Skip to main content

Questions tagged [e-commerce]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
15 votes
5 answers
5k views

Is it a security issue to expose PII on any publically accessible URL?

I am designing a e-commerce based website, part of which will be a order summary page. This order summary page, will contain the address and name of the person who ordered a product. My plan was to ...
karatecode's user avatar
2 votes
1 answer
137 views

Can CVV be input in a standard web site? The site doesn't store it

On my website, payments are done using a PCI-compliant 3rd partner. If the client agrees, I store a TOKEN of the card (returned by the PCI partner). I want to make a new payment with CVV for the ...
Emmanuel Gleizer's user avatar
1 vote
0 answers
344 views

What is the purpose of the temu captchas?

When shopping on temu, while logged in to an account for which temu has a credit card and physical address and browsing normally, I am presented by an slider CAPTCHA frequently enough that it is ...
User65535's user avatar
  • 189
0 votes
0 answers
164 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
skept1ca1's user avatar
0 votes
1 answer
181 views

Is this insecure to show in cookie Google Tag?

While researching one site, I found that if you enter document.cookie (Firefox) I can see this filed in cookie _gat_gtag_UA_XXXXXXXXX_1=1. There were plain text. As I know gtag is for Google Tag ...
dokichan's user avatar
  • 157
12 votes
4 answers
4k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
Acorn's user avatar
  • 222
1 vote
1 answer
137 views

Does the “post/redirect/get" pattern create security problems?

My understanding of Post-Redirect-Get so far is not very deep. I've used it a couple of times now. What I notice, though, is that when I use it, I am sending a rather private token of some sort to ...
Mark Goldfain's user avatar
2 votes
1 answer
200 views

PCI scope for a Direct-Post e-commerce site (SAQ A-EP)

An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security). Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
J. Lam's user avatar
  • 21
3 votes
0 answers
2k views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
Robin Winslow's user avatar
11 votes
4 answers
2k views

Defending against DoS via product reservation

An e-commerce site should reserve products for a user while they're going through the payment process (more info). This creates a potential denial-of-service risk where an attacker could reserve many ...
paj28's user avatar
  • 33.8k
0 votes
1 answer
127 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
Tallboy's user avatar
  • 105
1 vote
2 answers
211 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
breck-cabinets's user avatar
1 vote
1 answer
98 views

List additional cart items in ecommerce website

I am using an ecommerce website. When I log in, I would expect my cart to be empty. But it shows the cart items selected by another user who previously used the same machine and logged out. Is this a ...
Jay's user avatar
  • 11
1 vote
0 answers
293 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
lango9631's user avatar
3 votes
3 answers
10k views

Driver's license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my driver's license to verify that it matches the details on the card because ...
user196351's user avatar
2 votes
2 answers
559 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
pcinewb's user avatar
  • 21
1 vote
2 answers
143 views

Sending order details in hidden input fields?

I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a ...
Sumit Wadhwa's user avatar
1 vote
2 answers
734 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
Alex's user avatar
  • 111
1 vote
1 answer
1k views

Why do scammers use emails like yahoo?

I was doing a Cyber Security and IT audit for a company. I was told that they had very little in terms of fraud protection, one of the only ways that they detected potential fraudsters was by ...
user5623335's user avatar
12 votes
5 answers
10k views

Generating and securing gift card codes

I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores. I'm wondering what the most secure way of generating these gift card codes are. The ...
Mark's user avatar
  • 181
1 vote
5 answers
267 views

How to decide where to host an online store?

How can one know whether it is more secure to host the store on our own servers or on those from external vendors? Answer: Do a risk assessment. 1.) Summarized Answer 2.) Detailed Answer 3.) ...
Lizzy21's user avatar
  • 21
4 votes
1 answer
269 views

Prevent automated account creation without using CAPTCHA

I had a scenario, where someone created thousands of user accounts in a shop system, which flooded the DB. Different usernames/emails were used and each creation came from a different IP address. How ...
xhallix's user avatar
  • 141
7 votes
3 answers
1k views

Why would some web applications disable Numpad input?

Some web applications (One popular example is Skrill) don't allow input from Numpad for number <input>. I've seen some local websites here also follow the same procedure. The thing is, all of ...
Eekan's user avatar
  • 79
4 votes
0 answers
533 views

Security Implications of a Single Page E-Commerce Application [closed]

I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex. Everything ...
user373688's user avatar
1 vote
2 answers
454 views

PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops

I did a pre-assessment of 2 web shops of one company today. One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP. ...
0x90's user avatar
  • 113
1 vote
2 answers
729 views

PCI DSS for web servers not storing credit card info

I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
AirmanAJK's user avatar
1 vote
1 answer
107 views

Reusing an “anonymous” user entity across orders

I wonder if it would be a good idea if a shopping system would reuse existing user accounts across multiple orders. For example: A person buys a concert ticket in an online shop. The ticket is mailed ...
lxg's user avatar
  • 111
6 votes
2 answers
617 views

Supporting TLS v1.0 while remaining PCI compliant

We have a significant portion of sales still coming in from users using browsers that do not yet support TLS 1.1+. We also have demands from our payment processors to stop supporting TLS 1.0 for PCI ...
jimmy0x52's user avatar
  • 161
2 votes
2 answers
237 views

PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)

Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI ...
ack__'s user avatar
  • 2,758
2 votes
2 answers
224 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
AshboDev's user avatar
  • 121
1 vote
1 answer
150 views

Hosted checkout page - who holds liability if there is fraud case?

We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
anandmongol's user avatar
2 votes
1 answer
2k views

Do I have to comply with PCI DSS for bank transfers?

The company I work for is looking forward to make an online store for wholesalers (t-shirts, muggles, office co-branded supplies, etc.) but we don't store, process or transit any card data. The ...
Alan's user avatar
  • 21
3 votes
1 answer
1k views

Script tag loading "xss.re/692" in e-commerce transaction data - real attack or something else?

An e-commerce site I run recently received a suspicious transaction. The field for customer's name included a script tag, like so (customer's name changed to John Doe to protect anonymity): John Doe"&...
Robert's user avatar
  • 607
1 vote
4 answers
893 views

Is it a vulnerability if an application cookies carry sensitive information?

I am assessing a small e-commerce web application. I have found that the application passes the order details, the cost, the order ID etc as a part of the cookie. Tampering with it does not affect the ...
Tim's user avatar
  • 19
2 votes
1 answer
238 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
another-joe's user avatar
1 vote
0 answers
137 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...
dubloons's user avatar
  • 111
2 votes
0 answers
96 views

Reasonable means of security in commercial dealings [closed]

I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...
jigenbakuda's user avatar
5 votes
5 answers
6k views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
franz1's user avatar
  • 481
16 votes
2 answers
458 views

Is adding a supplementary credit transaction something that could improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
WhiteWinterWolf's user avatar
3 votes
2 answers
298 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
indextwo's user avatar
  • 155
1 vote
1 answer
491 views

How to migrate users? (Changing the login system)

Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system. Specification Old System Username : email address Password ...
Gudradain's user avatar
  • 7,021
1 vote
3 answers
304 views

What type of attack is this?

Attacker purchasing something from e-store when attempting to tamper with requests and change the transaction amount value. What type of attack is this? How to prevent this kind of attack as the bank ...
Blah's user avatar
  • 35
2 votes
1 answer
174 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
dessalines's user avatar
1 vote
1 answer
276 views

How prevent online payment fraud? [closed]

What is the solution of independent payment authorization from hackers between bank and merchant? Some banks used SOAP protocol. I need another solution.
Blah's user avatar
  • 35
0 votes
2 answers
210 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are completed....
dbasch's user avatar
  • 101
3 votes
2 answers
435 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
unor's user avatar
  • 1,779
6 votes
2 answers
383 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
makerofthings7's user avatar
1 vote
1 answer
2k views

How important is a dedicated SSL certificate vs. shared for eCommerce?

At my work, we've been using Network Solution eCommerce for many years now, and they have been working very well for us. However, as the years go on, their services become more and more outdated. As a ...
Devin's user avatar
  • 113
2 votes
1 answer
854 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
Jacques Bronkhorst's user avatar
2 votes
2 answers
812 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
D.W.'s user avatar
  • 100k