Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #4750

Re: storing credit card data

Show all headers | View raw

"Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> writes:

> Better not to keep sensitive data in RAM if possible.  At minimum encrypt 
> (actually more like obfuscate) and scatter the data around the address space, 
> or better wipe it and release the memory (to be regenerated later if there is 
> need).

Naturally, you can't wholly wipe the decryption key from RAM unless you
want the administrators to have to re-enter it for every new transaction
that the system has to process. Not having it lying around in RAM in
plain form is a good point though; the PCI compliance people didn't
mention the possibility of obfuscating it. Perhaps a more transient kind
of data that was of interest is the card security code used in online
transactions, especially as for compliance we were not permitted to
store those (beyond, say, as required for retrying a transaction).

This does raise the point that, especially with garbage collectors and
virtualization and suchlike, I found that many programming languages do
not make it easy to write portable code to allocate unswappable memory
that you can be sure of successfully wiping without leaving any copies.

-- Mark

Back to comp.programming | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

storing credit card data b <mike7411@gmail.com> - 2014-09-04 22:05 -0700
  Re: storing credit card data Robert Wessel <robertwessel2@yahoo.com> - 2014-09-05 01:51 -0500
    Re: storing credit card data Mark Carroll <mtbc@bcs.org> - 2014-09-05 08:26 +0100
      Re: storing credit card data "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-09-05 12:41 +0100
        Re: storing credit card data Mark Carroll <mtbc@bcs.org> - 2014-09-05 13:08 +0100
          Re: storing credit card data "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-09-05 16:16 +0100

csiph-web