http://www.perlmonks.org?node_id=307064


in reply to Use placeholders. For SECURITY!

I was bothered by Re: Re: (OT) SSL Certificates: Self-Signing and Alternative Solutions because it shows a fundamental misunderstanding of how easy it is to steal credit card databases.

???

That entire point of that node was that it is, in fact, really easy to nab CC nums from databases. So easy that you could throw away SSL entirely in many cases and the security of the entire system wouldn't substantially drop.

I agree that this statement might not be clear:

While we're bothering to educate users, why not explode the "Must Have Encryption on Credit Card Numbers" myth?

The myth concerns SSL, not the database server. You should always have encryption on the CC nums in the database, if you must store them at all.

----
I wanted to explore how Perl's closures can be manipulated, and ended up creating an object system by accident.
-- Schemer

: () { :|:& };:

Note: All code is untested, unless otherwise stated

Replies are listed 'Best First'.
Re: Re: Use placeholders. For SECURITY!
by tilly (Archbishop) on Nov 14, 2003 at 16:00 UTC
    My point was that you characterized the act of stealing them as waiting for a good exploit to come along and then finding a poorly secured box that you can target. Which says that for most developers, worrying about it is Someone Else's Problem. It also comforts a lot of people that they are OK because they have a firewall in place.

    I think that developers should be far more paranoid than that.

    Also while I agree that people have a lot of obvious problems which cause more failures than whether or not to use encryption, that is not a good reason to avoid using encryption. Sure, one step in the chain being done right or wrong doesn't usually make that much of a difference. But if people at each step assume that all of the others are wrong, then you don't really have much of a chain at all. Start getting things right where you can control them (your piece) and work from there. SSL doesn't solve your basic problems, but it is an easy thing to do that does solve some that come up.

      My point was that you characterized the act of stealing them as waiting for a good exploit to come along and then finding a poorly secured box that you can target. Which says that for most developers, worrying about it is Someone Else's Problem. It also comforts a lot of people that they are OK because they have a firewall in place.

      Ahh, I see what you're saying now. Certainly, just because you have a firewall in front of your database doesn't make you secure. I pointed it out only because an awful lot of places don't have a firewall in place, and often store cleartext CC nums, and there is nothing SSL or anything else client-side can do to change that fact.

      SSL doesn't solve your basic problems, but it is an easy thing to do that does solve some that come up.

      Agreed. SSL is out there, it works, and it's reasonably easy to set up. I only wanted to point out that well-meaning people have taught Aunt Nellie that if that little padlock shows up at the bottom of the browser, her CC num is secure, when it often isn't. As long as the Internet community already went to all the trouble to get SSL working, we might as well use it. However, it's by far not the weakest link in the chain.

      ----
      I wanted to explore how Perl's closures can be manipulated, and ended up creating an object system by accident.
      -- Schemer

      : () { :|:& };:

      Note: All code is untested, unless otherwise stated