5 ms·
The first four digits are pretty generic. They tell you who issued the card. Many people will have the same first four digits. Maybe the second set of four and
by KGIII 9y ago
The first four digits are pretty generic. They tell you who issued the card. Many people will have the same first four digits. Maybe the second set of four and the last set of four would be better?
Usually the first four is the issuer and whatever numbers signify the specific type of card. The next set is the bank, I think. The third set is, as I recall, the account number, and the last numbers equate to your routing number.
Actually, just the last eight digits should be adequate. Hash them with a salt based on the last name and collisions are very, very unlikely. Don't store them at all, just store the hashes.
- lloydde 9y agoI can’t tell if you are playing, but by storing the most unique part of the credit card with last name you are not reducing the desirability of the target much.
- KGIII 9y agoYou don't store the name. You use the name to generate the salt and hash the results. You only store the hashes.
- lloydde 9y agoYou are still doing a near lossless transformation of the unique part of the credit card and name as one of your goals is zero (minimized) hash collisions. The character set and length of the input plus reasonable assumptions about the salt and hash make it very likely "reversible" using rainbow tables or other brute force techniques. Choose metadata that doesn't have such high financial value. Additionally, it's been years since I've been involved in e-commerce and the details are now foggy, but if I recall storing those addition credit card digits, even transformed, will prevent you from achieving the industrial certifications.