4 ms·

I dont think so, this would probably go against PCI DSS.

by Znafon 8y ago

leesalminen 8y ago
I've seen several deterministic tokenizers for payment cards.
- Znafon 8y ago
  Where there done by the payment processor like Artemis2 or in house? I'm asking because I saw a lot of in-house tokenizer with hashes or deterministic encryption that could get reversed in a few seconds by brute force since the space to cover is so small.
unethical_ban 8y ago
The whole point of tokenizing is to get rid of PCI problems on CC analysis and testing, as I understand it.
- Znafon 8y ago
  Is there credit card tokenization services from which you can get a token identifying permanently a card without the possibility to make a payment?
  - nothrabannosir 8y ago
    Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints). https://stripe.com/docs/api/tokens/create_card https://stripe.com/docs/api/tokens/create_card (notice the request has no charge, but the response contains a fingerprint). To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.
Artemis2 8y ago
Most payment gateways offer a card fingerprinting feature. Here’s Stripe’s: https://stripe.com/docs/api/cards/object#card_object-fingerprint https://stripe.com/docs/api/cards/object#card_object-fingerp.... It’s fine with PCI DSS as long as it is not reversible.
1stcity3rdcoast 8y ago
Stripe and Square both identify consumers by their unique CC numbers. If I swipe my card on a square reader, it recognizes me and asks if I want a receipt sent to my phone or email, even if I’ve never purchased from that vendor before.
paulie_a 8y ago
Not really. I work with payment processing, I've got the partially obscured credit card number, usually the name and the location. Plus a bunch of other info.

I dont think so, this would probably go against PCI DSS.

by Znafon 8y ago

I dont think so, this would probably go against PCI DSS.

leesalminen 8y ago

I've seen several deterministic tokenizers for payment cards.

Znafon 8y ago
Where there done by the payment processor like Artemis2 or in house? I'm asking because I saw a lot of in-house tokenizer with hashes or deterministic encryption that could get reversed in a few seconds by brute force since the space to cover is so small.

unethical_ban 8y ago

The whole point of tokenizing is to get rid of PCI problems on CC analysis and testing, as I understand it.

Znafon 8y ago
Is there credit card tokenization services from which you can get a token identifying permanently a card without the possibility to make a payment?
- nothrabannosir 8y ago
  Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints). https://stripe.com/docs/api/tokens/create_card https://stripe.com/docs/api/tokens/create_card (notice the request has no charge, but the response contains a fingerprint). To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.

Artemis2 8y ago

Most payment gateways offer a card fingerprinting feature. Here’s Stripe’s: https://stripe.com/docs/api/cards/object#card_object-fingerprint https://stripe.com/docs/api/cards/object#card_object-fingerp.... It’s fine with PCI DSS as long as it is not reversible.

1stcity3rdcoast 8y ago

Stripe and Square both identify consumers by their unique CC numbers. If I swipe my card on a square reader, it recognizes me and asks if I want a receipt sent to my phone or email, even if I’ve never purchased from that vendor before.

paulie_a 8y ago

Not really. I work with payment processing, I've got the partially obscured credit card number, usually the name and the location. Plus a bunch of other info.