3 ms·
Even if they had to, they would be. Everything transmitted over a public network is encrypted. What assume they probably do is: Browser compress data -> Browse
by Coincoin 14y ago
Even if they had to, they would be. Everything transmitted over a public network is encrypted.
What assume they probably do is:
Browser compress data -> Browser encrypt data for transmission to proxy -> Browser transmit encrypted data to proxy -> Proxy receive and decrypt the data -> Proxy decompress de data -> Proxy reencrypt the data for transmission to server -> Proxy transmit encrypted data -> Server receive and decrypt data
I could be wrong but, at no point are the unencrypted data transmitted over a public network. The only places the data are not encrypted is on the client, the proxy and the server.
You are already trusting Nokia party on the client side, they assumed you could also trust them on their proxy without asking you, which is moraly questionable, but surely not illegal.
EDIT: Missing step above
- Firehed 14y agoMerely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory. Of course because they're not processing the payments, there's not a damn thing the networks can do to stop them; compliance can only be enforced when there's something to turn off (your merchant account) when you're not compliant. That's not the case here.