number of that credit card. If you are in a position to know all that, then you are probably already in a position to stalk them using other/superior methods.
I think it’s exactly as big a deal as the article makes it out to be. Think of abusive partners. Transphobic parents. Waiters or bartenders who want to stalk the pretty girl they just checked out.
I know that the Apple credit card doesn’t have a number printed on it (iirc), and I think some of the payment systems essentially use a unique credit card number per purchase. I’m not sure if those kinds of things would help here.
But this is both dangerous and absolutely idiotic. Someone came up with an idea, so robe’s manager ram with it without talking to legal or security, and it got pushed live. It should absolutely be pulled.
This should be shared to privacy@lemmy.ml
Other cities let you pay for transit directly via a credit card. Surely places like London have come up with a solution to this problem.
Creep acts creepy and then writes article about how creepy it all was
With their consent, I had entered the rider’s credit card information—data that is often easy to buy from criminal marketplaces, or which might be trivial for an abusive partner to obtain—and punched that into the MTA site for OMNY
Didn’t actually read it did you?
