Hacker News Reader

Comment by ralph84 | Hacker News Reader

I give out my credit card number hundreds of times per year. Credit cards wouldn't be very useful if you never gave them out.

View on HN

An ecommerce site has a merchant agreement with a payment processor to comply with PCI DSS. This does not. It is in no way similar.

FYI we are complying with PCI DSS when you use this site - you can read details in the FAQ

Do we have proof of that? I think the fact that we're taking your word for everything so far is the source of the discomfort here.

Sort of humorous comment, as PCI DSS is self assessment and attestation of compliance. If OP states they’ve met their burden, that’s all that’s required at their scale.

Really? I evidently know nothing of the matter, but you're saying that the auditors only get involved when they become a larger operation?

Yep. Card networks can also unilaterally decide your level.

https://www.pcicomplianceguide.org/faq/#4

Disclaimer: I work in governance/risk/compliance, but have not performed PCI compliance work in the last several years.

PCI DSS assessments are signed by natural persons, not arbitrary HTML content.

Natural persons who are rarely, if ever, pursued when breaches occur.

Anyone can make a FAQ on the web. Not everyone can prove compliance with PCI DSS.

The same could be said about any other online merchant...

It could but they should be able to provide an Attestation of Compliance. If they can't, then you can trust that they're PCI compliant.

I give out my credit card number hundreds of times per year to websites that I have not verified have a merchant agreement with a payment processor to comply with PCI DSS.

In terms of what users are taught (which is plainly the context of the comment you are replying to), this website is identical to ecommerce sites.

Reply on news.ycombinator.com