Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #5043

Re: eHow advise to use Base64 to "encrypt" credit card data

Show all headers | View raw

On 22/09/2014 9:54 PM, Rich wrote:
> http://blog.human-friendly.com/ehow-advise-to-use-base64-to-encrypt-credit-card-data
>
>     This is a short WTF post about this article on ehow which contains
>     insanely bad advice that I thought must be a joke when I saw this
>     tweeted extract:
>
>     Design a script to encrypt the credit card information. Using an
>     encryption algorithm of your choice, create a routine that converts the
>     information into encrypted data. Programming languages such as PHP have
>     built in functions that can encrypt. An example is the base 64
>     encryption function that can be used by invoking the following code:
>
>     base64_encode($credit_card_number);
>
>     Save this encrypted data in a separate variable.
>
>     ...
>

If there's to be any point in storing the details, there has to be a way 
of retrieving the plain-text. Unless this requires data supplied by the 
user (for example, their password) that is not retained on the system, 
then it's just security by obscurity, since if the system can retrieve 
the plain-text, then so can a hacker.

If the user's password is to be involved, it should probably be hashed, 
and that hash preserved during the session, rather than the password 
itself, to limit the exposure of the password. It goes without saying 
that this hash is not the same as the hash of the password stored for 
the purpose of validating logins.

Sylvia.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

eHow advise to use Base64 to "encrypt" credit card data Rich <rich@example.invalid> - 2014-09-22 11:54 +0000
  Re: eHow advise to use Base64 to "encrypt" credit card data Paul Sture <nospam@sture.ch> - 2014-09-22 14:12 +0200
  Re: eHow advise to use Base64 to "encrypt" credit card data scott@alfter.diespammersdie.us (Scott Alfter) - 2014-09-22 14:32 +0000
  Re: eHow advise to use Base64 to "encrypt" credit card data polygonum <rmoudndgers@vrod.co.uk> - 2014-09-22 18:38 +0100
  Re: eHow advise to use Base64 to "encrypt" credit card data Sylvia Else <sylvia@not.at.this.address> - 2014-09-23 11:22 +1000
    Re: eHow advise to use Base64 to "encrypt" credit card data invis <invis@invis.net> - 2014-09-23 02:37 +0100
      Re: eHow advise to use Base64 to "encrypt" credit card data Sylvia Else <sylvia@not.at.this.address> - 2014-09-23 13:03 +1000

csiph-web