5 ms·

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

nojvek 9y ago
To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.
- tonyedgecombe 9y ago
  This is one area where PayPal has an advantage, you are pushing the payment rather than the vendor pulling it.
- Tistron 9y ago
  Is this not changing though? I can't remember the last time I bought something online without having to either use password or 2factor auth, and there are no places here that do not require a pin code when using a cc in a store. I'm in Sweden though (but using mastercard).
  - the_af 9y ago
    Hmmm, that's interesting. I've never been to Sweden, but pretty much no shops in any country I've ever visited required a pin code for Visa or Amex credit cards. Is this really changing?
    - gambiting 9y ago
      What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.
      - OJFord 9y ago
        I was made to sign my card for the first time ever recently in order to complete an exchange that required a refund and repurchase... Parent comments are talking about online purchases, for which your PIN is not needed.
        the_af 9y ago
        I was talking about brick & mortar shops. Now I've done some reading, and it seems my country (in Latin America) is following US standards. It seems US-issued credit cards only require signatures, even when used abroad, and only recently (as far as I can google it) are they slowly starting to switch to either PIN or chip-based cards. Newly issued cards where I live have chips (this is a relatively recent development), which I'm not sure exactly how are supposed to be safer than magnetic strip cards, and also don't require PINs.
      - the_af 9y ago
        Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa credit card, either. Maybe it's the type of card? I'm talking about credit cards, mind you. Debit cards are different, and while in my country Visa Electron doesn't require anything but a signature, it's entirely possible if I tried to use it abroad they'd ask for a pin code. Not sure.
        Tistron 9y ago
        I believe it is possible to use a cc here without the pin if you show ID and sign a receipt. I think I've seen it for people who've forgotten their code and tourists who don't know their code.
        gambiting 9y ago
        I have both British and Polish debit and credit cards, Visa and Mastercard(Visa Classic credit cards), I've used them in Spain, Germany, Netherlands, France, Spain and Portugal, and literally never had to sign for them, be it in shops or restaurants. I'm not saying there aren't cards that need signing,but I've literally never seen any.
  - tomjen3 9y ago
    There are a couple online stores that requires verified by visa. Just means I don't care to shop there, its a pain.
- djtriptych 9y ago
  All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites. They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assumed passwords might get phished and thought through how to protect users in that case. My credit card numbers are one of my pieces of private information I feel _least_ apprehensive about sharing.
  - krupan 9y ago
    Thing is, you pay for that cc number protection with every transaction. How are you going to pay for the same sort of protection on your password?
r1ch 9y ago
Reminds me of Cloudflare's "Flexible SSL", where backend connections aren't encrypted at all.
- stickfigure 9y ago
  As someone who has used Flexible SSL, it's perfectly reasonable for some threat models. In our case, credit cards and passwords were both managed by external services and the actual data we stored was not sensitive. We really just needed to prevent account hijacking in cafes via Firesheep.

nojvek 9y ago

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

tonyedgecombe 9y ago
This is one area where PayPal has an advantage, you are pushing the payment rather than the vendor pulling it.
Tistron 9y ago
Is this not changing though? I can't remember the last time I bought something online without having to either use password or 2factor auth, and there are no places here that do not require a pin code when using a cc in a store. I'm in Sweden though (but using mastercard).
- the_af 9y ago
  Hmmm, that's interesting. I've never been to Sweden, but pretty much no shops in any country I've ever visited required a pin code for Visa or Amex credit cards. Is this really changing?
  - gambiting 9y ago
    What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.
    - OJFord 9y ago
      I was made to sign my card for the first time ever recently in order to complete an exchange that required a refund and repurchase... Parent comments are talking about online purchases, for which your PIN is not needed.
      - the_af 9y ago
        I was talking about brick & mortar shops. Now I've done some reading, and it seems my country (in Latin America) is following US standards. It seems US-issued credit cards only require signatures, even when used abroad, and only recently (as far as I can google it) are they slowly starting to switch to either PIN or chip-based cards. Newly issued cards where I live have chips (this is a relatively recent development), which I'm not sure exactly how are supposed to be safer than magnetic strip cards, and also don't require PINs.
    - the_af 9y ago
      Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa credit card, either. Maybe it's the type of card? I'm talking about credit cards, mind you. Debit cards are different, and while in my country Visa Electron doesn't require anything but a signature, it's entirely possible if I tried to use it abroad they'd ask for a pin code. Not sure.
      - Tistron 9y ago
        I believe it is possible to use a cc here without the pin if you show ID and sign a receipt. I think I've seen it for people who've forgotten their code and tourists who don't know their code.
      - gambiting 9y ago
        I have both British and Polish debit and credit cards, Visa and Mastercard(Visa Classic credit cards), I've used them in Spain, Germany, Netherlands, France, Spain and Portugal, and literally never had to sign for them, be it in shops or restaurants. I'm not saying there aren't cards that need signing,but I've literally never seen any.
- tomjen3 9y ago
  There are a couple online stores that requires verified by visa. Just means I don't care to shop there, its a pain.
djtriptych 9y ago
All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites. They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assumed passwords might get phished and thought through how to protect users in that case. My credit card numbers are one of my pieces of private information I feel _least_ apprehensive about sharing.
- krupan 9y ago
  Thing is, you pay for that cc number protection with every transaction. How are you going to pay for the same sort of protection on your password?

r1ch 9y ago

Reminds me of Cloudflare's "Flexible SSL", where backend connections aren't encrypted at all.

stickfigure 9y ago
As someone who has used Flexible SSL, it's perfectly reasonable for some threat models. In our case, credit cards and passwords were both managed by external services and the actual data we stored was not sensitive. We really just needed to prevent account hijacking in cafes via Firesheep.