News for hackers. Stuff that matters.

A comment on Very Good Security. Parent comment

Re:Very Good Security by raesene9 on Tuesday August 28, 2018 @03:55PM (#17862296)
If by outsourcing PCI compliance entirely, they mean "ensure you don't store cardholder data by tokenizing it and we store the real stuff" this is very much not a new solution, so I'd struggle a bit to see the value of a new entrant.

There's already quite a few payment gateways where an e-commerce site can iFrame the payment page (or similar) to ensure that they never see the real cardholder data.

(the fact that this shouldn't really make them out-of-scope for PCI is a different problem)

[ Parent | on HN ]
Re:Very Good Security by twelve40 on Wednesday August 29, 2018 @03:10AM (#17866308)
This is not a payments gateway. We use them for something entirely different than processing payments or credit cards. I haven't seen a general PCI-compliant transparent PII tokenizer proxy service like that. If you know of one, let me know, maybe we'll even switch. But this is not a payment gateway solution, and it's offering many more use cases than an iframe or credit cards.
[ Parent | on HN ]