Menu
Community /Pin to ProfileBookmark
@NogDogAug 30.2009 — #You really, really do not want to keep credit card numbers in any manner if there is any way to avoid it. If you do store them, then you had best be prepared to either do a lot of reading on all the regulations involved in doing so or hiring someone who specializes in this, as the legal risks of not doing so could be severe. Your best bet is usually to use a 3rd party billing service, letting them assume the risk of processing/storing the card data.
But if you are going to take on the responsibility and store them, you need to use a strong encryption method, not something easily reversed like base64_encode. MySQL has a number ofencryption functions built in, such as AES_ENCRYPT() and DES_ENCRYPT(). But even such encryption is useless if your site can be hacked and your source code read, giving any such hacker info on which encryption method you used and what the encryption key was.
Also, if you are going to be accepting CC info from users, you [i]must[/i] use an SSL encryption in the connection to the applicable pages (HTTP[b]S[/b]).@NogDogSep 01.2009 — #While we programmers tend to concentrate on security holes in the code, a lot of hacking is done via "people holes" (that sounds vaguely disgusting). Con jobs/scams to get people's login credentials (phishing being a notorious example), filtering through trash to find useful info in documents that should have been shredded but weren't, people using their pets' names and other easy things to guess if you know something about them (this is partly coding security too, in allowing weak passwords), disgruntled employees providing access or doing the hacking themselves, etc.
Presumably a company dedicated to such billing processes would have efforts in place to address physical security, personnel security, and best practices in terms of code security. A weak link in any one of those areas can bypass the measures taken in the other two areas.
Password and Credit Card encryption
I am building a site, and will have it hosted with a public company (ipowerweb.com). I would like to keep customers credit cards in the database.
Does anyone have advice for the best way to secure and encrypt them ? What about storing and encryption of passwords, too (please) ?
Thanks for any insight.
Mike P
Sign in
to post a comment12 Comments(s) ↴
0
@NogDogAug 30.2009 — #You really, really do not want to keep credit card numbers in any manner if there is any way to avoid it. If you do store them, then you had best be prepared to either do a lot of reading on all the regulations involved in doing so or hiring someone who specializes in this, as the legal risks of not doing so could be severe. Your best bet is usually to use a 3rd party billing service, letting them assume the risk of processing/storing the card data.But if you are going to take on the responsibility and store them, you need to use a strong encryption method, not something easily reversed like base64_encode. MySQL has a number of
Also, if you are going to be accepting CC info from users, you [i]must[/i] use an SSL encryption in the connection to the applicable pages (HTTP[b]S[/b]).
0
@NogDogSep 01.2009 — #Presumably a company dedicated to such billing processes would have efforts in place to address physical security, personnel security, and best practices in terms of code security. A weak link in any one of those areas can bypass the measures taken in the other two areas.