Skip to main content
Share Your Experience: Take the 2024 Developer Survey
21 votes
Accepted

Defending against DoS via product reservation

I've seen 2 main solutions: Your products are being reserved for X minutes I've seen notices like this occasionally, but only on places where inventory really matters (usually ticketing sites). I've ...
Conor Mancone's user avatar
11 votes

How does collecting sensitive data using iframes increase security?

... if a bad actor is able to run javascript on your page That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
Steffen Ullrich's user avatar
8 votes

Generating and securing gift card codes

To prevent fraud, you need a sufficiently low probability of the attacker guessing any valid code. For 1 million cards, a 10^16 code will be guessed on the average each 10^10 attempts. If your site is ...
Therac's user avatar
  • 2,670
6 votes
Accepted

Is adding a supplementary credit transaction something that could improve online payment security?

Answering my own question to be able to flag it as answered and prevent it from popping up from time to time: this measure appears as a plain example of security theater. Here are the elements ...
WhiteWinterWolf's user avatar
6 votes

Supporting TLS v1.0 while remaining PCI compliant

No CHD over TLS 1.0 The core requirement as explicitly listed in PCI DSS is that cardholder data (CHD) must be securely encrypted in transit, not about particular configuration of servers. TLS 1.0 is ...
Peteris's user avatar
  • 8,429
6 votes

Defending against DoS via product reservation

Abandoned cart management processes are the key to try to verify legitimate orders. Use your expected order patterns even in periods of order spikes. Get engagement from users by nagging them about ...
schroeder's user avatar
  • 131k
5 votes
Accepted

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

my concern is that providing this email address to other businesses in our manufacturing and delivery pipeline will have PCI compliance consequences. No, PCI does not care about email address at ...
gowenfawr's user avatar
  • 72.8k
4 votes

PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)

IANAQSA, and a lot of this has more to do with contractual merchant-processor-card brand obligations than the DSS per se, so there's more "I think" than "I know" than usual here: Suppose we have an ...
gowenfawr's user avatar
  • 72.8k
4 votes

PCI-DSS requirements regarding long exposure to critical vulnerability (RCE)

Note : Not a QSA, but some PCI experience. The section relevant here is section 6, especially 6.1 "Is there a process to identify security vulnerabilities" and especially 6.2.b "Are critical security ...
crovers's user avatar
  • 6,381
4 votes

Defending against DoS via product reservation

Reservation is a privilege If we can, we reserve products during checkout: Returning users - who have previously made and paid for an order. Their account is more trusted and can reserve products any ...
paj28's user avatar
  • 33.4k
4 votes

How does collecting sensitive data using iframes increase security?

I'm writing this as an answer because a comment would be too long. But some time ago there was some malware that was used to infect some e-commerce websites, and the malware simulated a fake paypal ...
reed's user avatar
  • 15.8k
3 votes

How to decide where to host an online store?

This is hardly a security question but I can give you some pointers. ... can (and will) accumulate large parts of our customer database. This is normally handled by contract law. (or to be more ...
LvB's user avatar
  • 8,963
3 votes

Why would some web applications disable Numpad input?

This answer is only speculative, but after I did some digging, this is the most probable solution for me. The coders wanted to prohibit the input of numeric values in some fields of a web form. To do ...
Tom K.'s user avatar
  • 7,966
3 votes

Is it a vulnerability if an application cookies carry sensitive information?

Putting actual information into cookies, as opposed to just storing a session ID and keeping the rest of the information server side can (but does not have to) be problematic. There are two pitfalls ...
Anders's user avatar
  • 65.6k
3 votes
Accepted

How does collecting sensitive data using iframes increase security?

You ask a great question and the technical reason that iframes add a layer of security is covered in many of the above answers. However, you also correctly observe that if an attacker has access to ...
withoutfire's user avatar
  • 1,040
2 votes

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

Yes, SAQ A-EP requires your hosting provider be validated to all applicable PCI DSS requirements. To quote the SAQ A-EP itself (emphasis mine): SAQ A-EP merchants confirm that, for this payment ...
gowenfawr's user avatar
  • 72.8k
2 votes

PCI DSS Compliance for Client

If your e-commerce site neither stores, processes nor transmits PCI data, then you can take what is known as Attestation A. This is what you do when you use a so-called "Payments 2.0" provider, such ...
user127's user avatar
  • 51
2 votes
Accepted

PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops

As I see, there are two web shops of the same company in scope where one has hosted its website in their own data center while other one has hosted on cloud (Azure). Since the first webshop uses ...
taurean72's user avatar
2 votes

Do I have to comply with PCI DSS for bank transfers?

PCI DSS is for handling card data Payment Card Industry Data Security Standard is, as the name states, a standard for handling payment card data. Compliance with PCI DSS is generally a contractual ...
Peteris's user avatar
  • 8,429
2 votes
Accepted

Script tag loading "xss.re/692" in e-commerce transaction data - real attack or something else?

What does the script do? It sends of some information to xss.re (by including it in a query string when loading images with JavaScript). If the attack had been successful, any person visiting the ...
Anders's user avatar
  • 65.6k
2 votes

Driver's license required for online purchases

I'll start with the TLDR; version of the answers to your explicit questions, and then give some breakdown beyond that. A merchant may set any requirement they wish upon a transaction (as long as it ...
Ruscal's user avatar
  • 851
2 votes

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

PCI compliance is about payment data. An email address on it's own is not payment data, so it's nothing you have to worry about with regards to PCI compliance. Generally speaking, the email address ...
nvoigt's user avatar
  • 1,653
2 votes
Accepted

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Yes, PCI allows you to store a customer's card provided you do so in compliance with the PCI DSS. Specifically, Requirement 3: Protect stored cardholder data outlines what you may (card number) and ...
gowenfawr's user avatar
  • 72.8k
2 votes
Accepted

Does the “post/redirect/get" pattern create security problems?

It seems someone can pretty easily get my Querystring parameters and then go look at my transaction at any later time. Maybe it is like this, maybe not. The actual implementation is not known. But ...
Steffen Ullrich's user avatar
2 votes

How does collecting sensitive data using iframes increase security?

I ran a small organization's e-commerce operation. You're looking at it from an in-browser technology perspective, and presuming every organization is responsible for its own security. Small ...
Harper - Reinstate Monica's user avatar
2 votes
Accepted

Can CVV be input in a standard web site? The site doesn't store it

Assumptions: 3rd party partner is an approved Payment Processor, "Standard Website" means a site using HTTPS/TLS1.2, and all other PCI requirements are followed (e.g., data in transit ...
kenlukas's user avatar
  • 1,988
1 vote

List additional cart items in ecommerce website

In short, yes. That is not a well designed website and I'd stay clear, certainly don't put any of your payment details into it! With regards to your question, it's a little vague so I want to ...
Tipping44's user avatar
  • 347
1 vote

Driver's license required for online purchases

Unsure in the US, but in France, when a client contests an online payment, the bank has to prove that the order of payment was validated by the client. A signed document is of course a proof, an order ...
Serge Ballesta's user avatar
1 vote

Driver's license required for online purchases

Can merchants require a copy of a photo ID? Depends on the credit card and the nature/location of the transaction. Merchant agreements for Visa and Mastercard indicate they cannot require ID (for ...
YLearn's user avatar
  • 4,017
1 vote

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

You need to be very careful to understand if you are embedding an IFRAME from Square/Stripe or using JavaScript libraries. As the IFRAME or full redirect is currently classed as outsourcing as Joe ...
withoutfire's user avatar
  • 1,040

Only top scored, non community-wiki answers of a minimum length are eligible