Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Has anyone worked with eWay payment gateway before?

Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends those detail to the server.

Now, how's that security of anykind? (Please note I'm no security expert. Just a developer) The weakest link of online payment, AFAIK, has always been the consuming party of the service, ie the eCommerce websites themself.

If I were the user, I expect my CC detail to be only handled by the payment gateway, not the web applicatiion. Wasn't that the whole point of a payment gateway? To abstract the security concern from the web application?

share|improve this question
    
Has this answered your question. If not please let us know. –  Bernie White Nov 28 '11 at 20:16
add comment

3 Answers

Agreed, from disclosure of information point of view fewer parties in the transaction process the better.

Specifically to eWAY (with I have not used) I assume you are referring to the Hosted Payment solution (See http://www.eway.com.au/Developer/eway-api/hosted-payment-solution.aspx) where a web service is exposed. eWAY do offer alternatives such as the Shared Payment (See http://www.eway.com.au/Developer/eway-api/shared-payment-solution.aspx) which is the redirect to the payment gateway solution but this may not be available in your specific location.

In the case where you are taking payment details you would need to be PCI-DSS (or equivalent) compliant in addition to the payment gateway. Also you should avoid storing any payment details that could be harvested by an attacker.

From a user’s point of view my personal opinion is they would be more cautious being redirected to a payment gateway that they don’t know then using the payment off the web site. Just something to consider.

In my mind, I would use a payment gateway that handled all the payment details for the purpose of offloading risk.

I hope that helps.

share|improve this answer
add comment

The security idea of passing information through to a payment gateway lies in not having to maintain any card data within your own applications. In that regard, a compromised server can only provide information about card transactions after the fact. It also provides a level of simplicity to the application website where they don't have to develop the code for handling credit card transactions.

share|improve this answer
add comment

The weakest part of credit card security has always been that credit card numbers are stored on servers. If you don't store the numbers on your own servers, then getting hacked will cost you a lot less.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.