3 ms·

If dish is hacked and their credit cards on file are stolen, yours will not be one of them.

• leeoniya 12y ago
  merchants should not store credit cards in any form. pretty much every payment processor / gateway allows you to create payment profiles with reference ids which you can store and reuse later to process additional payments. if DISH got hacked, all the hacker should be able to get are useless payment profile ids. EDIT: i hope everyone who's downvoting me does extensive pen testing and security audits on their servers/network. storing even properly encrypted card info is a huge liability.
  • gnaritas 12y ago
    If processor is hacked and their credit cards on file are stolen, yours will not be one of them. And merchants often store cards despite processor vaults being available; the recent Target hack should make it clear that saying merchants shouldn't store cards is a non-answer.
    • enmaku 12y ago
      Former Verifone employee here: While it's technically true that pay-by-reference is a thing most payment processors offer it's not supported by most payment processing software and most processors treat it like a premium service. The vast majority of recurring credit card payments are sadly still done by storing an encrypted card number and decrypting it every time payment is made. Adding insult to injury, most payment processing software also only conforms to the bare minimum encryption requirement meaning your credit card information is only encrypted using 3DES, keying 3 (meaning a whopping 56 bit key). You can attribute this poor security to laziness since that's the same encryption mechanism PINpads use so the CC co devs already had that code laying around to repurpose. Of course I have no idea what software Dish uses, who their processor is and what those two things allow/support. Dish may actually be using proper pay-by-reference transactions or they may not, I have no idea. None of this changes the fact that a payment system where you must reveal your secret key (cc#) in order to spend is inherently flawed, poorly designed and will be frequently compromised at every link in the chain. It's just a bad security design from the ground up.
    • leeoniya 12y ago
      the Target hack was not a hack of the payment processor. it was malware that effectively MITM'd the swipes and stored them on target's compromised servers. so whether the cards were stored by the merchant or not would have been irrelevant. > If processor is hacked and their credit cards on file are stolen, yours will not be one of them. i'll put my money on the merchant being hacked before a payment processor whose business IS data security.
      • gnaritas 12y ago
        All still problems Bitcoin would have avoided.
  • skolor 12y ago
    Consider the case where the hacker gets in and sits on a machine that processes cards for a week. With bitcoin, the only people who would lose money is Dish, the users wouldn't have any direct effect.
  • tzs 12y ago
    A problem with pay by reference is that it locks you into that processor for future recurring payments on that card. If you are selling something in a fairly high risk category, there is a lot to be said for keeping options open.
• deleted 12y ago
  [deleted]