3 ms·
Don't VISA et al require some kind of PCI compliance for storing credit card details?
by teyc 15y ago
Don't VISA et al require some kind of PCI compliance for storing credit card details?
- jacquesm 15y agoPCI compliance is worth as much as the party that signs off on you being compliant, in most cases that is you. Audits are few and far between, lots of places have shoddy security but claim they are Fort Knox. PCI compliancy is quite meaningless unless the people that implement it take their job seriously. That's very frequently not the case, it is just seen as a small obstacle in the way of doing business.
- teyc 15y agoThanks. Odd that VISA would let the third party auditors get away with it, until they don't... which I'd hope so in this case. Related: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants http://serverfault.com/questions/293217/our-security-auditor...
- rdtsc 15y agoIt is mostly to cover their behinds not really to protect your data. When it comes to litigation they basically want to point to a piece of paper with your signature on it and say "see they agreed to be compliant" it is not our fault, we did all we could.
- teyc 15y agoI saw an Australian company offering tokenising solutions for credit card transactions. Glancing briefly, they talked about replacing credit card number with "tokens" that can be stored on the customer's premises, while the actual card numbers are securely stored on theirs. To me it seems to be a sensible approach to reducing the attack surface or auditable surface. Is this what Stripe does?
- rdtsc 15y agoVisa has the "visa verify" and it is a web service that basically asks extra security questions during authorization. That works online only. Relies on the merchant to provide the extra security. Another thing is temporary one-use credit card numbers. My Discover card as that feature. Of course then it also relies on me to assess the risk of a merchant and go through the steps of getting that number.
- deleted 15y ago[deleted]
- MichaelSalib 15y agoBelieve it or not, there are entire industries that get a sweetheart deal on PCI compliance where companies can be certified compliant without actually complying with the rules. Think airlines and ancient mainframes that can't handle real disk or network encryption.
- teyc 15y agoOh dear. And I thought the internet is a safe place for credit cards. Why would hackers want to execute MOTM when servers are sitting ducks?