4 ms·

Tangentially: Why do merchants really need to store CC numbers? From the consumers' standpoint, there would be no difference if, during the first transaction,

by cmsmith 13y ago

Tangentially: Why do merchants really need to store CC numbers? From the consumers' standpoint, there would be no difference if, during the first transaction, the merchant is issued some alterate key with which to charge the account. Each merchant would be issued their own key, so there would be no risk of a security breach spreading outside of the merchant.

bluelu 13y ago
Hetzner, which was hacked today, did so. They got a unique id back from their payment provider which they stored in their database in order to bill. Depending on your payment provider, you will be however locked in and can't change anymore.
wr0ng 13y ago
Mostly they don't. The payment provider stores this and provides that and the truncated PAN (the card number with digits masked by asterisks). One of the things you pay payment providers for is for taking on the risk of the higher levels of PCI compliance.
bifrost 13y ago
> Why do merchants really need to store CC numbers? They need to store them transitionally to use them, but in general you don't really want to keep it around. The only legit reason is for subscription/recurring based charges, but if you're doing that you want to make damn sure you're not stupid with how you store them. Stripe makes it super easy to never even see a CC, so I use them for a bunch of stuff, you can even do reocurring charges pretty easily. If you have any doubts about storing data safely, DO NOT DO IT.
dangrossman 13y ago
This creates lock-in with whatever company is storing the cards. Let's say you let PayPal store all your cards and you only had tokens. Now, you want to switch to Stripe, but you'd have to re-acquire the cards from all your customers to do so. If you're doing recurring billing, you're going to lose a significant percentage of your revenue doing this, perhaps so much that it's not feasible to switch even though you're unhappy with your current processor.

by cmsmith 13y ago

bluelu 13y ago

Hetzner, which was hacked today, did so. They got a unique id back from their payment provider which they stored in their database in order to bill. Depending on your payment provider, you will be however locked in and can't change anymore.

wr0ng 13y ago

Mostly they don't. The payment provider stores this and provides that and the truncated PAN (the card number with digits masked by asterisks). One of the things you pay payment providers for is for taking on the risk of the higher levels of PCI compliance.

bifrost 13y ago

> Why do merchants really need to store CC numbers? They need to store them transitionally to use them, but in general you don't really want to keep it around. The only legit reason is for subscription/recurring based charges, but if you're doing that you want to make damn sure you're not stupid with how you store them. Stripe makes it super easy to never even see a CC, so I use them for a bunch of stuff, you can even do reocurring charges pretty easily. If you have any doubts about storing data safely, DO NOT DO IT.

dangrossman 13y ago

This creates lock-in with whatever company is storing the cards. Let's say you let PayPal store all your cards and you only had tokens. Now, you want to switch to Stripe, but you'd have to re-acquire the cards from all your customers to do so. If you're doing recurring billing, you're going to lose a significant percentage of your revenue doing this, perhaps so much that it's not feasible to switch even though you're unhappy with your current processor.