Store credit card data in google sheets - Asymetric Encryption

Question

Yes! this sounds crazy, and it is, please let me give you some background about this...

I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the front desk staff can copy and paste it to the main System, in the past guests had to fill this checkin data in a paper form, including credit card details in case they wanted credit applied to their rooms, so the guest would eat at the restaurant and pay later at checkout, in case the guest decides to leave without pay the charged ammounts, the hotel would proceed to charge it's credit card with the details in the checkin form.

After all this coronavirus madness the hotel wants to make this process with an app, so the guests would not need to touch anything else than their phones, BUT the challenge is, i can't use a webserver to process and store this data, i have to use a google sheets to store this data, which i know it's not as secure as would be on a server.

Anyway the thing is, i already did the app, and since anyway nobody should store credit card data, we decided to just ask to the costumer to do it in paper again, fill the rest of the data in the app.

Next thing to know is that the only data is requested to guests are the credit card number and the expiry date, the hotel won't ask never for the CVV number, and the app is using SSL to encrypt the communication between the app and the google sheets api, also i im encrypting the credit card data with asymetric encryption method, this works creating a public and private key from a secure computer, then encrypting the data before send with the public private key, and decrypting the data with another app which is only hosted on an isolated PC with the private key in order to decrypt the text stored on the google sheets.

So in case anyone could get this data from the google sheet api (which also only accept calls from the authorized domain where the app is hosted), this person could only read encrypted data, and since the private key is not public, it would be useless for the "hacker".

So under all this panorama, do you think it's still possible to get the decrypted numbers for a hacker? it's illegal to store only that part of the credit card data encrypted? (card number and expiry date), what would be the worst scenario?

The app is written in VueJS, and i know it's not secure, i just want to know how? what methods would an attacker use to stole data, and if the data is encrypted this way (asymetric) what damage would cause?

Here is part of my app code:

async saveData(signature){
            // console.log(this.signatureURL);
            let apiURL = "https://script.google.com/macros/s/AKfycbw3TI3jiIPNq1MliW77IE4-FkCGe9ADq5tt2pBTVSOrqoWv9yM/exec"
            let formData = new FormData();
            //...
            formData.append('credit', !!this.cardNumber ? 'true' : 'false')
            formData.append('cardNumber', this.encryptMe(this.cardNumber));
            formData.append('cardExp', this.encryptMe(this.cardMonth+"/"+this.cardYear));

            this.axios.post(apiURL, formData).then(response => {
                // console.log(response)
                localStorage.setItem('selfCheckin', true);
                this.$router.push({name: 'landing'}).catch(e => {});
            }).catch(error => {
                this.$swal({
                    title: "Error",
                    text: error,
                    icon: 'error'
                })
            });
        },

and this is where i encrypt the data:

encryptMe(data){
            let publicKey = "-----BEGIN PUBLIC KEY-----\n" +
                "FDSAJKFDSJfjkFe8f7dfsajfkldsajklfdsajklfdsajklfdsajkfdsajklfdsaf\n" +
                "fdsjaklfdsajfkldsaajkldfsajklFDJKLfjdklfdjsklfdsjkfldsjfklfdsjkl\n" +
                "fdsajjfkldsjklfdsafds9fdsa9fdsaufe3ufdsnaklfdsankfldsanfkldsanfk\n" +
                "FDSAFJJKFLDAJKFLDA\n" +
                "-----END PUBLIC KEY-----"

            let encrypt = new JSEncrypt();
            encrypt.setPublicKey(publicKey);

            return encrypt.encrypt(data);
        },

So in another app which is hosted in a secure local computer i have the decrypt method:

decryptMe(data){
            // console.log(data);
            let privateKey = 'THE PRIVATE KEY GOES HERE'
            let decrypt = new JSEncrypt();
            decrypt.setPrivateKey(privateKey);
            return decrypt.decrypt(data);
        },

Thanks in advance for your opinnions and thoughs, as i said i have refused to do it this way to the hotel and i let them know this is not safe, so they decided to just skip that part of the app, but they asked me how dangerous was, and i didn't really know the facts and technical knowledge to answer, that's why i'm here, and sorry because i'm not a native english speaker.

Answer 1

When processing credit card data, your application and its systems need to be PCI (Payment Card Industry) compliant. If the hotel is not PCI compliant and credit card data is stolen they will be fined by the credit card companies.

Storing the private key in the application itself is a security risk, this should be avoided as it would be rather easy to decompile the application and retrieve the private key.

Also stating that a computer is "secure", doesn't mean it is secure. Questions you could ask are:

• Is full disk encryption enabled?
• Is the "secure" computer connected to the internet?
• Are patch management procedures in place?
• Are there password policies and if so what are they?
• Who and how many users have access to this machine?
• Are there separate accounts for each user?
• Is the machine hardened?
• Does the application that holds the private key require a password?
• Do you use MFA?

These are just a few simple questions and a lot more questions should be asked before one can state that a computer is "secure".

My main recommendation would be: Either do it right, or don't do it at all.