4 ms·
Does the PCI standard make any tangible differentiation between having unencrypted versus encrypted credit information pass through my system? The major advant
by lftl 15y ago
Does the PCI standard make any tangible differentiation between having unencrypted versus encrypted credit information pass through my system?
The major advantage of the transparent redirect and similar implementations at other providers is that the data doesn't pass through my server at all. To me this always seemed like a bit of a loophole in PCI compliance. My server that serves up the form which, if hacked, could easily be modified to send credit card details to an attacker is out of scope because it doesn't technically, "accept, transmit or receive" as worded in the PCI docs. Does receiving the data in encrypted format still afford me use of the loophole or are the PCI requirements more stringent than when using transparent redirect?
- dan_manges 15y agoThe PCI DSS does differentiate between handling encrypted data and handling unencrypted data -- some requirements are only in scope if handling unencrypted data. It's important to note that Transparent Redirect doesn't remove the need for a merchant to become PCI compliant, it only reduces the scope of what's necessary to achieve compliance. It's true that if your form is hacked it could be modified to send credit card details to an attacker. But that's also true even if you're redirecting the user to a third party page like Paypal to complete the payment. If hacked, somebody could change the Paypal button to redirect to a malicious page.
- boucher 15y agoAbsolutely. Any page in the process served without SSL introduces a vulnerability. None of that is explicitly within the scope of PCI.