Hacker News Reader

Comment by MBCook | Hacker News Reader

I worked on something with credit card processing a few years ago. As I remember, it doesn't really matter if the details hit your server, but the point is you absolutely can not save them.

No putting them in a DB, no putting the in a log file (not even the last four or something like that), nothing. So if your form takes the numbers in, you make an API call, and then you blank them in memory you were OK.

If you put them in the user's session, you were in trouble.

It's all insanely complicated, and the only good solution is "don't do it." There's a good reason people use things like Stripe, PayPal, Authorize.net's CIM (where they store it and certify that they are PCI compliant).

View on HN

To make sure there isn't confusion here, having card details go through your server, even if you aren't saving them, still can lead to certain PCI compliance burdens (e.g. you may need to get an audit from a PCI auditor verifying this).

Having the card never go to your server is the best way to make sure you are PCI compliant, as you mention.

Ah, thanks. Like I said, I wasn't sure. We made sure we were PCI compliant, but I wasn't in charge of that by any means.

One component is the transit security -is the data safe from interception in transit (on the network). The other component it security of the data at rest - is the data safe from interception if it comes to rest on your server (sessions, databases, etc.).

From data security standpoint is is easier to let somebody else do it, but end users tend to have a less satisfying checkout experience.

This is wrong. You still need to be PCI compliant even if you don't persist the CC data. There are a few bullet points you don't need to worry about in that case, but the vast majority still apply if the system has anything to do with credit cards (such as the details hitting your server).

Please read stripe's TOS - your application is REQUIRED to be PCI compliant.

I think I know why I got this wrong. There are multiple levels of PCI compliance, right? I think we used services that allowed us to not have to be compliant with data at rest (since we didn't store it), but only the data in transit (or whatever the equivalent term is).

This is by no means my area of expertise (as I have accidentally proven).

Absolutely, there are different levels. However, for all levels you have to do some work to achieve PCI compliance (and overall security of your system). There is no magic in this world :)

True, and the thing about PCI is that many apps probably could benefit from being forced to do this type of work.

Reply on news.ycombinator.com