All geek questions in one place

What are the security implications of local HTML5 storage for credit card information

Storing credit card information on web servers running my company poses a serious security risk. This is an incentive for penetration. This forces us to closely monitor our database. This is a legal responsibility.

Obviously, this would be really useful only to users who are in one browser from one session to another, so there is a UX hit.

Will a security improvement put this information in HTML5 local storage?

+4
source share
2 answers

PERHAPS

By storing credit card information on a separate computer, you reduce the likelihood that successful hacking of one server (or "system") will lead to the loss of many (hundreds / thousands) of users. An ideal solution would entail a similar (or lower) risk of data storage on the server, but distributes the attack surface and, therefore, significantly reduces the impact.

Here is a brief overview of the proposed approach (which I posed completely as a SO question HERE until poo-poos exists:

  • Retrieve the encryption key from the server via HTTPS.

  • Use it (in javascript) to encrypt credit card data in local storage at the same time that it is entered by the user.

  • Drop the key when the user navigates from the page.

  • If the user returns later, he can retrieve the same key from the server, as well as a new key for caching data in the future (to avoid reusing the same key).

  • The server does not need to save a copy of the credit card data, and the hacker will need to obtain an access level so that they can in any case view the information entered by the user on the page.

+2
source

No.

Because then anyone can come to the computer and get unencrypted credit card information. Local storage is not encrypted on the computer. Keeping it encrypted on a secure server is the best option (even with legal problems).

But the best option is not to store it at all. This reduces legal and financial problems for everyone. If people are upset with their user experience, explain to them not to keep their credit card number to protect them.

+1
source

Source: https://habr.com/ru/post/1489972/

More articles:


All Articles