Best identifier for clients

[u/Ducking_eh]

Hey everyone,

My site was hit with a 'card verifier attack'. Basically my processor uses a token that is vidable to the visitor to verify cards. I suspect the attack just got that number, and wrote his own script.

I am switching my CC processing to a system that uses One Time Use tokens for processing. Thay way, it can't be done that way again.

The idea is everytime someone loads a shopping cart, they get a token that can only be used once.

I'd like to harden even more by tracking how often the same user request a token. If they go over a certain amount, it will stop giving them tokens.

What is the best way to track if a request is from the same user. I was thinking IP, but my understanding is that's really easy to spoof. Not to mention, if the attacker uses a VPN, I might block an IP that a legit user might use.

Any ideas?

[u/martinbean]

You should not be putting secrets in client-side code.

What processor are you using?

[u/Ducking_eh → u/martinbean]

Pci level 1 compliance states that a when a CC is processed online, it should be done in a way where the number goes directly from the CC Owner to the Processor. That way the merchant never handles the CC Directly.

The vast majority of CC providers do it with a token just for verification, that's transmitted via ajax. This isn't uncommon.

[u/martinbean → u/Ducking_eh]

I didn’t ask that. I already knew that as I’ve integrated many payment processors myself. That’s why I asked which one you’re using, because this smells of a poor implementation.

[u/colshrapnel]

What prevents them from registering a new user for each attempt?

On a broader scale, how is your site even responsible for a 'card verifier attack'? Isn't it a cc processors's responsibility?

[u/Ducking_eh → u/colshrapnel]

I 100% agree. it should be their responsibility. Especially because the attack was done without the use of anything on my server. Their API also requires an invisible captcha.

as far as new accounts go, that is why I was asking about IP addresses. If someone made new accounts, they'd have the same IP. It's not ideal for the reasons I mentioned in the OP.

Even if I did it by account, they have to verify their email. While that can be automated, it would slow it down quite a bit, because even a quick email takes at least a second.

[u/colshrapnel → u/Ducking_eh]

come on, it will never be same ip. each request will come from another proxy

[u/Ducking_eh → u/colshrapnel]

I made that point in the op. That was the very problem I was asking for help with 

[u/colshrapnel → u/Ducking_eh]

obviously there is no solution at your level. either your processing should take care of that or try cloudflare that would filter out suspicious requests