Re:A software change allowed FTX to use client money
by IWillForgetThis on Wednesday December 14, 2022 @08:35AM
(#33983251)
My first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and probably shouldn't have been working on it.
Re:A software change allowed FTX to use client money
by iamben on Wednesday December 14, 2022 @09:24AM
(#33983846)
Yeah, I worked for an agency around the same sort of time and saw exactly the same kind of thing.
I remember one site that saved all the CC and order details to a plain text file in the web root. This was opened using an FTP programme every evening and someone would run the numbers through the machine in their store and post out the orders...
Re:A software change allowed FTX to use client money
by verst on Wednesday December 14, 2022 @09:41AM
(#33984067)
This surprisingly sounds very much like the actual ACH system still in use today in the US (from my limited understanding)
Re:A software change allowed FTX to use client money
by michaelbuckbee on Wednesday December 14, 2022 @08:55AM
(#33983477)
If it's any consolation, the entire industry was in that state: poor controls, poor encryption, and security, etc.
Re:A software change allowed FTX to use client money
by a2tech on Wednesday December 14, 2022 @09:59AM
(#33984288)
"was"? It still seems like a confused mess with lots and log 'security' that people ignore
Re:A software change allowed FTX to use client money
by michaelbuckbee on Wednesday December 14, 2022 @10:14AM
(#33984537)
Sure, there's always room for improvement, but at the very least SSL/TLS is ubiquitous now, there actual TLS versions are much better, developers generally view holding onto CC data directly as toxic (the growth of things like Stripe checkout, etc.)
Re:A software change allowed FTX to use client money
by arealaccount on Wednesday December 14, 2022 @08:52AM
(#33983448)
Do you mean not a conversation in the sense that we wouldn’t think of doing it, or in the sense that we wouldn’t think of questioning it?
Re:A software change allowed FTX to use client money
by TrickardRixx on Wednesday December 14, 2022 @09:33AM
(#33983966)
We wouldn't think of doing it. This is the kind of thing your auditors would see from outer space. If you're doing this and you don't have auditors, you're lying on your self-assessment questionnaire. Either way your merchant status is in jeopardy.
Not quite the same level, but in my early days working on a payment system, a request from the product team was to create a summary screen where customer service reps could see payment histories AND THE CC INFORMATION USED FOR THE PAYMENTS. In my mind, there was no way that would end well, so I strenuously objected and had to endure some very heated conversations over the course of a month or two. Eventually product team agreed to last 4 digits + expiration.
Nowadays it wouldn't even be a conversation, but in the early 2000's, it was a different world.