Blippy And Credit Card Numbers - Official Blippy Blog

http://blippy.posterous.com/blippy-and-credit-card-numbers

by ashishk • 16 years ago

139 50 16 years ago

blippy.posterous.com

icey4• 16 years ago

Wow, I would have thought they would have at least made a motion to apologize. Instead they've basically said "hey, this isn't a big deal, stop complaining".

scdlbx• 16 years ago

"While we take this very seriously and it is a headache for those involved (to whom we apologize and are contacting)"

icey4• 16 years ago

They changed their post. I specifically searched for the words "sorry" and "apologize" / "apol" before commenting.

nathanb• 16 years ago

Seems like they apologized to the four users involved. I don't know that they owe the public in general an apology. They basically explained why this is less scary than the headlines (including the one here on HN) makes it look and said that they were committed to keeping this from happening again, including giving examples of steps they were going to take.

What would you have liked to see from them? Prostrating themselves before you for revealing someone else's credit card data?

whiskeyjack• 16 years ago

I would have liked to have seen "a lot less bad that it looks" replaces with "one would have been too many" and "we will work very hard to regain your trust". It's okay... but the public is their target audience! Simple phrases, big impact.

jmathai• 16 years ago

Leaking 4 of thousands of credit card number IS a huge deal. It's a disservice to their users (even the ones who weren't affected) for them to downplay it.

axod3• 16 years ago

  * Someone finds a small isolated mistake,
    assumes the absolute worst
  * Rumor, misunderstanding, exaggeration, sensationalism
  * Opinion, how could they be so stupid, it's *so* simple!
  * Over-reactionary moralistic boycots start
    "Well I for one won't stand for this, who's with me!"
  * One-upmanship starts "Well I for one want the CEO to apologise"
    "I think the only decent thing is for them to cease trading".
    "Lets start an anti-<company> website!". This is war.
  * Sheep all join in and circlejerk for a while.
  * News that the original premise was in fact wildly exaggerated
    or just plain incorrect, gets lost in all the noise.

Sadly it's the way of the internet... Just look at most posts on Reddit these days... Just a shame it seems to have come to HN.

icey4• 16 years ago

Really???

I'm not really sure what you're referring to. I haven't assumed anything, publishing credit card numbers is about the worst thing you can do when dealing with people's financial credentials. Maybe you don't think it's a big deal, but I'm sure you're not one of the people who's card information was being plastered on the internet.

Additionally, I don't think I was being sensationalist - when this posting first went up there was no apology, just a long explanation of why this wasn't a big deal.

I wasn't being moralistic, made no demands, nor did I exaggerate anything.

I've been here just as long as you have (longer, actually; but who's counting, right?) so you can save the reddit comments.

dsplittgerber• 16 years ago

If the onus is soon going to be on the user having to explain why he sees a problem with his private details being shown to the whole world, there are going to be lots of problems and incidents which people are in no way ready for.

thirdstation• 16 years ago

Their anonymously-signed blog post doesn't engender much confidence in them as a company. Except that they try hard to protect their own identity.

pinstriped_dude2• 16 years ago

The apology is signed by the Co-Founder. What am I missing?

"Thank you for reading. Philip Kaplan, co-founder"

weaksauce• 16 years ago

Probably 2 hours of time in which they could edit the page and append a signature.

patio112• 16 years ago

We take security seriously and want to assure Blippy users that this was an isolated incident from many months ago in our beta test, and doesn't affect current users.

While it looks super-scary and certainly sucks for those few people who were affected, and is embarrassing to us, it's a lot less bad than it looks.

This could have been phrased a bit better to include an actual apology. It's pretty easy to do: "Several months ago Blippy's limited beta test leaked data about four customers, including their credit card numbers. That is totally our fault. We have apologized to those four customers personally and have taken steps to make sure it cannot happen again. The site currently does not leak data, but those four customers' numbers are still visible on Google searches. We are working with Google to correct this and expect it to be resolved in a few hours.

Here are the improvements Blippy has made to deserve our customers' trust:"

[Edited to add:

The Japanese salaryman in me would suggest that the CEO sign this post. Phrasing might include "This was ultimately a failure of our internal quality controls, because it should have been caught several times before this data was exposed publicly. I take full responsibility for the lapse and have begun..."]

codemechanic2• 16 years ago

http://blippy.com/business/+1310-6645810epoc-04-02-card-7096...

are we still seeing the cc number?

patio112• 16 years ago

A quick elaboration on the CEO thing, because I didn't want to give the impression I'm grinding anybody's nose in it: Tactically I think it is a good idea because it demonstrates that the company has no higher priority than the users' security and their trust. (And if your business is publishing folks' info, that is probably true. Heck, everybody on the Internet who takes credit cards, in any capacity, has a built-in "Are they going to scam me?" objection to address.)

Culturally, in Japan, the title for the CEO (often) literally means "Person With The Highest Responsibility." (最高責任者 -- all the other CXOs are "Person with the Highest Responsibility For [Information, etc]") Within the company, I'm sure some junior engineer is going to get a royal chewout today, but to the rest of the world, the company is an impenetrable mass. When an employee screws up, the company has screwed up, and when the company screws up, the CEO (or division chief or whomever) apologizes because his job is managing the business such that it does not screw up.

When done well, I think this is one of the most emulation-worthy bits of the Japanese corporate culture. It sends a message internally that you will always back your people come what may, and externally that you're worthy of the trust your customers, shareholders, and business partners place in you.

jacquesm4• 16 years ago

I wished all companies lived up to your standards.

donw2• 16 years ago

Patrick, it's always a pleasure reading your posts. How I wish companies in the US acted like this...

BRadmin• 16 years ago

It's amazing how many companies still don't get it.

You made a very public mistake -- apologize, wholeheartedly and genuinely, and accept responsibility. That's it!

Making it seem like it's not a big deal makes it come off defensive, unprofessional, and like an excuse..

Now is not that time for that -- use the mitigating details in a follow-up post that highlights your progress and what you've implemented to ensure it never happens again. Don't do it now.

staunch• 16 years ago

And absolutely don't use distancing language (http://en.wikipedia.org/wiki/Distancing_language). A single "sorry" is worth a thousand "we apologize"-es.

MikeCapone• 16 years ago

Too bad there isn't a couple of mandatory classes in Evolutionary Psych. 101 and Cognitive Biases 101 for the people in charge and those who advise them. Knowing about very common human flaws could help these people avoid these same mistakes that we see over and over when these types of situations happen.

rdl3• 16 years ago

Phil Kaplan is the guy most associated with Blippy (and with the biggest reputation of the 3 people at Blippy from before Blippy). I'd consider his statement more meaningful than the CEO's. The other two blippy guys are mid-2000s graduates with 1-2 smaller projects to their names.

Phil is non-CEO due to historical accident (I think he was CEO of adbrite still when blippy was launched and maybe it would have looked bad?).

_delirium2• 16 years ago

Whoa, I didn't know until just now that Phil Kaplan was at both AdBrite and Blippy. I think of him as the FuckedCompany guy, so wouldn't have thought he'd be part of something so close to the kinds of things FuckedCompany used to ridicule...

cjeane• 16 years ago

sucks for those few people who were affected

Pretty much guarantees I'll never use this site.

pinstriped_dude2• 16 years ago

I have never used this service and from reading what it does, I probably never will. BUT, if were the kind of person into these type of things, I would feel pretty good about them. The explanation sounds sincere, honest and heart-felt. They have done their research and discovered what caused the problem. The credit card numbers were only in the source-code of the HTML, not actually diaplayed on the HTML page (I know it only takes 2 clicks to see the source, but how many people check out the source code of every page we see through the day ?). And they are telling us that they are well-funded to dedicate more resources on security. I feel pretty good about them.

stingraycharles• 16 years ago

(I know it only takes 2 clicks to see the source, but how many people check out the source code of every page we see through the day ?)

The same kind of people that go hunting for credit card numbers online?

tptacek• 16 years ago

Yeah, I don't know. My lizard brain wants to see them writhing on the ground pleading for mercy, but the teeny tiny rational part of my brain wonders what I expected them to say instead of this.

If you get past your expectations about their attitude, they are being pretty forthright about what actually happened; in many more contrite disclosures, you don't get this level of detail. I appreciate the detail.

I'd like to see something other than the standard "now we're getting third-party security audits" platitudes. For instance, I'd like to know that they have a software security person on staff now, since they're clearly dealing with credit card information that they don't fully understand.

latch• 16 years ago

u guys are being too hard on them. Shit happens. Even serious shit. I feel like they are being accountable and honest.

samd• 16 years ago

Either you want businesses to communicate with the public like normal human beings or you can complain and nitpick their statements for not being perfectly phrased. Not both.

I'm glad they candidly told us about what went wrong. There's an important lesson to remember about how everything put on the web can be indexed and stored even if it was only up for a short time.

codemechanic2• 16 years ago

"That's why it's okay to hand your credit card over to waiters, store clerks, and hundreds of other people who all have access to your credit card numbers."

I don't like this attitude. Anyway who cares when you have $11.2 million funding

waxman• 16 years ago

Everyone and every company makes mistakes, so it's not a matter of whether or not you screw up (because you will), but rather how will you deal with it when it happens. I think Blippy dealt with it pretty well.

Having said that: I think Blippy was a dumb idea to begin with, and this dumb mistake may have been the final nail in the $11-million-Series-A-funded coffin.

jamesshamenski• 16 years ago

all publicity is good publicity.

lallysingh• 16 years ago

Hint for the future: if you're processing raw data that could include credit card #s, filter out 16-digit sequences as a whole.

tzs• 16 years ago

15 for American Express. 14-16 for various kinds of Diner's Club. 16, 18, or 19 for Solo and Switch.

It would not have occurred to me that the number might even be in the raw data. Sounds like the supplier is violating PCI. (That doesn't apply if the supplier is the card company or issuing bank--PCI is just something they require others to follow. They hold themselves to a much lower standard).

_delirium2• 16 years ago

It might be a useful heuristic for companies anywhere remotely in this space to use during early alpha/beta periods though. There aren't that many legitimate cases where you're going to be sending 14-to-19-digit numbers in HTML, so at least during the early phases, flag them and make sure they're not CC#s that somehow got there.

ssp• 16 years ago

Their response is totally fine and in proportion to the actual harm done.

sriramk• 16 years ago

I was chatting with someone about the language used in a lot of these apologies. This has come up in a lot of issues - like in the Justin.tv suicide case.

I think companies fear legal repercussions. If you use certain words, you might be taking blame onto yourself in a legal sense and might have someone use that against you in a lawsuit.

I'm not sure about this incident but I definitely sensed that was the issue with the Justin.tv apology.

donw2• 16 years ago

Sorry, but this blog post indicates that Blippy is in no way serious about security. Blippy handled sensitive data (credit card numbers) in a highly insecure fashion, and rather than treating it like a full-scale emergency, which it is, regardless of the number of people affected, we get this "hey, it's no big deal" blog post.

What other massive security mistakes are lying around in their codebase? Why does this sort of reply give me absolutely no faith that they'll deal with those problems seriously when/if they arise?

there• 16 years ago

now that this whole thing has blown over, i'd love to hear from someone at blippy regarding how this affected their subscriber count. i have a feeling it went up today despite the negative press.

Blippy And Credit Card Numbers - Official Blippy Blog

Related Stories