Tag Info

New answers tagged

0

Yes, use these functions to encrypt & decrypt the data from the DB. static function encrypt($s) { $keyHex = getenv('APP_KEY'); if (!$keyHex) { Yii::error ("Could not retrieve environment variable APP_KEY"); return null; } $key = pack('H*', $keyHex); $iv = mcrypt_create_iv(256/8); // 256 bit / 8 bit/byte = 32 ...


1

I recommend that you strongly consider paying a third party for the security, because it will probably be the most fiscally responsible solution. If you handle the payment card data yourself, you will be responsible for PCI audits, which can be very expensive. And after the upcoming October 2015 liability shift (assuming you are in the U.S.A.), the weakest ...


1

The password is hashed with bcrypt, and the public and private keys are stored alongside the password hash in the user table. Storing the private key means a compromise of the database would allow attacker to decrypt the bank information. You might as well store the bank information in plain text. Why exactly would the bank information need to be ...


1

You can try to update your web browser and maybe plugins. If your browser supports it, you can disable weak ciphers and apply custom order to ciphersuite. This can help you in this: https://www.ssllabs.com/ Everything else must be done at the server side.


3

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


0

Banks are not places where creativity is rewarded, or where change is part of the culture. In addition, the financial industry isn't well known for treating employees well, so talent tends to leave. For these reasons, banks operate like dinosaurs. They don't have to innovate, so they don't. I wouldn't be too sure that breaches don't occur, since the ...


1

They have little incentive to do so. They have insurance policies covering the frauds. If the cost of fixing X hole is bigger than the fraud loses, they may not be too motivated in fixing it. There's no legislation forcing them to support those technologies (Forward Secrecy, TLS 1.2, etc) There's no pressure from the users to better ways, and so they can ...


8

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...



Top 50 recent answers are included