Hacker News Reader

Comment by Znafon | Hacker News Reader

I dont think so, this would probably go against PCI DSS.

Most payment gateways offer a card fingerprinting feature. Here’s Stripe’s: https://stripe.com/docs/api/cards/object#card_object-fingerp....

It’s fine with PCI DSS as long as it is not reversible.

Stripe and Square both identify consumers by their unique CC numbers. If I swipe my card on a square reader, it recognizes me and asks if I want a receipt sent to my phone or email, even if I’ve never purchased from that vendor before.

The whole point of tokenizing is to get rid of PCI problems on CC analysis and testing, as I understand it.

Is there credit card tokenization services from which you can get a token identifying permanently a card without the possibility to make a payment?

Yes, most PSPs do this. E.g. Stripe calls it a fingerprint. It's only valid for your merchant ID (i.e. if we both signed up for Stripe and swiped the same card, we'd get different fingerprints).

https://stripe.com/docs/api/tokens/create_card (notice the request has no charge, but the response contains a fingerprint).

To state the obvious: it's not determinstic outside of Stripe, and there's no way to revert it, or even iterate over all CC numbers and brute force the space. You'd need Stripe's secret, e.g. assuming they use HMAC.

Not really. I work with payment processing, I've got the partially obscured credit card number, usually the name and the location. Plus a bunch of other info.

I've seen several deterministic tokenizers for payment cards.

Where there done by the payment processor like Artemis2 or in house?

I'm asking because I saw a lot of in-house tokenizer with hashes or deterministic encryption that could get reversed in a few seconds by brute force since the space to cover is so small.

Reply on news.ycombinator.com