Stripe and Square both identify consumers by their unique CC numbers. If I swipe my card on a square reader, it recognizes me and asks if I want a receipt sent to my phone or email, even if I’ve never purchased from that vendor before.
Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints).
To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.
Not really. I work with payment processing, I've got the partially obscured credit card number, usually the name and the location. Plus a bunch of other info.
Where there done by the payment processor like Artemis2 or in house?
I'm asking because I saw a lot of in-house tokenizer with hashes or deterministic encryption that could get reversed in a few seconds by brute force since the space to cover is so small.
No. With 10^12 possible account numbers and a hash rate of ~10^10 H/s using off the shelf hardware [1] it would only take 100*(10^12/10^10) = 10000 seconds to deanonymise the token.
I'm really surprised this was down voted so much. I really don't think it's all that controversial. Like so many websites require registration when you are almost guaranteed never to return.
