8 ms·

PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issu

• admax88q 7y ago
  > then PCI-DSS is a farce. Take a wild guess on what you think will happen.
  • cryptica 7y ago
    All these regulations are bs. Designed to keep small players out.
    • giancarlostoro 7y ago
      To be fair they are probably not designed specifically for that, the issue is big players are much more likely to have more political leverage. Or is that one much like GDPR? Crazy fines that only big players can afford, in such a case, that was poorly designed.
      • lonelappde 7y ago
        GDPR only charges big fines to big players.
        • giancarlostoro 7y ago
          https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ > Up to €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher I'm no lawyer, but this doesn't sound like it's just for the bigger players, at the minimum you'd be looking at some fines. At minimum you'd be paying 10 million if you incur that amount of fines. I guess it could be argued the 2% is geared towards hurting the big players.
          • tastroder 7y ago
            No lawyer either and I don't know how to parse the legalese of the actual text [0]: "Infringements of the following provisions shall [...] be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:" but reading that as a generic "max(10 million, 2% worldwide annual revenue)" seems unlikely to be correct - especially given all the "up to"s in the sentence. [0] https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ Art. 83(4)
          • buzer 7y ago
            At minimum you would be looking at "nothing". Between that and 2%/10 million there are many possibilities. Requiring to answer questions, warnings, requiring some changes etc. And even once it gets to the fine territory, getting things from the max end is not something that would always happen. Out of documented 208 cases (https://www.enforcementtracker.com/ https://www.enforcementtracker.com/), there have been 6 fines that exceeded 10 million and another 4 that exceeded 1 million. Median seems to be around 10 000.
      • Crosseye_Jack 7y ago
        GDPR max fine is (iirc) 4% of revenue. So if you are a small fish you will be paying less then the big fish. Also the fines are for wilful failure to comply, if you accidentally broke GDPR then your first offence is going to be more a slap on the wrist then an instant 4%.
        • giancarlostoro 7y ago
          Except it says "whichever" is higher, so if they decided to fine you 10 million or 2% of revenue, and your 2% is much lower than 10 million, guess which one you're paying... > Up to €10 million, or 2% of the worldwide annual revenue of the prior financial year, whichever is higher See: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/
          • Crosseye_Jack 7y ago
            GDPR breach fines are discretionary rather than mandatory. They must be imposed on a case-by-case basis and should be “effective, proportionate and dissuasive”. Fining a small mom and pop site 20 mill (20mil/4% is the highest fine depending on the case) is not proportionate, not effective because I would like to see them actually collect on that and I would say such a fine to a mom and pop would be dissuasive of doing business at all which is not that the ICO in the U.K. would want. Speaking of the ICO, their big fine (fucking auto correct) to BA for shockingly bad security earned them a 1.5% fine instead of the max 4% because they worked with the ICO (but the ICO still found they failing in a duty of care to protect data) and have been pushing the fine down the road ever since it was issued, atm the earliest ICO will actually fine BA is next month and it’s been almost a year since they filed their "intent to fine". So while they can throw around heavy fines. It’s not like they run every mom and pop site out of the country.
            • Mirioron 7y ago
              >I would say such a fine to a mom and pop would be dissuasive of doing business at all Welcome to the EU. They've pulled these stunts before. When they introduced changes to digital VAT collection the lawmakers "forgot" that VAT has exemption thresholds. This effectively barred some small and micro businesses from selling their digital services/goods to other EU countries, because the business would not have been exempt from VAT afterwards. It took the lawmakers years to implement a minimum VAT threshold. >It’s not like they run every mom and pop site out of the country. Of course they won't, because people want to do business. There will always be more businesses that get started. The question is whether there will be fewer businesses started because of the regulation. So far analysis after GDPR points to yes.
    • endorphone 7y ago
      They were created for sincere reasons, and with best intentions. In the real world best intentions always conflict with the motivations of individual players. It just isn't reasonable that PayPal would be cut off. That was always a toothless threat, at least for larger players. As an aside, PayPal is a marvel to me because it is effectively lost in time. Using their tools and interface is like stepping back to 1995, and it seems -- from an outsider perspective -- that it must be some duct-taped quagmire that is barely holding on.
      • cptskippy 7y ago
        > They were created for sincere reasons, and with best intentions. No? They were created by the industry to avoid actually being regulated and are a way to shift liability. That doesn't mean they aren't also beneficial, but that's more a side effect than the intention.
        • endorphone 7y ago
          Yes? If we want to be cynical, of course there was a self-serving reason they created the standards -- because fraud, especially "internet" fraud, was on a massive upswing and it threatened this enormous new market of credit card spending. There is no question it's in their self-interest to improve the general condition of transactions.
          • cptskippy 7y ago
            > If we want to be cynical, of course there was a self-serving reason they created the standards It's not cynical, it is literally the reason PCI exists. > Five different programs had been started by card companies... The intentions of each were roughly similar: to create an additional level of protection for card issuers - https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard#History https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
            • endorphone 7y ago
    • cptskippy 7y ago
      I guess you're not at all familiar with the self report nature of PCI audits. The purpose of PCI is to shift liability
• ohithereyou 7y ago
  Are there other cases where PCI-DSS compliance requirements are selectively enforced?
  • rasengan 7y ago
    From this article [1], I get the feeling that PCI-DSS has always been selectively enforced. [1] https://www.anitian.com/the-failure-of-the-pci-dss/ https://www.anitian.com/the-failure-of-the-pci-dss/
• tsukurimashou 7y ago
  no shit PCI-DSS is a farce it's just there to make people that don't know anything about technology feel better
  • tjpnz 7y ago
    It's certainly very effective at providing said people with a false sense of security. It's also another buzzword they can utilize to waste people's time during meetings.
    • tsukurimashou 7y ago
      exactly, it is simply marketing (/ politics) really
    • magduf 7y ago
      It's just like ISO-9001.
• ailideex 7y ago
  > PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed. Quote from your source: > If your scan fails, you must schedule a rescan within 30 days to prove that the critical, high-risk or medium-risk vulnerabilities have been patched. Scan in this sentence refers to "a PCI DSS external scan". The list of approved vendors that can conduct PCI DSS external scans can be found here: https://www.pcisecuritystandards.org/assessors_and_solutions/approved_scanning_vendors https://www.pcisecuritystandards.org/assessors_and_solutions... Please find cybernews' certificate number there and quote it for us, I have looked and can't find it. I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the characteristics of PCI-DSS and your comment just seems wrong. And even if they were an approved scanning vendor, from what little I know about PCI-DSS, these scans are part of larger process - so even if they were an approved scanning vendor the scan failure would still have had to be part of the larger process for this 30 day limit to apply. I could go on and on about how much I hate PayPal and random other things, but just because I don't like something does not quite justify making false claims about it.
  • rasengan 7y ago
    HackerOne states they are a PCI-DSS auditor approved organization [1]. [1] https://www.hackerone.com/product/challenge https://www.hackerone.com/product/challenge
    • empath75 7y ago
      Yeah but someone reporting a vulnerability to HackerOne is not the same as HackerOne reporting it. Otherwise you could just spam HackerOne with reports and remove someone’s compliance.
    • ailideex 7y ago
      > HackerOne states they are a PCI-DSS auditor approved organization Not anywhere on the page you linked. And a "PCI-DSS auditor approved organization" is not a "PCI-DSS approved scanning vendor" which if they were you could just quote the certificate number instead of link to HackerOne. ---- EDIT: I guess you are referring to this: > Meet penetration testing requirements for PCI DSS and SOC2 Type II compliance certifications with our auditor-approved penetration testing methodology and Security Assessment Report. This in no way is the same as claiming "we are a PCI-DSS auditor approved organization". Which again, would be irrelevant if it was the case. ---- Further, if you read the article, it is clear the "We" does not refer to "HackerOne". > When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. As far as I can tell "We" refers to cybernews.com And again even if cybernews was a PCI-DSS approved scanning vendor it would still have to qualify as an official external scan within the PCI-DSS framework.
• znpy 7y ago
  My suspicion is that Paypal is now "too big to fail" and will suffer very little consequences if none at all.
• tptacek 7y ago
  How is this the top comment on the thread? Do people really believe that failing to respond to a self-XSS report on HackerOne to the satisfaction of the reporter would cause someone to lose their PCI certification?
  • rasengan 7y ago
    > failing to respond to a self-XSS report This really downplays the report or shows a complete lack of understanding. Getting access to someone's Paypal account which could potentially mean all their credit cards and banks is definitely an issue that needs to be addressed. This in itself should not be reason to lose PCI certification. However, as the article further indicates [1], failure to respond (or even closing the issue without resolving) is a completely different story. [1] https://cybernews.com/security/we-found-6-critical-paypal-vulnerabilities-and-paypal-punished-us/ https://cybernews.com/security/we-found-6-critical-paypal-vu...
    • tptacek 7y ago
      It's not at all clear to me what you're saying here. Are you making a case that the whole report all put together is impactful? Or are you actually trying to argue that self-XSS is a critical security vulnerability?
      • rasengan 7y ago
        The former; the author's report (short of seeing what was intentionally left out for proper disclosure reason) is credible, and Paypal's failure to respond/remediate the issue is improper. Getting access in this way to users' financial accounts is absolutely a vulnerability.
        • tptacek 7y ago
          They are getting access to the accounts of people who do not have 2FA enabled and whose credentials have been stolen. Every bounty program I've ever paid attention to would close that report. Risk-based anti-ATO systems are heuristic.
• whatsmyusername 7y ago
  PCI-DSS does not have Bug Bounty requirements. That's referring to ASV scans which have to be run quarterly by a specific list of vendors and then there's a dispute/remediation process. Their response is dogshit but not for this reason.
• 87zuhjkas 7y ago
  There is no doubt that the PCI-DSS is a farce.
• rsync 7y ago
  "If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce." PCI Compliance is total bullshit and everybody knows it.[1] [1] https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html