Hacker News Reader

Comment by fatnoah | Hacker News Reader

> If you want to see what you should never do as a software engineer if you like not being in jail, this is it.

Not quite the same level, but in my early days working on a payment system, a request from the product team was to create a summary screen where customer service reps could see payment histories AND THE CC INFORMATION USED FOR THE PAYMENTS. In my mind, there was no way that would end well, so I strenuously objected and had to endure some very heated conversations over the course of a month or two. Eventually product team agreed to last 4 digits + expiration.

Nowadays it wouldn't even be a conversation, but in the early 2000's, it was a different world.

View on HN

My first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and probably shouldn't have been working on it.

If it's any consolation, the entire industry was in that state: poor controls, poor encryption, and security, etc.

"was"? It still seems like a confused mess with lots and log 'security' that people ignore

Sure, there's always room for improvement, but at the very least SSL/TLS is ubiquitous now, there actual TLS versions are much better, developers generally view holding onto CC data directly as toxic (the growth of things like Stripe checkout, etc.)

Yeah, I worked for an agency around the same sort of time and saw exactly the same kind of thing.

I remember one site that saved all the CC and order details to a plain text file in the web root. This was opened using an FTP programme every evening and someone would run the numbers through the machine in their store and post out the orders...

This surprisingly sounds very much like the actual ACH system still in use today in the US (from my limited understanding)

Do you mean not a conversation in the sense that we wouldn’t think of doing it, or in the sense that we wouldn’t think of questioning it?

I took it as "wouldn't think of doing it".

We wouldn't think of doing it. This is the kind of thing your auditors would see from outer space. If you're doing this and you don't have auditors, you're lying on your self-assessment questionnaire. Either way your merchant status is in jeopardy.

Yeah, I definitely meant the former. We (hopefully?) wouldn't even think of doing it.

Reply on news.ycombinator.com