Reputation
40,968
Next tag badge:
159/100 score
19/20 answers
Badges
14 93 162
Newest
 Nice Answer
Impact
~1.5m people reached

Jun
5
comment New credit card security standards regarding PA-DSS Compliance
And btw as an aside, the DSS's are very technically oriented, and they work with many in the industry to ensure that it's (relatively) on target.
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
Here's a solution, though - the "secure" 3rd party processor DLL should offer a "secure" UI to accept the CHD directly. I've guided many a vendor in implementing this solution.... That way, the CHD goes directly into their own code, and never touches your bits. (Of course, verify this with your own PA QSA).
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
Now, to your points - the issue is that you are processing it, by accepting the CHD from the user. It is handled by your code, so your code needs to be PA compliant. It's as simple as that... Think of the alternative, you could be simply getting the CC's, and writing them to a file, before sending it to the DLL. See why your product would also need to be compliant?
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
please add this as an update to your question, not as an answer.
Jun
5
comment Progress in market approaches to software vulnerability disclosure?
Very interesting question, I hope this eventually gets some answers! Are you talking only about disclosure, or economic factors in improving security in general?
Jun
5
revised Progress in market approaches to software vulnerability disclosure?
edited tags
Jun
5
comment How can I ensure that I connect to the right wireless Access Point?
This isnt really an answer, is it? Consider changing this to a comment....
Jun
2
revised IIS IP Address Restriction - can I rely on it online?
edited tags
Jun
1
revised How should I protect in-app Android payments when using a separate server?
edited tags
May
31
revised Are there any security problems with Google false start for TLS?
edited tags
May
31
revised Do security questions subvert passwords?
edited tags
May
31
comment Do security questions subvert passwords?
Note that the answers to these questions are not just shorter than passwords, they are typically dictionary words, and from a limited set of words at that. (e.g. "Favorite color"...). Also, knowing a person would make it even easier to "guess" the answers... And EVEN worse, these answers are often shared with other sites (as answers to "security questions"!!)... not to mention much of it is public record.
May
31
comment How to store my contacts encrypted?
this question seems to be missing some essential information to be answerable. Please update, or close...
May
31
revised How to implement non-password authentication in a web site
edited tags
May
31
revised How to determine what type of encoding/encryption has been used?
edited tags
May
31
comment OSes that are mathematically proven to be 100% (or 99%) secure?
And people. Dont forget about people, usually these are the biggest vulnerabilities... To reach 100%, you'd need to find a way to neutralize that threat.
May
31
revised Keystrokes to text converter method? (from an audio file, from previously recorded sounds of keystrokes)
edited tags
May
31
comment Could an Encrypted VG/Image compromised?
Correction, encryption is not designed to prevent modification, it provides confidentiality only. For integrity protection, you'd need a hash-based mechanism, such as HMAC, or digital signatures.
May
31
revised Could an Encrypted VG/Image compromised?
edited tags
May
31
revised wlan security - why is it not possible to protect against deauthentication flooding
edited tags