1

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that transmitting plain text to payment gateway is not PCI Compliant. Also once we transmit the details to the Gateway they return a Token which we use for recurring payments so just want to make sure that if we are secure or not.

  • Please know that when ever credit cards flow through your system to the payment gateway, you'll need to be PCI DSS certified as well. – Jeroen - IT Nerdbox Nov 27 '14 at 6:27
2

If you are transmitting the credit card details to your payment gateway via HTTPS, you are not transmitting in plain text, you are using SSL/TLS cryptography.

Once you don't store the details in your systems willingly (using databases, etc.), your only concern would be your system's logs, because they can store this informations without your knowledge, so make sure that no log is storing the credit card details.

We can have another issue that an attacker can use to steal your client's credit card details before he sends it to your server, this issue is called Cross Site Scripting (XSS), be aware.

Edit:

Be careful!

I am not saying that you don't need to pay attention in tons of other possible vulnerabilities.

I am just saying that if an attacker gain access to your servers, he will not be able to steal old credit card details if you follow the above rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.