Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct openID login server?

share|improve this question
Is the Open ID authentication being used to access the card holder data? – w.c Sep 11 '12 at 15:38
it wouldn't be to access the data, but to use it for future purchases. – Jonny White Sep 11 '12 at 15:41

1 Answer

up vote 1 down vote

For use by consumers, I believe you should be ok, but for use by employee's you'd potentially run afoul of PCI-DSS requirement 8.5. OpenID provides an authentication mechanism independent of data and validates a user matches with the unique ID assigned to the user within your system. For non-consumer users there are additional requirements for password complexity and changes that might not be enforced by a third party OpenID system, however for the consumer users (whose information is being protected), it seems to be allowable to let them use an OpenID to authenticate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.