24
votes
Is it a security issue to expose PII on any publicly accessible URL?
The problem of using encrypted order IDs (or the HMAC of the order ID) is that the entire scheme depends on the secrecy of the key. If you have a secure key store (ideally a hardware security module), ...
- 23k
21
votes
Accepted
Defending against DoS via product reservation
I've seen 2 main solutions:
Your products are being reserved for X minutes
I've seen notices like this occasionally, but only on places where inventory really matters (usually ticketing sites).
I've ...
- 31.7k
14
votes
Is it a security issue to expose PII on any publicly accessible URL?
One additional step I would personally take as an extra precaution: partially censor the name and address on the document shown (so karate code becomes k*** c***, and 11 Wall Street becomes 11 W******)...
- 7,583
11
votes
How does collecting sensitive data using iframes increase security?
... if a bad actor is able to run javascript on your page
That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
- 208k
11
votes
Accepted
Is it a security issue to expose PII on any publicly accessible URL?
My plan was to encrypt the order id, and pass it to the checkout success page like like so: https://www.mysite.com/success?id=AES-128ENCRYPTED_ID
It seems like you want integrity, and not ...
- 34.4k
8
votes
Generating and securing gift card codes
To prevent fraud, you need a sufficiently low probability of the attacker guessing any valid code.
For 1 million cards, a 10^16 code will be guessed on the average each 10^10 attempts. If your site is ...
- 2,770
6
votes
Supporting TLS v1.0 while remaining PCI compliant
No CHD over TLS 1.0
The core requirement as explicitly listed in PCI DSS is that cardholder data (CHD) must be securely encrypted in transit, not about particular configuration of servers. TLS 1.0 is ...
- 8,439
6
votes
Defending against DoS via product reservation
Abandoned cart management processes are the key to try to verify legitimate orders. Use your expected order patterns even in periods of order spikes. Get engagement from users by nagging them about ...
- 132k
6
votes
Accepted
Is adding a supplementary credit transaction something that could improve online payment security?
Answering my own question to be able to flag it as answered and prevent it from popping up from time to time: this measure appears as a plain example of security theater.
Here are the elements ...
- 19.4k
5
votes
Accepted
Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)
my concern is that providing this email address to other businesses in
our manufacturing and delivery pipeline will have PCI compliance
consequences.
No, PCI does not care about email address at ...
- 73.3k
5
votes
Is it a security issue to expose PII on any publicly accessible URL?
This is an authentication/authorization problem. The question is, "Does having a URL with a long, unguessable part provide sufficient identification of a user?" You have posed several ...
- 3,299
4
votes
PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)
IANAQSA, and a lot of this has more to do with contractual merchant-processor-card brand obligations than the DSS per se, so there's more "I think" than "I know" than usual here:
Suppose we have an ...
- 73.3k
4
votes
PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)
Note : Not a QSA, but some PCI experience.
The section relevant here is section 6, especially 6.1 "Is there a process to identify security vulnerabilities" and especially 6.2.b "Are critical security ...
- 6,391
4
votes
Defending against DoS via product reservation
Reservation is a privilege
If we can, we reserve products during checkout:
Returning users - who have previously made and paid for an order. Their account is more trusted and can reserve products any ...
- 34.7k
4
votes
How does collecting sensitive data using iframes increase security?
I'm writing this as an answer because a comment would be too long. But some time ago there was some malware that was used to infect some e-commerce websites, and the malware simulated a fake paypal ...
- 15.9k
3
votes
How to decide where to host an online store?
This is hardly a security question but I can give you some pointers.
... can (and will) accumulate large parts of our customer database.
This is normally handled by contract law. (or to be more ...
- 9,063
3
votes
Why would some web applications disable Numpad input?
This answer is only speculative, but after I did some digging, this is the most probable solution for me.
The coders wanted to prohibit the input of numeric values in some fields of a web form. To do ...
- 8,021
3
votes
Accepted
How does collecting sensitive data using iframes increase security?
You ask a great question and the technical reason that iframes add a layer of security is covered in many of the above answers. However, you also correctly observe that if an attacker has access to ...
- 1,050
2
votes
PCI DSS Compliance for Client
If your e-commerce site neither stores, processes nor transmits PCI data, then you can take what is known as Attestation A. This is what you do when you use a so-called "Payments 2.0" provider, such ...
- 51
2
votes
Accepted
PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops
As I see, there are two web shops of the same company in scope where one has hosted its website in their own data center while other one has hosted on cloud (Azure). Since the first webshop uses ...
- 36
2
votes
Driver's license required for online purchases
I'll start with the TLDR; version of the answers to your explicit questions, and then give some breakdown beyond that.
A merchant may set any requirement they wish upon a transaction (as long as it ...
- 841
2
votes
Accepted
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Yes, PCI allows you to store a customer's card provided you do so in compliance with the PCI DSS. Specifically, Requirement 3: Protect stored cardholder data outlines what you may (card number) and ...
- 73.3k
2
votes
Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)
PCI compliance is about payment data. An email address on it's own is not payment data, so it's nothing you have to worry about with regards to PCI compliance.
Generally speaking, the email address ...
- 1,923
2
votes
Accepted
Does the “post/redirect/get" pattern create security problems?
It seems someone can pretty easily get my Querystring parameters and then go look at my transaction at any later time.
Maybe it is like this, maybe not. The actual implementation is not known. But ...
- 208k
2
votes
How does collecting sensitive data using iframes increase security?
I ran a small organization's e-commerce operation.
You're looking at it from an in-browser technology perspective, and presuming every organization is responsible for its own security. Small ...
2
votes
Accepted
Can CVV be input in a standard web site? The site doesn't store it
Assumptions: 3rd party partner is an approved Payment Processor, "Standard Website" means a site using HTTPS/TLS1.2, and all other PCI requirements are followed (e.g., data in transit ...
- 2,260
1
vote
List additional cart items in ecommerce website
In short, yes.
That is not a well designed website and I'd stay clear, certainly don't put any of your payment details into it!
With regards to your question, it's a little vague so I want to ...
- 347
1
vote
Driver's license required for online purchases
Unsure in the US, but in France, when a client contests an online payment, the bank has to prove that the order of payment was validated by the client. A signed document is of course a proof, an order ...
- 26.9k
1
vote
Prevent automated account creation without using CAPTCHA
There are a number of things that a 'developer' could do to avoid bulk account creation in this manner - but it will depend on the appetite / budget for a client.
For example, a number of commercial ...
- 11
1
vote
What are the security implications of the POLi Internet Payments technique?
The point is not the security of the POLi system, it is whether using it invalidates all or some banks' Internet Banking terms of service. Some banks say it does, and - thereby - also voids their ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible