Earlier today, VentureBeat detailed a major Blippy privacy breach that exposed user credit card information to search engines. The breach appears to have occurred on a small scale — Blippy believes that only four users had their credit cards compromised — but the fact that it happened at all is unsettling. After all, Blippy’s service asks users to entrust it with their credit card information (and in some cases, their credentials for online services) — it is of paramount importance that Blippy keep that data secure.
In an official response, the company says it isn’t as bad as it looks and doesn’t affect current users, explaining that it affected four early beta users, specifically those whose credit cards include their credit card numbers as part of a transaction’s “Raw Data”.
Here’s Blippy’s Offical statement:
Today someone discovered a Google search that displays the credit card numbers of 4 Blippy users.
We take security seriously and want to assure Blippy users that this was an isolated incident from many months ago in our beta test, and doesn’t affect current users.
While it looks super-scary and certainly sucks for those few people who were affected, and is embarrassing to us, it’s a lot less bad than it looks.
Here are the details:
- Say you buy lunch at Quiznos. Your credit card statement shows a complex entry like “Quiznos Inc Store #1234 San Francisco.” But Blippy cleans this up to only show “Quiznos.” We refer to these as the “raw data” vs the “cleaned up data.”
- Raw data is typically harmless. But it turns out that some credit cards (4 out of thousands in this case) show the credit card number in the raw data. For example, “Quiznos Inc Store #1234 from card 4444….”
- Many months ago when we were first building Blippy, some raw (not cleaned up, but typically harmless) data could be viewed in the HTML source of a Blippy web page. The average user would see nothing, but a determined person could see “raw” line items. Still, this was mostly harmless — stuff like store numbers and such. And it was all removed and fixed quickly.
- Enter Google’s cache. Turns out Google indexed some of this HTML, even though it wasn’t visible on the Blippy website. And exposed 4 credit card numbers (but a scary 196 search results).
- We’re working with Google now to remove Blippy from their cache, and they inform us it will be completed within a couple of hours.
While we take this very seriously and it is a headache for those involved, it’s important to remember that you’re never responsible if someone uses your credit card without your permission. That’s why it’s okay to hand your credit card over to waiters, store clerks, and hundreds of other people who all have access to your credit card numbers.
We’re making efforts to bolster our security to ensure that nothing like this ever happens again. That includes third-party security audits, and in general being a lot more careful before new features are released, even if it’s during a small, limited beta test period.
Thank you for reading.
Blippy has always been controversial because of its potential privacy issues — this will only give its opponents more ammunition and may cause some current users to question the security of the service. It also comes just after Blippy closed a new $11.2 million funding round.