Tag Info

New answers tagged


I've had an auditor recommend Cornell Spider, which is just a hacked together tool that uses some regexp to look for things like SSN, PAN, etc... It works but isn't very polished.


Short version: You seem to be A-EP You seem to be A, based on the specific products referenced, but you should ask your processor(s) to be sure. If by "Amazon Payments JavaScript widget" you mean Amazon Express Checkout, then you're SAQ A-EP, because "elements of the payment page originate from the merchant website". Amazon Payments "Login and Pay" is jut ...


Chip and pin (EMV) credit cards support online PIN verification, which means the PIN has to be stored somewhere (I don't know whether it's at a central location controlled by VISA/MasterCard or at the bank), I assume its hash is stored securely as VISA/MC are usually pretty up to date in terms of security, though it's still very easy to bruteforce a 4-digit ...


Just like store password. Your PIN will be one-way-hashed, salted, and then stored in HSM in an encrypted format. Internal staff would be restricted (using access control policy) to get your PIN info. Even there is a way to get your PIN, it is hashed and hard to get your original PIN number. By this means, your bank would be able to associate your hashed ...


New visa debit card will the pin be the same? also read this answer it is same as you: A second bank card arrived with the same PIN They are probably stored encrypted, for local employees etc, but for an engineer working there it won't be a big problem to get the PIN out of the database. The only place where PIN records are stored is HSM.


effective in securing it from this kind of theft? Threats against credit card information while shopping online are diverse. I would say that your proposal is effective (as oppose to having no effect whatsoever), but the overall threat reduction is small. This technique might be effective in partially mitigating some of the following threats: ...


First, have a look at [this question]. Based on that question, my understanding of bank cards is that the chip card puts it's own accNumber+PIN into a signed message encrypted for the bank's server (probably with some challenge data from the POS to avoid replay attacks) and asks the Point-of-sale (POS) terminal to send this on its behalf. The POS terminal ...

Top 50 recent answers are included