3 ms·

Does this apply to things like Square card readers plugged into an iPhone?

freehunter 7y ago
In that case Square is the payment processor. The vendor using the Square reader is not required to be PCI DSS compliant, only Square is. Same for accepting Paypal, Stripe, etc.
- notyourday 7y ago
  > Same for accepting Paypal, Definitely not the case for Paypal. As soon as the charges cross certain rolling dollar amount, one needs to complete a security assessment that requires AV in addition to a pile of other idiotic things - such as a specific set of signatures returned by the web servers in a scan by TrustWave. Unrecognized signature? Failed! Source: first hand experience.
  - freehunter 7y ago
    Is that Paypal's requirement, or a PCI DSS requirement?
    - notyourday 7y ago
      PCI DSS. Paypal told us it applied to us and we either had to do it or they would block our seven digit monthly charges.
  - bradknowles 7y ago
    I've done PCI/DSS consulting. For the biggest provider of online loan servicing, in fact. Over 80% of all online loans are processed through their system, mostly done as a white-label service for virtually every big bank, credit union, or other financial services provider in existence. The reality of PCI/DSS is a bit more ... complex. What it really comes down to is whatever your auditor says you have to do in order to meet the requirements. And history has already taught us that if your auditor is one of the Big Accounting firms, then they can be ... flexible ... if you're a big enough customer. So, there's the letter of the law, and then there's what you actually have to implement in your code. And the two may have relatively little to do with each other. Just make sure that you document everything you do within an inch of your life and the life of the code in question, so that when there is a breach (and there WILL be a breach), you're not the one that is being left out in the cold.

In that case Square is the payment processor. The vendor using the Square reader is not required to be PCI DSS compliant, only Square is. Same for accepting Paypal, Stripe, etc.

notyourday 7y ago
> Same for accepting Paypal, Definitely not the case for Paypal. As soon as the charges cross certain rolling dollar amount, one needs to complete a security assessment that requires AV in addition to a pile of other idiotic things - such as a specific set of signatures returned by the web servers in a scan by TrustWave. Unrecognized signature? Failed! Source: first hand experience.
- freehunter 7y ago
  Is that Paypal's requirement, or a PCI DSS requirement?
  - notyourday 7y ago
    PCI DSS. Paypal told us it applied to us and we either had to do it or they would block our seven digit monthly charges.
- bradknowles 7y ago
  I've done PCI/DSS consulting. For the biggest provider of online loan servicing, in fact. Over 80% of all online loans are processed through their system, mostly done as a white-label service for virtually every big bank, credit union, or other financial services provider in existence. The reality of PCI/DSS is a bit more ... complex. What it really comes down to is whatever your auditor says you have to do in order to meet the requirements. And history has already taught us that if your auditor is one of the Big Accounting firms, then they can be ... flexible ... if you're a big enough customer. So, there's the letter of the law, and then there's what you actually have to implement in your code. And the two may have relatively little to do with each other. Just make sure that you document everything you do within an inch of your life and the life of the code in question, so that when there is a breach (and there WILL be a breach), you're not the one that is being left out in the cold.