Hacker News Reader

Comment by kevin_thibedeau | Hacker News Reader

Let me guess. They passed their PCI audits with flying colors.

I’m sure the only reason that only partial credit card numbers were stolen is that PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back).

> PCI makes it very hard for Panera to store complete credit card numbers (with expiration dates and the security code on the back)

How about impossible. Storing the CVV number is 100% not allowed. Even storing complete cards numbers is only allowed under very specific conditions. Any deviation opens them up to liability for related fraud.

Even storing complete cards numbers is only allowed under very specific conditions.

We encrypt these at the app, even before putting them into the DB, yada yada. The PCI auditor actually made us restore the DB from backup onto another server and show them the data, to prove that some magical process in the backup program didn't cause them to come un-encrypted. They also wanted us to change all corporate email addresses to random characters, ostensibly to prevent spearfishing (we declined to take this suggestion). My point is that they go to crazy lengths to ensure you're doing this stuff right.

I find PCI compliance annoying mostly due to individual auditor predilections.

I've heard that there's a fair amount of variability. Obviously at least part of our audit team were lunatics.

Thank you. I didn’t remember the details and went with “hard” because whenever I say “impossible” somebody will come up with some exception to the rule.

As long as that Nessus scan passed, they're in the clear, right?

My (potentially limited) understanding: Certification by an ASV doesn't free you from any responsibilities. You could still violate the DSS even if an ASV clears you.

To be fair, auditors can only check what they were hired to. PCI audits are better than having none at all but they clearly can't be the only audit.

Reply on news.ycombinator.com