5 ms·

I am going to sound contrarian, but I don't mean to be. How does this violate PCI-DSS? The data itself is likely stored somewhere secure (who knows) – what's b

I am going to sound contrarian, but I don't mean to be. How does this violate PCI-DSS? The data itself is likely stored somewhere secure (who knows) – what's being displayed in the web app is the last four digits of the card and expiration date, this isn't where it's stored. There is obviously a question of what the retention should be, but it's definitely the case that payment information can be transferred between companies. The whole situation exudes a lack of trust, but it's not clear to me that PCI compliance is a problem here.

chris_wot 11y ago
I thought it was pretty clear, but I'm willing to elaborate. The requirement is that card data is securely removed when it is no longer required. They are no longer billing customers at HomeJoy as the business has been wound up, so the credit card data should have been deleted. Also: no customer has given them any right to have their credit card billed to an entirely new entity. Credit card information should not be transferred due to sale of customer data to an entirely separate legal business entity because no contract of sale has been established between the customer and that new entity.
- codezero 11y ago
  Yeah, I get your position (hopefully!), but I think I'd rather hear from a lawyer whether this is OK or not, my guess is that it is OK. The snippet you pasted says also: ... regulatory, and/or business requirements A business that is going out of business may treat this data as a business asset and may need to retain it for a certain period even when they are inactive. Most terms of service do allow for transfer of account information to third parties, and have contingencies for what happens to the data if the company goes under, and as far as I'm aware, selling that customer data is an option unless they've explicitly said they won't. As long as the credit card data is transferred in a PCI compliant way, it's legal. You're absolutely right that it would be a serious violation if they were to charge someone without their knowledge, it doesn't look like that's happened yet. It's also quite possible the underlying business entity is still Homejoy with a name change. ZenPayroll* didn't have to get people's permission to charge them when they changed their name to Gusto, but it obviously helps to communicate that change very clearly! I am pretty sure we generally agree, though, it's very clear that there are dozens of egregiously bad things being done by Aaron and his team that can only hurt them and their desired future customers. *I said Zenefits :( :(
  - chris_wot 11y ago
    Yeah, you don't need to be a lawyer to implement PCI-DSS. You are entirely missing the following dot point: "Processes for secure deletion of data when no longer needed" Those dot points aren't using a disjunction, they must ALL be followed. The standard is very, very clear on that point: once you don't need the data, you securely delete it. That makes sense, incidentally. If you no longer have the data anywhere, then nobody can get to it even if they compromise your systems and gain access to your credit card lists. If your company winds down and you no longer bill your customers, you are absolutely required by PCI-DSS (and good security practice!) to delete that data. As for HomeJoy being the same legal entity, that's not the way that the email sent from HomeJoy reads. It says that Fly Maids is their partner, not the same organisation. That HomeJoy hasn't done this says to me they are cavalier with their customers data at best. I would not trust them with my credit card details, nor would I be happy letting them into my home.
    - codezero 11y ago
      I'm not entirely missing the point, but I don't know enough about the PCI-DSS to be too much of a contrarian here :) Processes for secure deletion of data when no longer needed Is "needed" defined anywhere? As far as I can tell this requires companies to create a plan – that plan could be very different between companies. I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right? Let me restate what I think you're saying though: When they shut down Homejoy, they should have immediately deleted all the data they had stored in Stripe (or what ever payment system they use)? "That HomeJoy hasn't done this says to me they are cavalier with their customers data at best. I would not trust them with my credit card details, nor would I be happy letting them into my home." Totally agree, maybe let's leave it at that :)
      - chris_wot 11y ago
        Is "needed" defined anywhere? Speechless! I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right? No, Stripe would then be violating PCI-DSS themselves.
- chetanahuja 11y ago
  and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.
  - codezero 11y ago
    Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data. It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.
    - chris_wot 11y ago
      You really need to read the PCI-DSS standard before you make comments like that. Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.... At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.
      - codezero 11y ago
        Got it, thanks for the link.
        chris_wot 11y ago
        It was in my original post!
        codezero 11y ago
        I didn't follow every link you included, and didn't expect to argue about this – also, I didn't realize this was your post, my bad! You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.

chris_wot 11y ago

I thought it was pretty clear, but I'm willing to elaborate. The requirement is that card data is securely removed when it is no longer required. They are no longer billing customers at HomeJoy as the business has been wound up, so the credit card data should have been deleted. Also: no customer has given them any right to have their credit card billed to an entirely new entity. Credit card information should not be transferred due to sale of customer data to an entirely separate legal business entity because no contract of sale has been established between the customer and that new entity.

codezero 11y ago
Yeah, I get your position (hopefully!), but I think I'd rather hear from a lawyer whether this is OK or not, my guess is that it is OK. The snippet you pasted says also: ... regulatory, and/or business requirements A business that is going out of business may treat this data as a business asset and may need to retain it for a certain period even when they are inactive. Most terms of service do allow for transfer of account information to third parties, and have contingencies for what happens to the data if the company goes under, and as far as I'm aware, selling that customer data is an option unless they've explicitly said they won't. As long as the credit card data is transferred in a PCI compliant way, it's legal. You're absolutely right that it would be a serious violation if they were to charge someone without their knowledge, it doesn't look like that's happened yet. It's also quite possible the underlying business entity is still Homejoy with a name change. ZenPayroll* didn't have to get people's permission to charge them when they changed their name to Gusto, but it obviously helps to communicate that change very clearly! I am pretty sure we generally agree, though, it's very clear that there are dozens of egregiously bad things being done by Aaron and his team that can only hurt them and their desired future customers. *I said Zenefits :( :(
- chris_wot 11y ago
  Yeah, you don't need to be a lawyer to implement PCI-DSS. You are entirely missing the following dot point: "Processes for secure deletion of data when no longer needed" Those dot points aren't using a disjunction, they must ALL be followed. The standard is very, very clear on that point: once you don't need the data, you securely delete it. That makes sense, incidentally. If you no longer have the data anywhere, then nobody can get to it even if they compromise your systems and gain access to your credit card lists. If your company winds down and you no longer bill your customers, you are absolutely required by PCI-DSS (and good security practice!) to delete that data. As for HomeJoy being the same legal entity, that's not the way that the email sent from HomeJoy reads. It says that Fly Maids is their partner, not the same organisation. That HomeJoy hasn't done this says to me they are cavalier with their customers data at best. I would not trust them with my credit card details, nor would I be happy letting them into my home.
  - codezero 11y ago
    I'm not entirely missing the point, but I don't know enough about the PCI-DSS to be too much of a contrarian here :) Processes for secure deletion of data when no longer needed Is "needed" defined anywhere? As far as I can tell this requires companies to create a plan – that plan could be very different between companies. I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right? Let me restate what I think you're saying though: When they shut down Homejoy, they should have immediately deleted all the data they had stored in Stripe (or what ever payment system they use)? "That HomeJoy hasn't done this says to me they are cavalier with their customers data at best. I would not trust them with my credit card details, nor would I be happy letting them into my home." Totally agree, maybe let's leave it at that :)
    - chris_wot 11y ago
      Is "needed" defined anywhere? Speechless! I highly doubt Homejoy/Fly Maids is maintaining the data themselves, it's probably stored in Stripe, so unless they are actually storing credit card data in a non PCI compliant way, they are probably fine, right? No, Stripe would then be violating PCI-DSS themselves.
chetanahuja 11y ago
and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.
- codezero 11y ago
  Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data. It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.
  - chris_wot 11y ago
    You really need to read the PCI-DSS standard before you make comments like that. Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.... At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.
    - codezero 11y ago
      Got it, thanks for the link.
      - chris_wot 11y ago
        It was in my original post!
        codezero 11y ago
        I didn't follow every link you included, and didn't expect to argue about this – also, I didn't realize this was your post, my bad! You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.