lsh123

78 ms·

781.
by lsh123 14y ago
Absolutely, there are different levels. However, for all levels you have to do some work to achieve PCI compliance (and overall security of your system). There is no magic in this world :)
782.
by lsh123 14y ago
Please read stripe's TOS - your application is REQUIRED to be PCI compliant.
783.
by lsh123 14y ago
The funny part - cloudflare still hosts DNS for UGNazi Domain Name: UGNAZI.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: LEE.NS.CLOUDFLARE.COM Name Server: RUTH.NS.
784.
by lsh123 14y ago
The funny part - cloudflare still hosts the DNS for the guys who claim responsibility for this attack: Domain Name: UGNAZI.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server
785.
by lsh123 14y ago
... if you want to pay with bank account and allow some small startup to charge it w/o you having any control over it or any way to dispute the charge with your bank
786.
by lsh123 15y ago
BS. The BEAST attack requires first injecting JS into the browser which in turns requires being man-in-the-middle. After that all bets are off and there are easier ways to hack the system. Moreover, the only known solution on the server sid
787.
by lsh123 15y ago
The OCSP is used to ensure that in case of security breach the certificate can be revoked dynamically. If you don't care about the "dynamic" part then you can skip the whole OCSP process all together. Now you are in the same state as you wi
788.
by lsh123 15y ago
I guess I never bothered to look at anything below level 1 :)
789.
by lsh123 15y ago
I am not familiar with A/B/C/D levels but PCI spec clearly defines PCI 1-4 levels based on volume/number of payments: http://www.pcicomplianceguide.org/pcifaqs.php#5
790.
by lsh123 15y ago
Someone already said in this discussion that PCI compliance is a legal term :) To some degree, it is a deal between you and your QSA (or you again if you are doing self-assessment). I heard about a few businesses that accept credit card num
791.
by lsh123 15y ago
You might want to talk to your PCI QSA to get a professional opinion. My views are explained here: http://news.ycombinator.com/item?id=3332001 Said that, you might want to think beyond PCI. Security is as strong as your weakest link and y
792.
by lsh123 15y ago
I think the better description would be: You are on the hook as soon as your code touches credit card data.
793.
by lsh123 15y ago
Interestingly, PayPal actually offers (or offered?) an iFrame checkout for some customers and it was confirmed to be PCI-compliant. But again, another PCI auditor might have another opinion on it :)
794.
by lsh123 15y ago
Disclaimer: I work for WePay and I am directly responsible for WePay's PCI audit process I am sure everyone would agree that PCI spec is complex and not easy to understand :) Said that, its intention is pretty clear: protect credit card inf
795.
by lsh123 15y ago
Just make sure you still do your PCI compliance audit if you use Stripe.
796.
by lsh123 15y ago
The (partial) solution to this problem is very well known and is already implemented by SSH and several other packages that rely on public cryptography: 1) When user visits a new site, the certificate is presented to the user for inspecti
797.
by lsh123 15y ago
https://secure.wikimedia.org/wikipedia/en/wiki/Wildcard_DNS_...
798.
by lsh123 15y ago
Facebook did, a few years ago