3 ms·
Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data. It's
by codezero 11y ago
Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data.
It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.
- chris_wot 11y agoYou really need to read the PCI-DSS standard before you make comments like that. Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.... At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.
- codezero 11y agoGot it, thanks for the link.
- chris_wot 11y agoIt was in my original post!
- codezero 11y agoI didn't follow every link you included, and didn't expect to argue about this – also, I didn't realize this was your post, my bad! You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.
- syed99 11y agoIf they were using stripe how did they pass details through onto HTTP? as far as I remember their webhook won't even communicate with an unsecure page. They must be using some other payment gateway.