If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct openID login server?


1 Answer 1


For use by consumers, I believe you should be ok, but for use by employee's you'd potentially run afoul of PCI-DSS requirement 8.5. OpenID provides an authentication mechanism independent of data and validates a user matches with the unique ID assigned to the user within your system. For non-consumer users there are additional requirements for password complexity and changes that might not be enforced by a third party OpenID system, however for the consumer users (whose information is being protected), it seems to be allowable to let them use an OpenID to authenticate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .