5 ms·

This. Entirely. I used to work for a small ecommerce webdev shop. I’ve worked on sooo many shitty insecure shopping carts over the years I simply know not to t

by donatj 9y ago

This. Entirely. I used to work for a small ecommerce webdev shop. I’ve worked on sooo many shitty insecure shopping carts over the years I simply know not to trust basically any small website asking for my card. Completely unencrypted, storing CVVs, sending CC details as GET parameters, I’ve seen it all. It’s painfully common! If a company is not a huge name, and is handling your credit card info themselves, they are mishandling your credit card information in one way or another. I guarantee it. Having been through PCI compliance, it’s no joke. It’s really not worth doing yourself in my strong opinion.

marcell 9y ago
> If a company is not a huge name Not to be snarky, but a huge name is no guarantee of safety. See: Target, Equifax.
- DrScump 9y ago
  Even eBay itself (PayPal's parent) had a major password hack in 2014.
  - Al-Khwarizmi 9y ago
    However, the advantage of PayPal is that I can buy from multiple websites while only needing to trust one entity with my credit card information. If trusting one entity can already be insecure, having to trust dozens of them is nuts.
- bdhess 9y ago
  Parent didn’t say that. You assumed the converse.
kinkrtyavimoodh 9y ago
> sending CC details as GET parameters facepalm
- dang 9y ago
  Could you please stop posting unsubstantive comments to Hacker News? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
reacharavindh 9y ago
This. I wish there was a fundamentally different way of handling payments. Something like a one time hash you give the vendor that serves like a digital check(cheque). This way, if they lose the hash they lost their money instead of the customer's. Handing a merchant credit card details "feels" like handing them a blank Check and trusting them to not take more than they should because of the risk of them losing the data. Edit: The digital hash should say where money comes from, to who, for what purpose, time, auth code and so on. I live in Denmark, and they have a system of phone banking here called "Mobile Pay" it works kind of like that. Where you transfer money to the merchant public phone number and show them proof of sending.. However it only works for in-person payments where you can swing your phone to show.
- jobigoud 9y ago
  There are also banks that provide virtual credit cards that can only be used by one merchant and where you specify the max amount and expiration date.
  - reacharavindh 9y ago
    Yeah, but that's like buying a gift card for every merchant. That's a huge inconvenience. I can't buy one for every small website I want to buy stuff from..
    - Already__Taken 9y ago
      It's 2018 we should be generating these on the fly from my encrypted 2FA phone app instantly.
      - diaz 9y ago
        This is a reality in many places already. On the internet I never input any real card details, I go to the app, generate a virtual card with X amount available or for one buy only or for a single merchant for Y amount of time and use the generated card details instead.
tome 9y ago
And why would that matter to me? I've shopped online at small (and large) vendors for 20 years and I've never experienced fraud. Even if I did, the CC company covers it, don't they?
rawfan 9y ago
But these problems don't exist if you use a service like Stripe. You never ever store any confidential customer information on your own servers.
- donatj 9y ago
  Stripe was just getting big as I left for a job in edtech so I never had a chance to work with it. Excuse my ignorance but does it require you to send your card info to the vendors server rather than directly to stripe? If that’s the case you are still wide open to basically every form of bad handling. Just because a vendor doesn’t NEED to store your CC doesn’t mean they’re not out of sheer ignorance or incompetence.
  - dodgrile 9y ago
    Nope, it's designed so that the card details never touch the vendors server. They don't see it to be able to store it.

by donatj 9y ago

marcell 9y ago

> If a company is not a huge name Not to be snarky, but a huge name is no guarantee of safety. See: Target, Equifax.

DrScump 9y ago
Even eBay itself (PayPal's parent) had a major password hack in 2014.
- Al-Khwarizmi 9y ago
  However, the advantage of PayPal is that I can buy from multiple websites while only needing to trust one entity with my credit card information. If trusting one entity can already be insecure, having to trust dozens of them is nuts.
bdhess 9y ago
Parent didn’t say that. You assumed the converse.

kinkrtyavimoodh 9y ago

> sending CC details as GET parameters facepalm

dang 9y ago
Could you please stop posting unsubstantive comments to Hacker News? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

reacharavindh 9y ago

This. I wish there was a fundamentally different way of handling payments. Something like a one time hash you give the vendor that serves like a digital check(cheque). This way, if they lose the hash they lost their money instead of the customer's. Handing a merchant credit card details "feels" like handing them a blank Check and trusting them to not take more than they should because of the risk of them losing the data. Edit: The digital hash should say where money comes from, to who, for what purpose, time, auth code and so on. I live in Denmark, and they have a system of phone banking here called "Mobile Pay" it works kind of like that. Where you transfer money to the merchant public phone number and show them proof of sending.. However it only works for in-person payments where you can swing your phone to show.

jobigoud 9y ago
There are also banks that provide virtual credit cards that can only be used by one merchant and where you specify the max amount and expiration date.
- reacharavindh 9y ago
  Yeah, but that's like buying a gift card for every merchant. That's a huge inconvenience. I can't buy one for every small website I want to buy stuff from..
  - Already__Taken 9y ago
    It's 2018 we should be generating these on the fly from my encrypted 2FA phone app instantly.
    - diaz 9y ago
      This is a reality in many places already. On the internet I never input any real card details, I go to the app, generate a virtual card with X amount available or for one buy only or for a single merchant for Y amount of time and use the generated card details instead.

tome 9y ago

And why would that matter to me? I've shopped online at small (and large) vendors for 20 years and I've never experienced fraud. Even if I did, the CC company covers it, don't they?

rawfan 9y ago

But these problems don't exist if you use a service like Stripe. You never ever store any confidential customer information on your own servers.

donatj 9y ago
Stripe was just getting big as I left for a job in edtech so I never had a chance to work with it. Excuse my ignorance but does it require you to send your card info to the vendors server rather than directly to stripe? If that’s the case you are still wide open to basically every form of bad handling. Just because a vendor doesn’t NEED to store your CC doesn’t mean they’re not out of sheer ignorance or incompetence.
- dodgrile 9y ago
  Nope, it's designed so that the card details never touch the vendors server. They don't see it to be able to store it.