3 ms·

My bullshit detector was sitting firmly at maximum until your post, now I'm not so sure. I thought that surely and auditor couldn't be asking for plain text pas

My bullshit detector was sitting firmly at maximum until your post, now I'm not so sure. I thought that surely and auditor couldn't be asking for plain text passwords, let alone the rest, and maybe this was just a massive troll by the OP. Perhaps not. I've dealt with Data Protection before but I'm not sure of the legality around attempting to get others to breach the law. This 'audit' sounds very much like a phishing scam so perhaps there's legislation that would put this situation outside the law? In any case, I am always extremely cautious about naming and shaming so you should think carefully about answering calls to do so, but there does come a point where whistle-blowing on a massive potential security problem this sort of audit is encouraging is in the public interest.

madaxe_again 10y ago
I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in the clients'. Like I said, there are good PCI QSAs out there, but there are also plenty who'll make you want to jump off a bridge. In my opinion it's made the entire standard a total joke. Bully the web provider, ignore the bricks and mortar "write the credit card number and cvv in a ring binder 'process'". Does the retailer no good either, apart from making them feel secure, as that cost so much it must have been good, right? Right?! Yes, I'm bitter.
- mcherm 10y ago
  Publicly shaming them on Hacker News is one thing, but PCI compliance reviewers are certified; the individual can be reported to the governing agency.
  - Normal_gaussian 10y ago
    s/can/should/ I would say we have a social responsibility to do so
    - akshatpradhan 10y ago
      Exactly, and if you feel there's isn't a safe place to discuss social responsibility regarding PCI and HIPAA, you can check out http://www.reddit.com/r/hipaa http://www.reddit.com/r/hipaa (250+ redditors) https://www.reddit.com/r/pcicompliance https://www.reddit.com/r/pcicompliance (250+ redditors) As well as ##CompSec in irc.freenode.org

madaxe_again 10y ago

I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in the clients'. Like I said, there are good PCI QSAs out there, but there are also plenty who'll make you want to jump off a bridge. In my opinion it's made the entire standard a total joke. Bully the web provider, ignore the bricks and mortar "write the credit card number and cvv in a ring binder 'process'". Does the retailer no good either, apart from making them feel secure, as that cost so much it must have been good, right? Right?! Yes, I'm bitter.

mcherm 10y ago
Publicly shaming them on Hacker News is one thing, but PCI compliance reviewers are certified; the individual can be reported to the governing agency.
- Normal_gaussian 10y ago
  s/can/should/ I would say we have a social responsibility to do so
  - akshatpradhan 10y ago
    Exactly, and if you feel there's isn't a safe place to discuss social responsibility regarding PCI and HIPAA, you can check out http://www.reddit.com/r/hipaa http://www.reddit.com/r/hipaa (250+ redditors) https://www.reddit.com/r/pcicompliance https://www.reddit.com/r/pcicompliance (250+ redditors) As well as ##CompSec in irc.freenode.org