If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct openID login server?
3
-
Is the Open ID authentication being used to access the card holder data?– w.cSep 11, 2012 at 15:38
-
it wouldn't be to access the data, but to use it for future purchases.– Jonny WhiteSep 11, 2012 at 15:41
-
see security.stackexchange.com/questions/1845/…– Gaurav SharmaSep 11, 2012 at 18:15
Add a comment
|
1 Answer
For use by consumers, I believe you should be ok, but for use by employee's you'd potentially run afoul of PCI-DSS requirement 8.5. OpenID provides an authentication mechanism independent of data and validates a user matches with the unique ID assigned to the user within your system. For non-consumer users there are additional requirements for password complexity and changes that might not be enforced by a third party OpenID system, however for the consumer users (whose information is being protected), it seems to be allowable to let them use an OpenID to authenticate.
answered Sep 11, 2012 at 16:51
