3 ms·

Thanks. Odd that VISA would let the third party auditors get away with it, until they don't... which I'd hope so in this case. Related: http://serverfault.com/

by teyc 15y ago

Thanks. Odd that VISA would let the third party auditors get away with it, until they don't... which I'd hope so in this case. Related: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants http://serverfault.com/questions/293217/our-security-auditor...

rdtsc 15y ago
It is mostly to cover their behinds not really to protect your data. When it comes to litigation they basically want to point to a piece of paper with your signature on it and say "see they agreed to be compliant" it is not our fault, we did all we could.
- teyc 15y ago
  I saw an Australian company offering tokenising solutions for credit card transactions. Glancing briefly, they talked about replacing credit card number with "tokens" that can be stored on the customer's premises, while the actual card numbers are securely stored on theirs. To me it seems to be a sensible approach to reducing the attack surface or auditable surface. Is this what Stripe does?
  - rdtsc 15y ago
    Visa has the "visa verify" and it is a web service that basically asks extra security questions during authorization. That works online only. Relies on the merchant to provide the extra security. Another thing is temporary one-use credit card numbers. My Discover card as that feature. Of course then it also relies on me to assess the risk of a merchant and go through the steps of getting that number.