Tag Info

New answers tagged


Your payment gateway probably has a way of storing and tokenizing credit card information on their servers in a PCI-compliant way. For example, if you use Authorize.Net, you can use their Customer Information Manager service to store and tokenize the end-users' card info securely on Authorize.Net's servers. Using such a service, when the end user books a ...


First of all, As nonce is supposed to be random is not, strictly speaking, true. Nonce in general is only required to be unique. It is, however, often convenient to generate nonce as (pseudo-)random bytes. In this case and if the nonce is sufficiently big (say, 12+ bytes) there is no need to check against previous nonces as you will never encounter a repeat ...


You can store nonces in any way you want, e.g. in a database; also note that you don't need to store past nonces longer than their validity time. In fact, a nonce should be timestamped, and valid only during a limited time since its creation. For this, all systems (nonce producer, client, and server) need to be time synchronized.


These WORM (write once read many) devices are by definition inconvenient and that's why there are very few of them and rather expensive. The expensive part is because it has to have hardware support. You could try doing it on the same system with read-only rights for certain users and harden it with the immutable attribute. Even root cannot delete those ...

Top 50 recent answers are included