Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [e-commerce]

The tag has no usage guidance.

1
vote
1answer
33 views

List additional cart items in ecommerce website

I am using an ecommerce website. When I log in, I would expect my cart to be empty. But it shows the cart items selected by another user who previously used the same machine and logged out. Is this a ...
1
vote
0answers
122 views

Does my eCommerce SaaS vendor need to be PCI DSS compliant?

I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
4
votes
3answers
174 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
1
vote
2answers
136 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
2answers
55 views

Sending order details in hidden input fields?

I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a ...
1
vote
2answers
113 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
1answer
496 views

Why do scammers use emails like yahoo?

I was doing a Cyber Security and IT audit for a company. I was told that they had very little in terms of fraud protection, one of the only ways that they detected potential fraudsters was by ...
10
votes
5answers
2k views

Generating and securing gift card codes

I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores. I'm wondering what the most secure way of generating these gift card codes are. The ...
1
vote
5answers
190 views

How to decide where to host an online store?

How can one know whether it is more secure to host the store on our own servers or on those from external vendors? Answer: Do a risk assessment. 1.) Summarized Answer 2.) Detailed Answer 3.) ...
3
votes
1answer
91 views

Prevent automated account creation without using CAPTCHA

I had a scenario, where someone created thousands of user accounts in a shop system, which flooded the DB. Different usernames/emails were used and each creation came from a different IP address. How ...
6
votes
2answers
253 views

Why would some web applications disable Numpad input?

Some web applications (One popular example is Skrill) don't allow input from Numpad for number <input>. I've seen some local websites here also follow the same procedure. The thing is, all of ...
4
votes
0answers
282 views

Security Implications of a Single Page E-Commerce Application [closed]

I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex. Everything ...
1
vote
2answers
315 views

PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops

I did a pre-assessment of 2 web shops of one company today. One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP. ...
1
vote
2answers
390 views

PCI DSS for web servers not storing credit card info

I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
1
vote
1answer
38 views

Reusing an “anonymous” user entity across orders

I wonder if it would be a good idea if a shopping system would reuse existing user accounts across multiple orders. For example: A person buys a concert ticket in an online shop. The ticket is mailed ...
5
votes
2answers
466 views

Supporting TLS v1.0 while remaining PCI compliant

We have a significant portion of sales still coming in from users using browsers that do not yet support TLS 1.1+. We also have demands from our payment processors to stop supporting TLS 1.0 for PCI ...
3
votes
2answers
110 views

PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)

Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI ...
2
votes
2answers
123 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
1
vote
1answer
62 views

Hosted checkout page - who holds liability if there is fraud case?

We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
2
votes
1answer
582 views

Do I have to comply with PCI DSS for bank transfers?

The company I work for is looking forward to make an online store for wholesalers (t-shirts, muggles, office co-branded supplies, etc.) but we don't store, process or transit any card data. The ...
3
votes
1answer
818 views

Script tag loading “xss.re/692” in e-commerce transaction data - real attack or something else?

An e-commerce site I run recently received a suspicious transaction. The field for customer's name included a script tag, like so (customer's name changed to John Doe to protect anonymity): John Doe"&...
1
vote
4answers
473 views

Is it a vulnerability if an application cookies carry sensitive information?

I am assessing a small e-commerce web application. I have found that the application passes the order details, the cost, the order ID etc as a part of the cookie. Tampering with it does not affect the ...
2
votes
1answer
136 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
1
vote
0answers
72 views

SAQ D PCI Compliance for Custom Shopping Cart

We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if: We aren't storing credit card information We ...
2
votes
0answers
39 views

Reasonable means of security in commercial dealings [closed]

I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...
6
votes
5answers
4k views

Home Banking, antivirus safe environments OR Linux on virtual machines?

Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now? I've been ...
16
votes
2answers
375 views

Is adding a supplementary credit transaction something that could improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
3
votes
2answers
223 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
1
vote
1answer
231 views

How to migrate users? (Changing the login system)

Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system. Specification Old System Username : email address Password ...
1
vote
3answers
180 views

What type of attack is this?

Attacker purchasing something from e-store when attempting to tamper with requests and change the transaction amount value. What type of attack is this? How to prevent this kind of attack as the bank ...
2
votes
1answer
93 views

Decentralized e-commerce site, what to do about SSL/security?

I'm building a service that is basically a decentralized Amazon. Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
0
votes
1answer
187 views

How prevent online payment fraud? [closed]

What is the solution of independent payment authorization from hackers between bank and merchant? Some banks used SOAP protocol. I need another solution.
0
votes
2answers
120 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are completed....
3
votes
2answers
233 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
6
votes
2answers
290 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
1
vote
1answer
2k views

How important is a dedicated SSL certificate vs. shared for eCommerce?

At my work, we've been using Network Solution eCommerce for many years now, and they have been working very well for us. However, as the years go on, their services become more and more outdated. As a ...
2
votes
1answer
568 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
2
votes
2answers
630 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
3
votes
2answers
3k views

Is PCI Compliance mandatory?

I recently started working on an eCommerce addition to a site I'm working on.In my research looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
3
votes
2answers
603 views

Is it normal for a payment procedure to ask for third party cookies to be turned on?

I was trying to pay for mobile phone credit online from a service provider. I selected the amount to pay and clicked next to continues. The following page asked me to turn on third party cookies if I ...
1
vote
2answers
112 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
2
votes
2answers
634 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
0
votes
2answers
1k views

E-Commerce website with REST backend : do I have to secure Backend URLs accessed by Front end public pages?

I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2. I don't want to oblige the user to authenticate when he first comes ...
1
vote
0answers
181 views

secure authentication between subdomains hosted seperately

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a ...
6
votes
4answers
3k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
2
votes
3answers
1k views

How can I protect my eCommerce site from stolen credit cards?

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site. How can I protect my eCommerce site from ...
-1
votes
2answers
743 views

How to use VirtualMerchant without PCI-DSS?

I want to use Elavon VirtualMerchant to make credit card payments on my website. I don't want to do PCI DSS certifications other than SAQ A, so don't want to process or store card data on my site. I ...
8
votes
1answer
2k views

Why is it hard to prevent scalpers from using bots to buy up lots of concert tickets?

The New York Times recently has an article that talks about how scalpers are using bots to programmatically buy up lots of concert tickets, making it harder for ordinary fans to buy up tickets. For ...
4
votes
2answers
745 views

How to select secret identifier?

For an ecommerce website I need to create an identifier, that will represent the user's order. It can't be order's ID in database as it's assigned in predicateble manner. So it needs to be some ...
9
votes
4answers
10k views

Make online payments anonymously? [closed]

Is there a service/company which allows you to make anonymous payments online ? This is how i want the service to work - Just like a credit/debit card. When you make the payment online, instead of ...