Re: Permissions Ignored - PLEASE HELP
This WebDNA talk-list message is from 2003
It keeps the original formatting.
numero = 47109
interpreted = N
texte = > >those credit card numbers are still stored in the individual orderfiles, > >therefore... YES, it is MY responsibility to protect those numbers. > > > First, the info in the order files should be written to a database, > with the credit card numbers encrypted.Hell yes - also encrypt the exp date and name.> > Second, the order files should be DELETED immediately after each > transaction is completed -- to prevent anyone from being able to > download them, and to prevent anyone with username/password access > from seeing the UNENCRYPTED credit card values in those files.There is a setting in webcat admin for how often to sweep the directory but the files can always be [deletefile] just in case. This will stop stuff like this happening... This is the company that both alain and i used to work for. they configured their brand new server wrong after we left... big mistake http://www.nzherald.co.nz/storydisplay.cfm?storyID=2999140> > Third, all your webdna templates and include files should be > encrypted -- to prevent anyone from seeing the SEED value you used to > encrypt the credit card values when storing them in your database > file.We have a database of 1000 randomly generated seeds. the ID of the seed to use is stored in the cc database and a lookup is used to find the seed for the particular row. the two databases are on opposite ends of the server and neither of them is in a served directory.> > Fourth, you should *NEVER* display the full credit card number on any > web page, even when you're decrypting those values for some reason. > Instead you should display only the last 3 or 4 digits of the number > on the page. >NEVER! The company above also use to send invoices via email with full credit card number as confirmation to the customer. BIG MISTAKE - HUGE!Everything surrounding an online store should also be wrapped up in SSL but this should be pretty obvious. > > Sincerely, > Kenneth Grome > > --------------------------------------------------- > WebDNA Professional Training and Development Center > 175 J. Llorente Street +63 (32) 255-6921 > Cebu City, Cebu 6000 kengrome@webdna.net > Philippines http://www.webdna.net > --------------------------------------------------- > > ------------------------------------------------------------- > This message is sent to you because you are subscribed to > the mailing list
. > To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to > Web Archive of this list is at: http://webdna.smithmicro.com/ ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Associated Messages, from the most recent to the oldest:
> >those credit card numbers are still stored in the individual orderfiles, > >therefore... YES, it is MY responsibility to protect those numbers. > > > First, the info in the order files should be written to a database, > with the credit card numbers encrypted.Hell yes - also encrypt the exp date and name.> > Second, the order files should be DELETED immediately after each > transaction is completed -- to prevent anyone from being able to > download them, and to prevent anyone with username/password access > from seeing the UNENCRYPTED credit card values in those files.There is a setting in webcat admin for how often to sweep the directory but the files can always be [deletefile] just in case. This will stop stuff like this happening... This is the company that both alain and i used to work for. they configured their brand new server wrong after we left... big mistake http://www.nzherald.co.nz/storydisplay.cfm?storyID=2999140> > Third, all your webdna templates and include files should be > encrypted -- to prevent anyone from seeing the SEED value you used to > encrypt the credit card values when storing them in your database > file.We have a database of 1000 randomly generated seeds. the ID of the seed to use is stored in the cc database and a lookup is used to find the seed for the particular row. the two databases are on opposite ends of the server and neither of them is in a served directory.> > Fourth, you should *NEVER* display the full credit card number on any > web page, even when you're decrypting those values for some reason. > Instead you should display only the last 3 or 4 digits of the number > on the page. >NEVER! The company above also use to send invoices via email with full credit card number as confirmation to the customer. BIG MISTAKE - HUGE!Everything surrounding an online store should also be wrapped up in SSL but this should be pretty obvious. > > Sincerely, > Kenneth Grome > > --------------------------------------------------- > WebDNA Professional Training and Development Center > 175 J. Llorente Street +63 (32) 255-6921 > Cebu City, Cebu 6000 kengrome@webdna.net > Philippines http://www.webdna.net > --------------------------------------------------- > > ------------------------------------------------------------- > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to > Web Archive of this list is at: http://webdna.smithmicro.com/ ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Andrew Simpson
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Apache 2.x (2003)
RE:It just Does't add up!!! (1997)
Emailer (1997)
This message couldn't reach the list! (1998)
Which GUI HTML editors work with WC ? (1997)
Webcatalog 4.0 on Mac OS & WebStar (2000)
Expiration of Carts (1997)
Requiring that certain fields be completed (1997)
[WebDNA] [OT] the "Work in progress" thread. (2009)
Kaaaaahhhhhhhnnnnnnn! (1997)
Using Applescript to process WebCatalog functions (1998)
multi-paragraph fields (1997)
pictures / referrer etc. (1998)
Image upload (2000)
Fun with dates (1997)
Weird problems with [SHOWIF]s (1997)
Text in coloums... (2000)
Strange intermittent WebDNA problems (2008)
$Replace with [founditems] (1997)
Grep Help (2003)