3

Has anyone worked with eWay payment gateway before?

Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends those detail to the server.

Now, how's that security of anykind? (Please note I'm no security expert. Just a developer) The weakest link of online payment, AFAIK, has always been the consuming party of the service, ie the eCommerce websites themself.

If I were the user, I expect my CC detail to be only handled by the payment gateway, not the web applicatiion. Wasn't that the whole point of a payment gateway? To abstract the security concern from the web application?

Improve this question
1
  • Has this answered your question. If not please let us know.
    – Bernie White
    Nov 28, 2011 at 20:16

3 Answers 3

Reset to default
4

Agreed, from disclosure of information point of view fewer parties in the transaction process the better.

Specifically to eWAY (with I have not used) I assume you are referring to the Hosted Payment solution (See http://www.eway.com.au/Developer/eway-api/hosted-payment-solution.aspx) where a web service is exposed. eWAY do offer alternatives such as the Shared Payment (See http://www.eway.com.au/Developer/eway-api/shared-payment-solution.aspx) which is the redirect to the payment gateway solution but this may not be available in your specific location.

In the case where you are taking payment details you would need to be PCI-DSS (or equivalent) compliant in addition to the payment gateway. Also you should avoid storing any payment details that could be harvested by an attacker.

From a user’s point of view my personal opinion is they would be more cautious being redirected to a payment gateway that they don’t know then using the payment off the web site. Just something to consider.

In my mind, I would use a payment gateway that handled all the payment details for the purpose of offloading risk.

I hope that helps.

Improve this answer
3

The security idea of passing information through to a payment gateway lies in not having to maintain any card data within your own applications. In that regard, a compromised server can only provide information about card transactions after the fact. It also provides a level of simplicity to the application website where they don't have to develop the code for handling credit card transactions.

Improve this answer
0

The weakest part of credit card security has always been that credit card numbers are stored on servers. If you don't store the numbers on your own servers, then getting hacked will cost you a lot less.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .