2 ms·
You keep a copy of credit card numbers and CVV unencrypted in a database? Why wouldn't you use a third party/gateway to deal with CC data storage?
by blaines 16y ago
You keep a copy of credit card numbers and CVV unencrypted in a database?
Why wouldn't you use a third party/gateway to deal with CC data storage?
- tzs 16y agoWhen you use the gateway to store the CC data, then with most gateways you are stuck doing all future subscription billing on that card through that gateway. For many businesses, that is an unacceptable restriction.
- blaines 16y agoOh well that makes some sense - hopefully other companies are encrypting the data and not storing CVV. The crazy part to me is that these guys are storing this information for years (One of the first rows was from 2002, and the last 2010) and they're not doing any kind of recurring billing/customer profile stuff. So if I make a purchase 10 times my card is stored 10 times. To top it off, I went back on it while writing the client, and I don't even need a password to access data. I can create a valid session by setting a url parameter. :(
- gexla 16y agoHehe, no, I was talking about grabbing a copy of the database. We are assuming no knowledge that the database carries copies of CC #'s, or he wouldn't have done it. ;)