Hacker News Reader

Comment by chetanahuja | Hacker News Reader

and umm... the OP was able to access their account details, including CC data over a plain HTTP connection.

Good point - can't believe I didn't pick that up! That's an even more obvious violation of PCI-DSS (and even the most basic security imaginable!).

Not the entire card, just the last four digits and expiration date. Is there anything that says that's not allowed? The PCI is about storage of the data.

It's bonkers to display it over an insecure connection, but I don't think that it's disallowed.

You really need to read the PCI-DSS standard before you make comments like that.

Rather than me point out exactly why what you just said was completely wrong, I suggest you download it from here:

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1....

At the very least, read requirement 4. The simple fact is that they were allowing customers to enter their credit card details and submit that data over HTTP.

Got it, thanks for the link.

It was in my original post!

I didn't follow every link you included, and didn't expect to argue about this – also, I didn't realize this was your post, my bad!

You can ignore my comment about the /payments page, I'll assume you checked that, so yeah, that's insane if you can update payment information on an insecure page.

If they were using stripe how did they pass details through onto HTTP? as far as I remember their webhook won't even communicate with an unsecure page. They must be using some other payment gateway.

I sure hope they don't gather the data via calls to Stripe's API then push it out via HTTP (and vice versa!)

Oh brother - surely they weren't storing that data themselves?!?

Reply on news.ycombinator.com