5 ms·
I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with
by maxlybbert 9y ago
I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).
- lsaferite 9y ago> PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back) How about impossible. Storing the CVV number is 100% not allowed. Even storing complete cards numbers is only allowed under very specific conditions. Any deviation opens them up to liability for related fraud.
- CWuestefeld 9y agoEven storing complete cards numbers is only allowed under very specific conditions. We encrypt these at the app, even before putting them into the DB, yada yada. The PCI auditor actually made us restore the DB from backup onto another server and show them the data, to prove that some magical process in the backup program didn't cause them to come un-encrypted. They also wanted us to change all corporate email addresses to random characters, ostensibly to prevent spearfishing (we declined to take this suggestion). My point is that they go to crazy lengths to ensure you're doing this stuff right.
- lsaferite 9y agoI find PCI compliance annoying mostly due to individual auditor predilections.
- CWuestefeld 9y agoI've heard that there's a fair amount of variability. Obviously at least part of our audit team were lunatics.
- maxlybbert 9y agoThank you. I didn’t remember the details and went with “hard” because whenever I say “impossible” somebody will come up with some exception to the rule.