News for hackers. Stuff that matters.

A comment on Chase did a bad thing, so we did a good thing. Parent comment

Re:Chase did a bad thing, so we did a good thing by WoahNoun on Tuesday June 11, 2019 @07:24PM (#20160422)
An ecommerce site has a merchant agreement with a payment processor to comply with PCI DSS. This does not. It is in no way similar.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by zbruhnke on Tuesday June 11, 2019 @07:28PM (#20160451)
FYI we are complying with PCI DSS when you use this site - you can read details in the FAQ
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by snazz on Tuesday June 11, 2019 @08:15PM (#20160694)
Do we have proof of that? I think the fact that we're taking your word for everything so far is the source of the discomfort here.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @08:23PM (#20160729)
Sort of humorous comment, as PCI DSS is self assessment and attestation of compliance. If OP states they’ve met their burden, that’s all that’s required at their scale.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by snazz on Tuesday June 11, 2019 @08:30PM (#20160759)
Really? I evidently know nothing of the matter, but you're saying that the auditors only get involved when they become a larger operation?
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @08:33PM (#20160777)
Yep. Card networks can also unilaterally decide your level.

https://www.pcicomplianceguide.org/faq/#4

Disclaimer: I work in governance/risk/compliance, but have not performed PCI compliance work in the last several years.

[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by gowld on Tuesday June 11, 2019 @08:51PM (#20160837)
PCI DSS assessments are signed by natural persons, not arbitrary HTML content.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @10:12PM (#20161169)
Natural persons who are rarely, if ever, pursued when breaches occur.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by craftyguy on Tuesday June 11, 2019 @08:26PM (#20160749)
Anyone can make a FAQ on the web. Not everyone can prove compliance with PCI DSS.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by chipperyman573 on Tuesday June 11, 2019 @08:43PM (#20160808)
The same could be said about any other online merchant...
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by igetspam on Tuesday June 11, 2019 @11:57PM (#20161660)
It could but they should be able to provide an Attestation of Compliance. If they can't, then you can trust that they're PCI compliant.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by laughinghan on Tuesday June 11, 2019 @09:21PM (#20160958)
I give out my credit card number hundreds of times per year to websites that I have not verified have a merchant agreement with a payment processor to comply with PCI DSS.

In terms of what users are taught (which is plainly the context of the comment you are replying to), this website is identical to ecommerce sites.

[ Parent | on HN ]