Questions tagged [e-commerce]
The e-commerce tag has no usage guidance.
61
questions
2
votes
1
answer
67
views
Can CVV be input in a standard web site? The site doesn't store it
On my website, payments are done using a PCI-compliant 3rd partner. If the client agrees, I store a TOKEN of the card (returned by the PCI partner).
I want to make a new payment with CVV for the ...
- 123
1
vote
0
answers
73
views
What is the purpose of the temu captchas?
When shopping on temu, while logged in to an account for which temu has a credit card and physical address and browsing normally, I am presented by an slider CAPTCHA frequently enough that it is ...
- 141
0
votes
1
answer
52
views
Showing a license/id to a shopping website, worth it? [duplicate]
I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
0
votes
1
answer
115
views
Is this insecure to show in cookie Google Tag?
While researching one site, I found that if you enter document.cookie (Firefox) I can see this filed in cookie _gat_gtag_UA_XXXXXXXXX_1=1. There were plain text. As I know gtag is for Google Tag ...
- 157
12
votes
4
answers
4k
views
How does collecting sensitive data using iframes increase security?
So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also ...
- 222
1
vote
1
answer
99
views
Does the “post/redirect/get" pattern create security problems?
My understanding of Post-Redirect-Get so far is not very deep. I've used it a couple of times now. What I notice, though, is that when I use it, I am sending a rather private token of some sort to ...
- 113
2
votes
1
answer
165
views
PCI scope for a Direct-Post e-commerce site (SAQ A-EP)
An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security).
Is the server for the e-commerce application and network it resides on in scope for PCI? There are questions in ...
- 21
3
votes
0
answers
2k
views
What's the latest thinking on website session expiry time? [closed]
Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
- 1,758
11
votes
4
answers
2k
views
Defending against DoS via product reservation
An e-commerce site should reserve products for a user while they're going through the payment process (more info). This creates a potential denial-of-service risk where an attacker could reserve many ...
- 33.4k
0
votes
1
answer
98
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
2
votes
2
answers
183
views
Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)
My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
1
vote
1
answer
75
views
List additional cart items in ecommerce website
I am using an ecommerce website. When I log in, I would expect my cart to be empty. But it shows the cart items selected by another user who previously used the same machine and logged out. Is this a ...
- 11
1
vote
0
answers
260
views
Does my eCommerce SaaS vendor need to be PCI DSS compliant?
I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, ...
- 11
3
votes
3
answers
9k
views
Driver's license required for online purchases
Problem
I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my driver's license to verify that it matches the details on the card because ...
- 39
2
votes
2
answers
528
views
Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?
I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
- 21
1
vote
2
answers
118
views
Sending order details in hidden input fields?
I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a ...
- 123
1
vote
2
answers
652
views
E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout
I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
- 111
1
vote
1
answer
1k
views
Why do scammers use emails like yahoo?
I was doing a Cyber Security and IT audit for a company.
I was told that they had very little in terms of fraud protection, one of the only ways that they detected potential fraudsters was by ...
- 715
12
votes
5
answers
9k
views
Generating and securing gift card codes
I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores.
I'm wondering what the most secure way of generating these gift card codes are. The ...
- 181
1
vote
5
answers
247
views
How to decide where to host an online store?
How can one know whether it is more secure to host the store on our own servers or on those from external vendors?
Answer:
Do a risk assessment.
1.) Summarized Answer
2.) Detailed Answer
3.) ...
- 21
4
votes
1
answer
235
views
Prevent automated account creation without using CAPTCHA
I had a scenario, where someone created thousands of user accounts in a shop system, which flooded the DB.
Different usernames/emails were used and each creation came from a different IP address.
How ...
- 141
7
votes
3
answers
1k
views
Why would some web applications disable Numpad input?
Some web applications (One popular example is Skrill) don't allow input from Numpad for number <input>.
I've seen some local websites here also follow the same procedure.
The thing is, all of ...
- 79
4
votes
0
answers
495
views
Security Implications of a Single Page E-Commerce Application [closed]
I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex.
Everything ...
- 41
1
vote
2
answers
426
views
PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops
I did a pre-assessment of 2 web shops of one company today.
One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP.
...
- 113
1
vote
2
answers
688
views
PCI DSS for web servers not storing credit card info
I plan on deploying our new company website to a dedicated server through a hosting provider. I will personally maintain the server with the exception of dealing with the physical hardware. The ...
- 11
1
vote
1
answer
84
views
Reusing an “anonymous” user entity across orders
I wonder if it would be a good idea if a shopping system would reuse existing user accounts across multiple orders. For example:
A person buys a concert ticket in an online shop. The ticket is mailed ...
- 111
6
votes
2
answers
592
views
Supporting TLS v1.0 while remaining PCI compliant
We have a significant portion of sales still coming in from users using browsers that do not yet support TLS 1.1+. We also have demands from our payment processors to stop supporting TLS 1.0 for PCI ...
- 161
2
votes
2
answers
206
views
PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)
Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI ...
- 2,748
2
votes
2
answers
202
views
PCI DSS Compliance for Client
I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
- 121
1
vote
1
answer
120
views
Hosted checkout page - who holds liability if there is fraud case?
We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
- 11
2
votes
1
answer
2k
views
Do I have to comply with PCI DSS for bank transfers?
The company I work for is looking forward to make an online store for wholesalers (t-shirts, muggles, office co-branded supplies, etc.) but we don't store, process or transit any card data. The ...
- 21
3
votes
1
answer
1k
views
Script tag loading "xss.re/692" in e-commerce transaction data - real attack or something else?
An e-commerce site I run recently received a suspicious transaction. The field for customer's name included a script tag, like so (customer's name changed to John Doe to protect anonymity):
John Doe"&...
- 607
1
vote
4
answers
851
views
Is it a vulnerability if an application cookies carry sensitive information?
I am assessing a small e-commerce web application. I have found that the application passes the order details, the cost, the order ID etc as a part of the cookie. Tampering with it does not affect the ...
- 19
2
votes
1
answer
216
views
Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?
I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions.
In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
- 21
1
vote
0
answers
119
views
SAQ D PCI Compliance for Custom Shopping Cart
We use a custom developed open-source e-commerce software. We are SAQ D and I am trying to figure out which of these requirements applies to our cart if:
We aren't storing credit card information
We ...
- 111
2
votes
0
answers
76
views
Reasonable means of security in commercial dealings [closed]
I am writing a paper from a legal standpoint and I'm suggesting legislation for a new duty of care for private companies in the safeguarding of customer's personal information. This will not apply to ...
- 21
5
votes
5
answers
6k
views
Home Banking, antivirus safe environments OR Linux on virtual machines?
Which is the safest way to do home banking, given that I do use Windows on a tablet, I do connect to both private and public networks and I cannot use a Linux live distro right now?
I've been ...
- 481
16
votes
2
answers
438
views
Is adding a supplementary credit transaction something that could improve online payment security?
An online company from which I regularly buy goods apparently recently upgraded their security policy.
Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
- 19.2k
3
votes
2
answers
282
views
Are there any ways to defraud a fundraising site?
I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
- 155
1
vote
1
answer
449
views
How to migrate users? (Changing the login system)
Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system.
Specification Old System
Username : email address
Password ...
- 6,981
1
vote
3
answers
284
views
What type of attack is this?
Attacker purchasing something from e-store when attempting to tamper with requests and change the transaction amount value. What type of attack is this? How to prevent this kind of attack as the bank ...
- 35
2
votes
1
answer
155
views
Decentralized e-commerce site, what to do about SSL/security?
I'm building a service that is basically a decentralized Amazon.
Basically, each seller hosts a copy of the site, at their own IP address, and accepts (bitcoin) payments using a self-hosted bitcoin ...
- 123
1
vote
1
answer
261
views
How prevent online payment fraud? [closed]
What is the solution of independent payment authorization from hackers between bank and merchant?
Some banks used SOAP protocol. I need another solution.
- 35
0
votes
2
answers
192
views
Library or service for rate limiting credit card transactions by IP [closed]
I have a simple product ordering form.
A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot.
99% of the orders are declined but some are completed....
- 101
3
votes
2
answers
370
views
Shop saves credit card data from guest orders
A web shop allows customers to order as guest or to create an account.
I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
- 1,779
6
votes
2
answers
364
views
Any way to prove that two devices are in the same physical space, for authentication?
I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs.
This could be:
A digital ID and the authenticator
A consumer ...
- 50.7k
1
vote
1
answer
2k
views
How important is a dedicated SSL certificate vs. shared for eCommerce?
At my work, we've been using Network Solution eCommerce for many years now, and they have been working very well for us. However, as the years go on, their services become more and more outdated. As a ...
- 113
2
votes
1
answer
820
views
Using OAuth as Security For E-Commerce Sites
I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
2
votes
2
answers
786
views
Would chip-and-PIN have prevented the Target breach?
Would chip-and-PIN have prevented the Target breach?
As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
- 99.4k
3
votes
2
answers
4k
views
Is PCI Compliance mandatory?
I recently started working on an eCommerce addition to a site I'm working on.In my research
looking for a way to do SSL without a certificate/a free certificate I came across PCI Compliance.I have ...
- 133