Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #5027 > unrolled thread

eHow advise to use Base64 to "encrypt" credit card data

Back to article view | Back to comp.misc

Contents

  eHow advise to use Base64 to "encrypt" credit card data Rich <rich@example.invalid> - 2014-09-22 11:54 +0000
    Re: eHow advise to use Base64 to "encrypt" credit card data Paul Sture <nospam@sture.ch> - 2014-09-22 14:12 +0200
    Re: eHow advise to use Base64 to "encrypt" credit card data scott@alfter.diespammersdie.us (Scott Alfter) - 2014-09-22 14:32 +0000
    Re: eHow advise to use Base64 to "encrypt" credit card data polygonum <rmoudndgers@vrod.co.uk> - 2014-09-22 18:38 +0100
    Re: eHow advise to use Base64 to "encrypt" credit card data Sylvia Else <sylvia@not.at.this.address> - 2014-09-23 11:22 +1000
      Re: eHow advise to use Base64 to "encrypt" credit card data invis <invis@invis.net> - 2014-09-23 02:37 +0100
        Re: eHow advise to use Base64 to "encrypt" credit card data Sylvia Else <sylvia@not.at.this.address> - 2014-09-23 13:03 +1000

#5027 — eHow advise to use Base64 to "encrypt" credit card data

http://blog.human-friendly.com/ehow-advise-to-use-base64-to-encrypt-credit-card-data

   This is a short WTF post about this article on ehow which contains
   insanely bad advice that I thought must be a joke when I saw this
   tweeted extract:

   Design a script to encrypt the credit card information. Using an
   encryption algorithm of your choice, create a routine that converts the
   information into encrypted data. Programming languages such as PHP have
   built in functions that can encrypt. An example is the base 64
   encryption function that can be used by invoking the following code:

   base64_encode($credit_card_number);

   Save this encrypted data in a separate variable.

   ...

[toc] | [next] | [standalone]

#5030

On 2014-09-22, Rich <rich@example.invalid> wrote:
> http://blog.human-friendly.com/ehow-advise-to-use-base64-to-encrypt-credit-card-data
>
>    This is a short WTF post about this article on ehow which contains
>    insanely bad advice that I thought must be a joke when I saw this
>    tweeted extract:
>
>    Design a script to encrypt the credit card information. Using an
>    encryption algorithm of your choice, create a routine that converts the
>    information into encrypted data. Programming languages such as PHP have
>    built in functions that can encrypt. An example is the base 64
>    encryption function that can be used by invoking the following code:
>
>    base64_encode($credit_card_number);
>
>    Save this encrypted data in a separate variable.
>
>    ...

I cracked up at the first instruction on the offending website.

"Create an input form that accepts credit card number submissions using
Notepad."

Right, I've got Notepad fired up. Where do I put my credit card number?

-- 
"Trustworthy Computing" is dead - one-third engineers, two-thirds PRs
                           - Caspar Bowden, Former Microsoft staffer

[toc] | [prev] | [next] | [standalone]

#5032

In article <7sb6igO5z2AB8bedLkfFk/Lw@dont-email.me>,
Rich  <rich@example.invalid> wrote:
>http://blog.human-friendly.com/ehow-advise-to-use-base64-to-encrypt-credit-card-data
>
>   This is a short WTF post about this article on ehow which contains
>   insanely bad advice that I thought must be a joke when I saw this
>   tweeted extract:
>
>   Design a script to encrypt the credit card information. Using an
>   encryption algorithm of your choice, create a routine that converts the
>   information into encrypted data. Programming languages such as PHP have
>   built in functions that can encrypt. An example is the base 64
>   encryption function that can be used by invoking the following code:
>
>   base64_encode($credit_card_number);
>
>   Save this encrypted data in a separate variable.

I use two rounds of rot13 for my most secret information. It doesn't bloat
up like it does with base64.

:-)

  _/_
 / v \ Scott Alfter (remove the obvious to send mail)
(IIGS( http://alfter.us/            Top-posting!
 \_^_/                              >What's the most annoying thing on Usenet?

[toc] | [prev] | [next] | [standalone]

#5039

On 22/09/2014 12:54, Rich wrote:
> article on ehow which contains
>     insanely bad advice

Are there any that don't?

-- 
Rod

[toc] | [prev] | [next] | [standalone]

#5043

On 22/09/2014 9:54 PM, Rich wrote:
> http://blog.human-friendly.com/ehow-advise-to-use-base64-to-encrypt-credit-card-data
>
>     This is a short WTF post about this article on ehow which contains
>     insanely bad advice that I thought must be a joke when I saw this
>     tweeted extract:
>
>     Design a script to encrypt the credit card information. Using an
>     encryption algorithm of your choice, create a routine that converts the
>     information into encrypted data. Programming languages such as PHP have
>     built in functions that can encrypt. An example is the base 64
>     encryption function that can be used by invoking the following code:
>
>     base64_encode($credit_card_number);
>
>     Save this encrypted data in a separate variable.
>
>     ...
>

If there's to be any point in storing the details, there has to be a way 
of retrieving the plain-text. Unless this requires data supplied by the 
user (for example, their password) that is not retained on the system, 
then it's just security by obscurity, since if the system can retrieve 
the plain-text, then so can a hacker.

If the user's password is to be involved, it should probably be hashed, 
and that hash preserved during the session, rather than the password 
itself, to limit the exposure of the password. It goes without saying 
that this hash is not the same as the hash of the password stored for 
the purpose of validating logins.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#5045

On 23/09/2014 02:22, Sylvia Else wrote:
> If there's to be any point in storing the details, there has to be a
> way of retrieving the plain-text.

True.

> Unless this requires data supplied by the user (for example, their
> password) that is not retained on the system, then it's just security
> by obscurity, since if the system can retrieve the plain-text, then
> so can a hacker.

False.

A cracker can intercept any input to the system, so having a
user-provided password doesn't help.

However, where there are multiple discrete systems using asymmetric
encryption, encrypting the details makes a lot of sense.

[toc] | [prev] | [next] | [standalone]

#5049

On 23/09/2014 11:37 AM, invis wrote:
> On 23/09/2014 02:22, Sylvia Else wrote:
>> If there's to be any point in storing the details, there has to be a
>> way of retrieving the plain-text.
>
> True.
>
>> Unless this requires data supplied by the user (for example, their
>> password) that is not retained on the system, then it's just security
>> by obscurity, since if the system can retrieve the plain-text, then
>> so can a hacker.
>
> False.

What's false?
>
> A cracker can intercept any input to the system, so having a
> user-provided password doesn't help.

It rather limits the scope of an attack, since they can only get details 
for those users who connect while the hacker has access. The issue of 
storage is then a bit moot, since if a user is buying something, their 
details will be exposed then anyway.

It's a lot better than a situation where a hacker needs only copy parts 
of a database before disconnecting forever having obtained all the details.

Sylvia.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web