4 ms·
Blogspam. Vendor selling tokenisation says tokenisation is good. How on earth would this stop security being expensive and difficult, as the intro seems to pro
by blowski 5y ago
Blogspam. Vendor selling tokenisation says tokenisation is good.
How on earth would this stop security being expensive and difficult, as the intro seems to promise?
- Animats 5y agoIt's probably useful mostly to companies which want to avoid the security levels needed to comply with the Payment Card Industry Data Security Standard (PCI DSS). Consider a seller with a shopping cart program. One that outsources the collection of the payment data, and gives back a token. The token can be used for billing the customer, but the payor, payee, and maybe the shipping address are encapsulated in the token. So possession of the token only lets you submit new transactions that match on those items. The seller doesn't have to have PCI DSS compliance. This is useful for systems which rebill the customer. They don't have to store the CVV, for which there are high security requirements. If an unauthorized party gets the token, they can cause rebilling, but not buy from others or, hopefully, change the shipping address. Also, in case of trouble, it's easy to invalidate tokens. People have to re-auth, but not get new credit cards. It's a similar concept to OpenID, in some ways.
- uwuemu 5y agoCan't say such things here. Apparently questioning OP's notivation and accusing of bias/spam/astroturfing is against HN rules. ¯\_(ツ)_/¯