Security Saturday!

Credit cards are no fun. All my life in Europe I have lived with cash money and debit cards, and I had not known any better. When the gulden (the golden, the gilded) was still a thing, back when I was a young boy, I used to save it up and like how heavy some of the coins felt. When I reached a certain age I learned about the Golden Standard where the gulden gets its name from, and appreciated the balance it gave. When we switched to the euro, the gold was quietly sold off. If there is any left, it is not enough to back the Euro.

But that is another story. With the switch to the Euro I also soon got a bank account and a debit card. It was convenient to use in Europe, and many travels to countries like Switzerland, Great Brittain and Germany were made less complicated because of the availability. Especially in Great Brittain and Switzerland, both of which never switched to the Euro. But in all of this, my finances were clear. I had a bank account that contained a measure of money that I could use. If I was out, that was a signal that I had made bad financial choices. It helped remind me to be better.

But then, through international contacts and an interest in cyber security I learned about another type of card. Convenient little things called credit cards. With a very broken security system that predated the internet as we know it today. Needless to say, I did not understand why anyone would need or want one. It seemed to be a status symbol for some, and a trap of pride and gluttony for others.

So far my cultural look at credit cards. Nowadays I look at them differently. Like with so many financial or security systems, credit cards are a legacy system that is so integrated into some societies that upending and removing it actually costs more than to pay people to constantly fix the many problems that crop up. On a large scale it is more efficient for a credit card company to reimburse a fraudulent transaction first, and get the responsible criminal through law enforcement or other means later, than that it is to completely change the ways that credit cards work. Although minor improvements are likely constantly being made, because technological advancements constantly make certain techniques cheaper to implement and therefor interesting to tack onto credit cards.

Now here is the interesting thought. Because of the above cultural background, because in my country I have zero need for a credit card (we have iDeal https://www.ideal.nl/en/) and because I see credit cards as a hassle, I never got one. Until one day I needed one to get somethign from Amazon, which I could not get from our local alternative (which is https://www.bol.com/nl/). Amazon, however, did not offer iDeal as an option. And back when I was interacting with it, it also did not offer Paypal as an option. (I had set up Paypal earlier to pay for Spotify).

So I went looking around, but eventually solved the problem by asking my Dad's credit card which he acquired for his newly started business (https://www.istruction.nl/home). Since this was the only instance in which I needed a credit card, I gave my search a rest. Until now.

On the locals communities you can (as of writing this) only subscribe using a credit card. And since I moved to live on my own, it makes no sense to use my dads card again. In fact, since we are talking subscriptions here, it is a terrible idea. My dad can get very cross when money business goes wrong. Luckily I knew that there was the idea of prepaid credit cards, and back when I was looking before I used my dads card, I found out that there is in fact prepaid online credit cards. These are cards that get registered but stay digital. They are pretty interesting, although a little zealous still in collecting personal information.

Not that it matters. I could fake most of it by using some tricks and the fact that several family members share initials with me, so it was easy to do some... Economic truth redistribution with me filling in the information for Pay2d (https://pay2d.nl/en/). Pay2d provides prepaid cards (that is how I found them) but also offer an online virtual card without any costs. Sounds too good to be true? You are right, it kind of is too good to be true. When you pick the card it is not as instantly available as they say. that is why I did not end up using it when I was trying to shop at amazon. I put 50 dollars on the card, tried to use it, and failed. The card registration had not propagated throughout the network, it seemed, and I was on a clock.

But now, with an empty prepaid card that is still valid for while, it is the perfect time to see if it works now that it has had a few years to propagate through the network. And indeed it does. I succesfully subscribed to the Engineering Politics locals community (https://engineeringpolitics.locals.com/).

Now before we wrap this post up, you should note that security-wise pay2d is not the best. It uses text message as a secondary authentication channel, which is vulnerable to number-transfer fraud. But it does use a secondary authentication channel, which is better than none at all. Do, however, keep an eye on it since your email-address change notification is sent to you by text message and phone number changes are communicated by email. This means that you will not be notified if someone manages to transfer your phone number away from you.

I have not tested if transactions on the prepaid card are passed through to the bank account that you are requried to link (for authentication of personhood), so I do not know the real impact of a compromised phone number. I will probably deal with phone numbers and 2-factor authentication in another post, since that is a delicate and weird subject in and of itself.

I hope this helps some people to gain access to otherwise locked away credit card functionality!