4 ms·
This pattern can be recommended so long as there is no liability for financial information disclosure. When you're hacked and a customer who closed their accou
by yborg 10y ago
This pattern can be recommended so long as there is no liability for financial information disclosure. When you're hacked and a customer who closed their account 2 years ago has their CC info used for fraudulent transactions, you just trollface and move on.
This is why I am baffled as to why the CC companies eliminated the transient number technology, which was pefect for e-commerce vendors like this. At least with those, after 3-6-12 months the number expires and no damage done when the vendor is hacked. I assume it was dropped because this technology complicated data mining.
- vertex-four 10y agoNote that in the case of Stripe, the site doesn't hold onto "financial information" per se - they hold onto tokens where Stripe is the holder of the information, and they can't access the card number or CVV after it's been sent to Stripe - so all fraudulent transactions would have to be requested through that Stripe account.
- hdhzy 10y agoThey shouldn't have access to card number and CVV either way because usually they are not PCI-DSS certified. Stripe handles that in an iframe (requirement of PCI). CVV cannot be stored at all even by Stripe.
- nodesocket 10y agoIf using Stripe, Braintree, etc you should never ever be storing any financial data.