Tag Info

New answers tagged

0

I've had an auditor recommend Cornell Spider, which is just a hacked together tool that uses some regexp to look for things like SSN, PAN, etc... It works but isn't very polished.


0

The other posts made the succinct point of saying the processors should shut you out quickly if you spam them with auth attempts, so it's doubtful you would make much headway there. If a hash were supplied as well, this would be stupidly easy to crack If by hash you mean the output of a hashed PAN, then it depends on the algorithm employed. Consider ...


9

start typing characters., Once the password is valid, the red text goes away, indicating a valid password. This kind of behavior doesn't necessarily violate PCI DSS requirements. If the site works the way you describe, it's not very good from a security point of view because it makes brute force attacks more difficult to detect -- but that doesn't make ...


0

First off - thanks for asking the question. Second, the respondent that stated its PII and should be protected is accurate. At a minimum I'd employ field level encryption. Along with N tiered architecture for an app on a site managing this - or consider outsourcing payment management to a third party, avoiding many issues. We manage payments for a few ...


3

It's up to the merchant to ensure he is PCI compliant. So this means that when you as a merchant run a webshop which holds or processes carholder data you are responsible for securing it. Either you do it yourself or you transfer the risk to Heroku. To transfer the risk (or some of it) you would require an attestation from Heroku which specifically shows ...


0

In fact although you might be said to be performing the hash for lookup performance, it is being done to be PCI compliant. There are two ways of looking at this. Do x, it is the right thing to do. Do x, or we'll get caught not doing it. Doing x to prevent cracking does not really come into it, since there are only about 5 numbers to guess in some cases. ...


2

Short version: You seem to be A-EP You seem to be A, based on the specific products referenced, but you should ask your processor(s) to be sure. If by "Amazon Payments JavaScript widget" you mean Amazon Express Checkout, then you're SAQ A-EP, because "elements of the payment page originate from the merchant website". Amazon Payments "Login and Pay" is jut ...


1

Am I right thinking that it is NOT relevant for the tokens based on mathematically reversible cryptographic functions? You're right. But you may not want to do it that way. Tokens are generally isomorphic to card numbers (15-16 digit numeric) because they are supposed to be able to easily replace card numbers in whatever software the recipient uses. ...


1

Best guess, short version: It's rooted in physical practices and has been retained into digital practice It's not significantly different from brute force guessing without it Reasoning: Historically, truncated numbers are printed on receipts because they provide enough information to allow identification for chargebacks in a return or refund. For ...


3

I think it makes more sense in the context of how much extra information is being given away, rather than how easy it'd be to brute force the remaining digits. A PAN is not entirely a random value, it's made up of: a six-digit Issuer Identification Number (IIN) (previously called the "Bank Identification Number" (BIN)) the first digit of which is ...



Top 50 recent answers are included