3 ms·

If someone injects javascript into your page, nothing you do will matter -- you are compromised. This is why your site has to be served over SSL (to prevent MI

by boucher 15y ago

If someone injects javascript into your page, nothing you do will matter -- you are compromised. This is why your site has to be served over SSL (to prevent MITM attacks), and why you should be careful about what third party content you embed in your site. In particular, you should never embed a non SSL resource on an SSL page (also known as the mixed content warning in most browsers).

andrewingram 15y ago
But say you have a untrustworthy employees (it happens), as long as they have the ability to deploy code, they can compromise your site. So my question is, to what extent can a solution like Slice (or Braintree) truly alleviate the PCI burden, surely you'd still need a record of who has the ability to deploy code, audit trail for deploys etc. Obviously you should be doing all this stuff anyway. I guess the point I'm making is that solutions like this make great claims about their ability to solve all your PCI woes, and I'm wondering about the extent to which this is actually true. PCI compliance is (normally) quite expensive to achieve, so your solution is obviously very attractive. But is it enough?
- boucher 15y ago
  No third party could completely protect you from an untrustworthy employee, but that doesn't automatically subject you to every theoretical PCI requirement. If you have a malicious employee, you'll be liable for the damage that employee causes, yes. But using something like Stripe.js reduces even that risk, because it reduces the potential surface area of an internal attack as much as it reduces the possibility of external attacks.
- mikey_p 15y ago
  >But say you have a untrustworthy employees (it happens), Well that's still a PCI requirement, but many more of their requirements wouldn't apply (i.e. rendering stored PAN unreadable, etc). When in doubt: http://www.youtube.com/watch?v=xpfCr4By71U http://www.youtube.com/watch?v=xpfCr4By71U
  - boucher 15y ago
    Rumored cost of this video is over 1 million dollars.

by boucher 15y ago

andrewingram 15y ago

But say you have a untrustworthy employees (it happens), as long as they have the ability to deploy code, they can compromise your site. So my question is, to what extent can a solution like Slice (or Braintree) truly alleviate the PCI burden, surely you'd still need a record of who has the ability to deploy code, audit trail for deploys etc. Obviously you should be doing all this stuff anyway. I guess the point I'm making is that solutions like this make great claims about their ability to solve all your PCI woes, and I'm wondering about the extent to which this is actually true. PCI compliance is (normally) quite expensive to achieve, so your solution is obviously very attractive. But is it enough?

boucher 15y ago
No third party could completely protect you from an untrustworthy employee, but that doesn't automatically subject you to every theoretical PCI requirement. If you have a malicious employee, you'll be liable for the damage that employee causes, yes. But using something like Stripe.js reduces even that risk, because it reduces the potential surface area of an internal attack as much as it reduces the possibility of external attacks.
mikey_p 15y ago
>But say you have a untrustworthy employees (it happens), Well that's still a PCI requirement, but many more of their requirements wouldn't apply (i.e. rendering stored PAN unreadable, etc). When in doubt: http://www.youtube.com/watch?v=xpfCr4By71U http://www.youtube.com/watch?v=xpfCr4By71U
- boucher 15y ago
  Rumored cost of this video is over 1 million dollars.