127 reputation
6
bio website
location
age 32
visits member for 11 months
seen Dec 18 at 20:58

The postings on this site are my own and don’t necessarily represent my company's position or opinion.


Sep
24
awarded  Autobiographer
Sep
12
awarded  Critic
Jul
22
comment Hashing a credit card number for use as a fingerprint
@FloatingRock: Your weak point is the transit of the card from the application to Braintree. Also, there is a weakness at the swipe reader to the PC to the application. There are solutions out there that encrypt end-to-end but it costs money.
Jul
22
comment Hashing a credit card number for use as a fingerprint
@JohnDeters: The discretionary data where the CVC1 is stored is entirely optional. You can put 0's there. CVC1 is to there as a sort of checksum to make sure the data has not been tampered with and that is in the discretionary data. ALOT of issuers ignore this discretionary data as it is well, discretionary. CVC2 that is on the back of card usually, is meant for eyes only.
Jul
22
comment Hashing a credit card number for use as a fingerprint
@JohnDeter: I have created my own cards. It's not that hard. All you need is track one. It's easy to generate. I used to create them all the time for testing. And they would pass authority
Jul
21
comment Hashing a credit card number for use as a fingerprint
@JohnDeters: Yes, I understand all that. I have been through the PA-DSS audit process. Anyone can generate a Track 1 only credit card using the Customer's Name, the PAN, and the expiration date. Neither of which are considered sensitive data. Therefore, you could create a credit card easily using that data. I used to create my own for testing, it isn't that hard. My point is that they assign less risk to retaining the PAN than retaining the full track data.
Jul
18
comment Hashing a credit card number for use as a fingerprint
In terms of refunds, you could in theory store the truncated card number hashed with a unique salt with the person's name so that (like when you go return something at Target), it matches the secure hash if the card is presented again. This wouldn't rely on Stripe and you wouldn't have to store the full PAN though you still need to protect the truncated version. There are various tricks you can do, the point is once you decide to store it anywhere, there is a business risk than just transmitting it to the processor.
Jul
18
comment Hashing a credit card number for use as a fingerprint
@FloatingRock: It is very, very difficult to securely store credit card information. In fact, it was announced five years ago that 130 million credit card numbers were stolen from major retail and finance companies that have far more resources than you probably do to secure that data. I fully understand the desire to easily facilitate recurring payments. However, think though and understand the risk related to storing of credit card numbers before deciding to do so. If you decide that you need to store the card numbers, I recommend hiring a security expert with a proven track record
Jul
18
comment Hashing a credit card number for use as a fingerprint
@FloatingRock: Yes, the correlation has to occur within their DB only as there isn't a way to provide the fingerprint or unique number and get back a card number. That would be royally stupid. I think you increase your risk by storing the card number anywhere. PCI does not go far enough in my opinion in preventing storage. It should flat out deny the capability to store the number anywhere. It would lead to a slight inconvenience but not as bad as what happened recently to Target or other retailers.
Jul
18
awarded  Teacher
Jul
18
comment Hashing a credit card number for use as a fingerprint
@Xander: Then there is still a weak point. It offloads the storage to another service hoping that it is secure.
Jul
18
comment Hashing a credit card number for use as a fingerprint
At the time, and I think still, this was a less risky situation because it wouldn't store cards forever and the database was securely deleted once it was dumped to the master server which never retained card information. It required us to place a hardened PC in the machine created by ADAM called the UNO with special software as an intermediary.
Jul
18
comment Hashing a credit card number for use as a fingerprint
@Xander: This is better because you aren't storing the hashed and salted PAN at all. It is re-run everytime the transaction occurs. The only problem I see with this is or Stripe is that you have to be online 24/7. If the internet connection ever goes down, then you cannot process credit cards. I used to write credit card processing code for Parking Applications and many parking garages are fully automated with no cashier. We had to devise a method to securely store the credit cards offline up to a certain dollar amount. Once it came back online, then it dumped the transactions.
Jul
18
comment Hashing a credit card number for use as a fingerprint
@JohnDeters: I understand that. My point is it is ridiculous to protect the tracks more than the PAN
Jul
17
revised Hashing a credit card number for use as a fingerprint
deleted 6 characters in body
Jul
17
comment Hashing a credit card number for use as a fingerprint
In your last edit, just because somebody does it, does not mean tomorrow it will be frowned upon. Plus, what if the Stripe server is down? Do you really want to be tied to that service?
Jul
17
comment Hashing a credit card number for use as a fingerprint
@JohnDeters: Yes, but the PAN is included in Track 1 and 2. It's a bad paragraph really. They shouldn't allow it
Jul
16
comment Hashing a credit card number for use as a fingerprint
So how is trunk encrypted and how is the card encrypted inside the trunk?
Jul
16
awarded  Editor
Jul
16
comment Hashing a credit card number for use as a fingerprint
@Xander: I prefer a one way token personally.