4 ms·

It seems to me that the cost of regulatory/license fees could act as a barrier to competiton, permitting the incumbent to coast while maintaining its monopoly.

It seems to me that the cost of regulatory/license fees could act as a barrier to competiton, permitting the incumbent to coast while maintaining its monopoly. The cost of fees/licenses is just a tax, which is less money a company or start-up could spend on meeting regulations (eg PCI-DSS) or other things that would actually protect customer data. Why is chip-and-pin (which from what I understand would render ineffective this type of breach - track 1 + 2 card data) already common in Europe, but not the U.S.? [sincere question]

tptacek 15y ago
The regulation and fee structure we're talking about is chump change compared to the transaction volume of even some of the newer payment processors. Meanwhile: PCI-DSS is an industry self-regulation scheme that I'd argue is an example of a failed security standard; to support that argument, I'd just go down the list of "PCI Certified" companies who had terrible breaches subsequent to their certification. (It's funny that this comment was downmodded to grey on a thread about a breach at a giant payment processor who had one of the industry's best known firms as their QSA).
- kylebrown 15y ago
  Dwolla, to take a popular payments company as an example, processes an average $1m/day with an average transaction of $500 at a fee of $0.25. An annual revenue of $182,500 hasn't prevented them from (so far) securely and compliantly processing transactions (arguably). And yet companies that charge and spend far more (ostensibly on security) are the ones making news for their data breaches. So why suppose that an arbitrary regulatory cost, whether a nominal fee or a more productive expense, would enhance security?
  - tptacek 15y ago
    What this argument does is look at a profound failure of regulation (payment processors are overseen by PCI QSAs, who in this case signed off on a site that experienced a monumental breach), and then points to a site at random that has not yet experienced a breach to argue that less regulation is needed.
- harshreality 15y ago
  It's possible to go overboard. You could mandate that all credit card data be treated like classified data, no sharing of systems or network domains, label everything, MAC everywhere, encrypt or hash everything at rest... How do you strike a balance between that level of security and the current horrible (I think everyone realizes PCI is horrible) industry self-regulation? a) PCI is lame. b) Auditors audit according to lame PCI standards c) The entire credit card payment scheme is insecure and broken d) Larger companies (payment processors, Citi, or Sony PSN) make juicier targets Doesn't that pretty much sum it up?

tptacek 15y ago

The regulation and fee structure we're talking about is chump change compared to the transaction volume of even some of the newer payment processors. Meanwhile: PCI-DSS is an industry self-regulation scheme that I'd argue is an example of a failed security standard; to support that argument, I'd just go down the list of "PCI Certified" companies who had terrible breaches subsequent to their certification. (It's funny that this comment was downmodded to grey on a thread about a breach at a giant payment processor who had one of the industry's best known firms as their QSA).

kylebrown 15y ago
Dwolla, to take a popular payments company as an example, processes an average $1m/day with an average transaction of $500 at a fee of $0.25. An annual revenue of $182,500 hasn't prevented them from (so far) securely and compliantly processing transactions (arguably). And yet companies that charge and spend far more (ostensibly on security) are the ones making news for their data breaches. So why suppose that an arbitrary regulatory cost, whether a nominal fee or a more productive expense, would enhance security?
- tptacek 15y ago
  What this argument does is look at a profound failure of regulation (payment processors are overseen by PCI QSAs, who in this case signed off on a site that experienced a monumental breach), and then points to a site at random that has not yet experienced a breach to argue that less regulation is needed.
harshreality 15y ago
It's possible to go overboard. You could mandate that all credit card data be treated like classified data, no sharing of systems or network domains, label everything, MAC everywhere, encrypt or hash everything at rest... How do you strike a balance between that level of security and the current horrible (I think everyone realizes PCI is horrible) industry self-regulation? a) PCI is lame. b) Auditors audit according to lame PCI standards c) The entire credit card payment scheme is insecure and broken d) Larger companies (payment processors, Citi, or Sony PSN) make juicier targets Doesn't that pretty much sum it up?