Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Sylvia Else Newsgroups: comp.misc Subject: Re: eHow advise to use Base64 to "encrypt" credit card data Date: Tue, 23 Sep 2014 13:03:33 +1000 Lines: 29 Message-ID: References: <7sb6igO5z2AB8bedLkfFk/Lw@dont-email.me> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net 6DBFwQrWvzjVd7smETE1aQiUimvn6AIMmBeW22vDWT3XFn43Hj Cancel-Lock: sha1:waXiIg0aO0a5RlUsw3w9FUr7quQ= User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 In-Reply-To: Xref: csiph.com comp.misc:5049 On 23/09/2014 11:37 AM, invis wrote: > On 23/09/2014 02:22, Sylvia Else wrote: >> If there's to be any point in storing the details, there has to be a >> way of retrieving the plain-text. > > True. > >> Unless this requires data supplied by the user (for example, their >> password) that is not retained on the system, then it's just security >> by obscurity, since if the system can retrieve the plain-text, then >> so can a hacker. > > False. What's false? > > A cracker can intercept any input to the system, so having a > user-provided password doesn't help. It rather limits the scope of an attack, since they can only get details for those users who connect while the hacker has access. The issue of storage is then a bit moot, since if a user is buying something, their details will be exposed then anyway. It's a lot better than a situation where a hacker needs only copy parts of a database before disconnecting forever having obtained all the details. Sylvia.