Protecting Data - SY0-601 CompTIA Security+ : 2.1

[@slyvax3359]

With tokenization, does the token server give a new token once it is used, or does it wait for you to attempt a purchase?

[@ausmanx1161]

I’m pretty sure it works the same as a DUO token.

[@onemoresmartone]

Tokens are one time use

[@Brandoncollins-dp8op]

what if the attacker knows about the token (in the video it's 4545 ...) and then just sends that to the merchant payment server so then it goes step 6 and 7 to gain approval, wouldn't that allow the attacker to use the person's credit card by knowing his/her token is?

[@professormesser]

The tokens are only good for one use, so any transactions using a previous token would be rejected.

[@theirresistableE]

so tokenization can only be used with a phone or similar device to interact with the token service server? It won't work when using the chip or slide on a plastic card itself, for example?

[@professormesser]

That's correct, the card is going to use the actual card numbers for the transaction instead of a token.

[@tatertotbot]

After learning about these attacks from your videos, it seems like Target is quite the target!

[@reversed5552]

We love to hate Target

[@truittdetra4239]

@@reversed5552 FR FR

[@triciayoung9584]

ROFLMAO!!🤣

[@mr.e9778]

when it comes to IRM, deos this relate to the Zero-trust, RBAC and other similar access control concepts ?

[@mohammadbrazi7272]

Is the process of tokenization the same if we used the credit card directly to pay instead of our phones?

[@professormesser]

Nope. If you use your credit card, then you're sending your actual credit card information through the system.

[@mohammadbrazi7272]

@@professormesser Thank you Professor!

[@Kovar99YT]

so is tokenization, spoofing the plain text basically ?, because its still plain text and its not encrypted but it is just something else

[@MetaphoricMinds]

@ 9:14, couldn't you just capture the token and replay it? What prevents that from being successful? Or is it a new token every time?

[@professormesser]

A token can't be reused, so even if it was somehow captured it would be worthless.

[@halo2bullseye922]

Thanks for vid!

[@tomkozlowski5205]

Thanks

[@littlemarduk22]

Professor Messer... you gotta do cissp one day