5

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me.

The app allows a user to store their credit card details on the phone for future purchases (note: The CSN number is explicitly not stored as a security measure), when the number is presented again the number is shown masked. The numbers are stored in a hashed/encrypted state (iOS keychain, Android has it as a hashed encrypted value). When making a purchase the credit card info is sent across via a configurable url that uses https.

The app doesn't currently have integration with thrid party credit card handlers (Paypal,Stripe etc).

I'm going to push for all credit card handling to be done via secure third party vendors and am wondering if PCI-DSS standards are being violated here, I've read through the OWASP and PCI-DSS guidelines and nothing seems to be directly breached but it seems to be skirting the edge of doing so.

Credit card storage on a user device just raises red flags to me so I'd like to check if someone else has experienced something similar?

Improve this question

1 Answer 1

Reset to default
2

You are absolutely correct. Storing the credit card on the device as it is currently being stored would be asking for trouble and would not be in line with PCI-DSS guidelines. One of the "Don'ts" on the PCI-DSS compliance states "Do not store cardholder data unless it is absolutely necessary" and beyond this there would need to be adequate measures to ensure that this data was being safeguarded. From what you have described - yes the data is encrypted but no it is not absolutely necessary to store this data.

Even Apple Pay on iPhone6 won't store your credit card details on the device - they use tokenisation.

Hope that answers your question.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .