Secure Mobile Payments using HTTPS Web App

Question

I'm hoping an expert with PCI compliance knowledge can help answer this question.

We're looking at integrating mobile payments with our application which is HTML5-based for cross-platform reasons. After considering native apps, Square, and others, we're considering simply inserting an HTTPS page that is pulled directly from a payment gateway (like Beanstream). This is to allow our customers to accept a credit card payment while our company is hands-off any sensitive data.

Can anyone elaborate the security risks? For instance, what is the risk of keylogging on an iPhone or Android device?

Thanks.

Answer 1

If you are using a 3rd party as a payment processor, then you don't need to directly interact with credit card data and there for the PCI-DSS doesn't apply to you. This is really good for you because its expensive to meet all of the requirements, even if your software is 100% complaint. There are a number of payment services that redirect the customer to the payment processor, amazon FPS, paypal payflow, ect. These are great services for start-ups, because they have virtually no security requirements. This is because there is very little security impact posed by a flaw in your system. However, when your company gets large enough. Then you can get a better rate for transactions by becoming PCI complaint.

In terms of risks, such as malware on the device. There is really not a whole lot you can do about it, and the PCI-DSS isn't going to hold you accountable. If any thing the credit card industry looks for ways to blame the customer for such things. A good example is the Chip and Pin Liability issues. The bottom line is that credit card industry wants merchants to be successful.

Answer 2

Is the HTML5 application loaded in a mobile browser or using WebView Canvas. Browsers acts as a sandbox, but an HTML 5 App opened using WebView no longer has the same security, but it can be made most secure by following some of the guidelines listed in the link below.

http://www.acsac.org/2011/openconf/modules/request.php?module=oc_program&action=view.php&a=&id=111&type=2&OPENCONF=e319837c671fd746a922ba2662e19fca

Some of the highlights:

1. All the pages you load in the webview should be from a source you agree to trust. So loading a facebook page or a forum page or similar page is not secure.
2. Only load trusted page in webview. For all others open in web browser
3. Make sure the HTML 5 app has minimal permissions (don't allow access to camera or contacts in the phone unless absolutely needed).
4. Don't load a any page in your app which has advertisements unless you are willing to trust them, which I think you should not for an app which accepts payment. Even if the ad was served on one of your previous page and not on the payment page (enter credit cards), the WebView model in Android and iPhone allows access across content of multiple pages...(see the link for detailed explaination).

Bottomline: The app should only load pages in webview which you absolutely trust.

I check the PCI compliance docs, there is no current explicit guidelines for how to accept PCI data in a Mobile application and they are working on creating a guidelines for it (as of Dec, 2011). Until then, follow as much of PCI guidelines as possible like never store private data on the phone and others.

I hope the above was helpful. I have been searching doe PCI compliance guideline for HTML 5 app opened in WebView for the last 3-4 days.

Thanks,