Tag Info

New answers tagged

0

No not really. First of all most banks have a system that likely uses big data to predict your spending pattern. This means any suspicious purchase abroad is likely to get rejected even without 3D secure. 3D Secure is a good way to protect since it provides 2 step verification with a OTP. In UK we have a system with the same name but we simply set a ...


2

Yes, it's a violation of PCI-DSS Requirements, specifically requirement 3.4: Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN) Truncation (hashing cannot be used to ...


0

Yes, you can't write out unencrypted PAN. If someone could force a crash while that file is being worked on, it would leave it sitting around on the server for anyone to access and the file could potentially be read by other processes. There is no such thing as a "temporary" file. There are only permanent files you intend to get rid of soon. Also, ...


1

This is more a security measure for the vendor. Generally speaking, the vendor gets screwed if the transaction is fraudulent, so verifying the purchaser prior to authorizing the transaction is a big plus for the merchant and may also help improve the rates they get for doing the processing. It allows for some level of the benefits of card present ...


0

There is a distinction which must be made between the account and the card. In countries where debit/credit cards have chips, things go the following way when paying in a shop or restaurant: The merchant/waiter shows a payment terminal to the customer. The customer inserts his card into the terminal. Half of the card still sticks out; only the chip is ...


2

There is a difference between using your CC on a machine (ATM, PoS) and online. On a machine you will be identified by the CC number and PIN. If you are using card with a magnetic strip - it can be easily cloned. If you are using chip card, then it's safer, because machines can not read the chip, they can only interact with it and ask it to verify if the ...


1

Since I am a new user and cannot leave a comment, I'll expand on what JekwA said in his previous answer. It's highly unlikely that the issue lies with any PoS system, either online or offline--rather--spyware on one of your devices would be to blame. If I were you I'd resign myself to only using a single device for online transactions, and at all costs ...


1

The first thing I would do is a full audit of any device you enter your card number into. Obviously you can't audit the POS machines at the stores you use, but if it was a store issue, they would have gotten a notice by now. So the problem is probably in the computer(s) you use for online transactions. I'd go to any machine you've typed your number into and ...


0

If you're going to do it, then add some kind of obfuscation. I just guaranteed myself downvotes, but obfuscation is not without value like some will insist. If you assume the system is known, then there is no value. But if the system isn't known, there is absolutely value. An IV used to 'pepper', as Xander put it, would be a form of obfuscation, while not ...


17

I cannot comment on how Stripe does this but I can tell you exactly how Braintree does it (because that is where I work). If I had to guess, Stripe probably uses a similar method. In the Braintree API, we offer a unique number identifier for a credit card. This identifier is a random opaque token that will always be the same for card number stored in our ...


3

tl;dr: It is not possible to do such a thing in a truly secure manner, but it can be done in a "probably good enough" way for being usable and acceptable. Your options are basically some form of encrypted storage (with the risk of encryption keys being stolen, as they need to be present for decryption), or something involving hashing, with the well-known ...


7

The answer will disappoint you: if a service/oracle/hash can tell you if an input number is on file, it can be broken by a very small amount of brute force. Consider that in much of the country, credit cards are issued by relatively few banks in their geographical region. You can learn the BIN numbers for the most popular of these banks quite easily. Let's ...


26

Ok, so if this is a business requirement that you must meet (check to see if a card already exists in the system) this is how I would do it. First, PCI-DSS does allow for a PAN (the primary account number, or credit card number) to be stored in hashed form using "strong cryptography" and they recommend (but do not require) that a salt be used as well. ...


1

You must not store it per the PA-DSS standards defined here: https://www.pcisecuritystandards.org/documents/pa-dss_v2.pdf It states: 1.1 Do not store sensitive authentication data after authorization (even if encrypted): Sensitive authentication data includes the data as cited in the following Requirements 1.1.1 through 1.1.3. In the adjacent ...


15

Hashing credit card numbers is not a substitute for securing the data. If your system isn't secure enough to store raw credit card numbers then it's not secure enough to store CC hashes. Same thing for anything that's a fixed size and limited character set: date of birth, phone number, zip, etc. Credit cards are all sixteen digits and while 10^16 seems ...


1

Yes, you card can be misused at various places. Though, it has never happened to me, I believe there are some websites which accept payments from debit cards without any secure 3D password. All they ask for is CVV and Card#. I would suggest you to block it right away.


1

In answer to: What's the difference between having the card talk to the server directly and having the card tell the point of sale system its details and then communicating with the authorizing server (Which can be done by a magnetic strip or proximity card)? The difference is that end-to-end encryption (also called point-to-point-encryption or P2PE in ...


0

Do you trust the vendors you buy from? They are all bound by PCI-DSS and the penalties for storing it insecurely can be pretty harsh. Older versions of Bluetooth had security problems(2.3 and prior), but if they are using current versions, there aren't known security issues, so it is possible to have a trusted pairing. Is it as strong as having a TPM ...


4

which cards are vulnerable to such abuse? First of all you need to recognize whether the card has RFID capabilities or not. These may be advertised with logos, icons (usually the three curved lines also used to indicate "WiFi" in some contexts), or in writing. You can also check on the supplying bank/company/entity, or look for telltales such as "My ...


0

I know that modern US Passports use RFID technology, not sure about driver license, at least not in FL,CA,TX,SC,AZ,NE,CO or NY. All RFID is vulnerable to RFID hijacking. The best way to protect against this type of attack is to cover the object with aluminum foil. Fortunately, many companies make faraday cage wallets, so we won't necessarily have to cover ...


1

Technically all RFID cards are scannable given the right equipment. Some vendors implement protections like randomly generated keys etc, so the only surefire way to protect your cards is to wrap them in a faraday cage. Aluminium may work, however it really does depend on the strength of the scanner. You can buy scan-proof wallets online.


2

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorization has occurred. In other words the restriction on storing sensitive authentication data applies to post authentication/processing storage. Here is a document from the PCI SSC about data storage requirments. See the "Technical Guidelines for PCI ...


0

EMV was designed to improve the security of card present transactions (i.e. physical purchases and ATM withdrawals) and to prevent magnetic stripe card skimming. It's unfortunate that card not present transactions can still be performed using only information printed on the card. As Akash has mentioned in his answer, there are solutions to that problem, ...


2

That depends on what you mean by "prevented". EMV is only used for transactions where both the card and the cardholder are present; it wasn't designed to improve the security of card not present (CNP) transactions. This has some implications on what an attacker can do with stolen credit card data. Physical transactions If all merchants and cards were ...


0

You need to speak to a QSA. You may not store the CVV. However, incidental storage may occur as part of an approved transactional flow, and that is acceptable if the QSA finds it so. Otherwise, it would be impossible to use CVV in batch transactions.


0

There are certainly (naturally) a lot of details missing here. I am in agreement with DKNUCKLES, and believe you have a process problem. Are you able to sanitize the rationale for the delay through authorization of your cardholder data? You definitely cannot store full track data or the CVV2 number at all.


1

You're not going to be able to do that - you'll need to find another way. If memory serves the PCI DSS framework also states that you can't store a credit card number (or other PAN) in plaintext in it's entirety. You'll need to obfuscate the middle numbers as is show on receipts, so you need to ensure your script will allow you to do that as well.


0

Does it really mean "PIN OK"? In the sense that you entered the correct PIN? My bank uses a similar system. I put the card in the reader, enter my PIN. The bank gives an 8 digit code which I enter in the reader. The reader gives a 8 digit code back. It does not need to know if the entered PIN is correct to generate this code. If I enter the wrong PIN, it ...


3

If your debit card has an EMV chip (almost all chips are based on EMV today), it very likely does know your PIN (or at least how to verify an entered PIN). Whether that capability is actually used depends on the type of transaction and terminal; if the terminal is online capable, it might as well verify the PIN directly with your bank's servers, which also ...


2

They do it because the magnetic strip is read on the removal instead of on insert, and when you remove the card in one rapid motion, it assures a relatively constant reading speed that is least prone to misreads.


6

The way the magnetic stripe reader works is by detecting changes in the magnetic field of the stripe as it passes under/across the head, similar to a magnetic tape head. In fact, mag stripes were invented from magnetic tape. Just like swiping your card at a point-of-sale kiosk, removing the card "quickly" is necessary to read the magnetic field flipping. ...


0

It is likely that the 8 digit code is mathematically related to your pin (i.e. the sum of a certain hash of both arrives at a predefined static value) so that the 8 digit code can serve as a challenge and a way to validate your PIN. One possible way to find out more about the Digipass sequence is to try entering random (presumably incorrect) 8 digit codes: ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...



Top 50 recent answers are included