3 ms·

The guy who originally discovered this: http://gaurangkp.wordpress.com/2012/12/05/nokia-proxy/ http://gaurangkp.wordpress.com/2012/12/05/nokia-proxy/ Does any

by welder 14y ago

The guy who originally discovered this: http://gaurangkp.wordpress.com/2012/12/05/nokia-proxy/ http://gaurangkp.wordpress.com/2012/12/05/nokia-proxy/ Does anyone have a reference to a law or regulation this would fall under? Does PCI compliance apply to this situation? If yes, then Nokia is not compliant to requirement 4.1: https://www.pcisecuritystandards.org/documents/Prioritized_Approach_V2.0.pdf https://www.pcisecuritystandards.org/documents/Prioritized_A...

elemeno 14y ago
Why would Nokia care about PCI compliance? That's incumbent on the processor, not all the points inbetween.
Coincoin 14y ago
Even if they had to, they would be. Everything transmitted over a public network is encrypted. What assume they probably do is: Browser compress data -> Browser encrypt data for transmission to proxy -> Browser transmit encrypted data to proxy -> Proxy receive and decrypt the data -> Proxy decompress de data -> Proxy reencrypt the data for transmission to server -> Proxy transmit encrypted data -> Server receive and decrypt data I could be wrong but, at no point are the unencrypted data transmitted over a public network. The only places the data are not encrypted is on the client, the proxy and the server. You are already trusting Nokia party on the client side, they assumed you could also trust them on their proxy without asking you, which is moraly questionable, but surely not illegal. EDIT: Missing step above
- Firehed 14y ago
  Merely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory. Of course because they're not processing the payments, there's not a damn thing the networks can do to stop them; compliance can only be enforced when there's something to turn off (your merchant account) when you're not compliant. That's not the case here.

by welder 14y ago

elemeno 14y ago

Why would Nokia care about PCI compliance? That's incumbent on the processor, not all the points inbetween.

Coincoin 14y ago

Even if they had to, they would be. Everything transmitted over a public network is encrypted. What assume they probably do is: Browser compress data -> Browser encrypt data for transmission to proxy -> Browser transmit encrypted data to proxy -> Proxy receive and decrypt the data -> Proxy decompress de data -> Proxy reencrypt the data for transmission to server -> Proxy transmit encrypted data -> Server receive and decrypt data I could be wrong but, at no point are the unencrypted data transmitted over a public network. The only places the data are not encrypted is on the client, the proxy and the server. You are already trusting Nokia party on the client side, they assumed you could also trust them on their proxy without asking you, which is moraly questionable, but surely not illegal. EDIT: Missing step above

Firehed 14y ago
Merely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory. Of course because they're not processing the payments, there's not a damn thing the networks can do to stop them; compliance can only be enforced when there's something to turn off (your merchant account) when you're not compliant. That's not the case here.