[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread valdhor
http://php.net/manual/en/function.md5.php --- In flexcoders@yahoogroups.com, Christophe christophe_jacque...@... wrote: Hello, I use Flex and Amfphp with php / mySql. In the database, I want to encrypt Credit card number with MD5. How to add this functionnality ? Thank you,

[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Flex
Christophe, MD5 is a one way hash so it's not like you can use the number meaningfully later on or get the card number back. There are other alternatives to credit card processing...payments gateways. Sorry to toot my own horn here, but we use Google checkout and Paypal simply because we

[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Jeff
PCI Compliance is a nightmare. ;) I'm sure Amazon.com goes through the process of being PCI compliant; and has high level security for storing and encrypting credit cards. For example, I'm sure their credit card storage machines are in a secure building [with guards and limited access] on

[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Jeff
You need to make your superiors aware of the PCI Compliance regulations. You're not actually breaking the law, but you may be breaking your contract with your merchant provider. I read all 80+ pages or so of my merchant account contract. Someone at your company should do the same to make

Re: [flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Laurence MacNeill
At 12:51 PM 2/11/2010, you wrote: You need to make your superiors aware of the PCI Compliance regulations. You're not actually breaking the law, but you may be breaking your contract with your merchant provider. I read all 80+ pages or so of my merchant account contract. Someone at your

[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Jeff
That is unequivocally wrong. However, depending what you're doing there are different levels of Compliance. Since you are storing credit cards; I thought you get bumped up to the highest level of compliance. DotComIt ( Flextras ) does a self assessment questionnaire and a quarterly web site

Re: [flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Lee Jenkins
Jeff wrote: That is unequivocally wrong. As I said, that was my understanding and it was so when the mandate was first released, but I assume that it was phased out in one of the steps to full PCI/DSS or maybe it is different for web facing models? I'll ask my compliance rep next time I

[flexcoders] Re: Credit Card number encryption

2010-02-11 Thread Jeff
I know the mandates have gotten stricter after they have been released. It sounds like you've been dealing with it longer than I have. Without a doubt a lot of compliance issues have very little to do with coding, but rather relate to administrative type of issues for how data is handled and