4 ms·
I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a
by cft 4y ago
I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a lot of monetary sense. We would also have lost our merchant accounts very quickly (although CC numbers were not stored, only MD5s, but i suppose they could have been captured from the application's memory after TLS decryption but before MD5 hashing, although this would have been a difficult task even on a rooted server). I am 99.999% confident by observing and recording loads, traffic, logs and other parameters of all servers that there were no intrusions. I understand that there's market size and appeal for bureaucracy and certifications, but i have my own data.
- Fnoord 4y agoDo you save logs? If yes, there's your PII.
- cft 4y agoThankfully, the servers were not in Europe! I said "hardly". It's genuinely amusing how people downvote facts, simply because they don't fit the zeitgeist.
- Fnoord 4y agoNobody mentioned Europe, except you. If you are referring to GDPR this still applies if you host outside of Europe. We disagree webserver logs contain 'hardly any PII'. You may find it insignificant PII, but it does not constitute 'hardly'. IMO its a circumstantial goldmine.
- cft 4y agoIn the US at least one court found that IPs were not PII https://www.huntonprivacyblog.com/2009/07/10/washington-court-rules-that-ip-addresses-are-not-personally-identifiable-information/ https://www.huntonprivacyblog.com/2009/07/10/washington-cour... I am curious who "we" are- a royal plural?
- Fnoord 4y agoAnd in EU, it is. We referred to you and me.
- krallja 4y agoMD5(CC#) is trivially reversed, so I hope that’s not what you were doing.
- booi 4y agoOmg. cft should not be allowed anywhere near credit card numbers.