[FX.php List] Secure Credit Card forms/procedures

[Leo R. Lundgren]

15 sep 2010 kl. 19.55 skrev Jonathan Schwartz:

> Passwords:
> 	- Require original password to change to new password, or not?

For the change password function inside the profile settings/my account part of a site, I would require the old password in order to set a new one (using two fields for the new password, of which one is a spelling verification).

The reason is that without this, an attacker could within half a minute change the password of a logged in user that forgot to lock the screen or similar, while going to the bathroom or such.

> 	- Display password on screen during entry or use bullets?

Bullets. The only reason I can think of not to show bullets is to aid the user, but that's not acceptible :D Being able to type ones password in a textfield without having to see each letter is fundamental to being able to use a computer. There has to be some reasonable limit to this.

> Credit Cards
> 	- Display CC# during entry or use bullets, or one of those bullets+last digit entered routines.

For upon-payment forms, I'd probably show the digits of the CC number, because they're aren't that easy to remember, most people probably don't? Maybe you could do bullets in the final three digits (the verification code), could be a nice compromise.

Where the CC is to be stored and edited, I'd probably display both numbers entirely because it's a hassle if they store wrong values and have to go back to fix it when they try to use their CC.

In the end it all depends on requirements though. This is just what I default to when there are none.

> 	- Which fields to re-display for editing, versus forcing re-entry

Not sure what you mean :o

> These can be argued either way in a security versus ease of use discussion.
> What resources do you use for design standards and to be able to demonstrate that the design *is" secure.
> Ultimately, I would like to adopt the right level of security...and then be able to back it up if/when challenged.

I don't have an answer for that. I guess research if a specific issue comes up. Back it up with some reasonable documentation.

I guess that in general, if a client "challenges" you with a question, you dig up information on the subject and either tell them how things really are to be done, or make changes to accomodate the requirements for a secure operation.

-|