4 ms·

Think of all the small 1-2 employee businesses / mom & pop businesses etc that take credit cards. They have no dedicated IT person. They’d be lucky to have a de

Think of all the small 1-2 employee businesses / mom & pop businesses etc that take credit cards. They have no dedicated IT person. They’d be lucky to have a dedicated LAN for payments (a PCI DSS requirement). Increasing the barriers to compliance for these people is not a good thing. In practice they will just close their eyes and pretend nothing is wrong, or they will just pay the fine charges by the banks for non compliance— which doesn’t improve your credit card security at all. You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance.

growse 8y ago
1-2 person businesses are likely outsourcing the entire problem of payment processing (and thus, the majority of the PCI controls) to a 3rd party like Stripe. The only PCI compliance needed then is an annual self-attestation which basically asks "Did you change your router's default password?" and "do you apply patches?" [1] There may be some mildly masochistic tiny businesses that choose to process / store payment details on their own networks and try to manage all the controls needed for that, but in the presence of so many options for outsourcing the problem, this doesn't seem like a particularly rational decision. > You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance. This is only true if there are no sane alternatives. [1] https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-A.pdf https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_...
- yardstick 8y ago
  For bricks and mortar businesses Stripe won’t help much, still need a chip and PIN reader on premise. Square on the other hand does let you outsource the entire problem of physical card payments to them, at the cost of much higher fees, as they are the merchant of record so you don’t need to be PCI compliant at all. Which is a real worry as that doesn’t give me much confidence when buying from a square “seller”. Their card reader originally didn’t encrypt data, and at least one model that did encrypt could be bypassed via tampering https://www.zdnet.com/article/square-reader-to-card-skimmer-in-less-than-10-minutes/ https://www.zdnet.com/article/square-reader-to-card-skimmer-... and while their current hardware may or may not have issues, they display a distinct lack of concern for local device security. Defense in depth is the way to go, but with Square you can put your Android/iOS device onto any WiFi network and without any security on who else is on it. Likewise you can download any random app that may look innocent enough but is full of exploits (eg an app that claims to help you manage a customer mailing list so you can grab signups on the same device as you take payments, or an app that claims to help with inventory levels, etc).
  - growse 8y ago
    Can you link the PCI requirement that means anyone who simply accepts physical payments needs to TLS-intercept all network traffic?
    - yardstick 8y ago
      See requirement 1.2 of https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-... Only services necessary for the business should be allowed in/out. If the service can’t be firewalled by simple IP:port then you are left with having to use a proxy to enforce the access control.

growse 8y ago

1-2 person businesses are likely outsourcing the entire problem of payment processing (and thus, the majority of the PCI controls) to a 3rd party like Stripe. The only PCI compliance needed then is an annual self-attestation which basically asks "Did you change your router's default password?" and "do you apply patches?" [1] There may be some mildly masochistic tiny businesses that choose to process / store payment details on their own networks and try to manage all the controls needed for that, but in the presence of so many options for outsourcing the problem, this doesn't seem like a particularly rational decision. > You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance. This is only true if there are no sane alternatives. [1] https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-A.pdf https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_...

yardstick 8y ago
For bricks and mortar businesses Stripe won’t help much, still need a chip and PIN reader on premise. Square on the other hand does let you outsource the entire problem of physical card payments to them, at the cost of much higher fees, as they are the merchant of record so you don’t need to be PCI compliant at all. Which is a real worry as that doesn’t give me much confidence when buying from a square “seller”. Their card reader originally didn’t encrypt data, and at least one model that did encrypt could be bypassed via tampering https://www.zdnet.com/article/square-reader-to-card-skimmer-in-less-than-10-minutes/ https://www.zdnet.com/article/square-reader-to-card-skimmer-... and while their current hardware may or may not have issues, they display a distinct lack of concern for local device security. Defense in depth is the way to go, but with Square you can put your Android/iOS device onto any WiFi network and without any security on who else is on it. Likewise you can download any random app that may look innocent enough but is full of exploits (eg an app that claims to help you manage a customer mailing list so you can grab signups on the same device as you take payments, or an app that claims to help with inventory levels, etc).
- growse 8y ago
  Can you link the PCI requirement that means anyone who simply accepts physical payments needs to TLS-intercept all network traffic?
  - yardstick 8y ago
    See requirement 1.2 of https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-... Only services necessary for the business should be allowed in/out. If the service can’t be firewalled by simple IP:port then you are left with having to use a proxy to enforce the access control.