Security horror stories in payments
summary
Banks and payment gateways routinely ship broken crypto: examples include AES with fixed IV and word‑by‑word encryption that lets attackers mix ciphertext fragments, signature schemes that implement HMAC using request ID (so keys travel in the message), and mobile code that stores CVV encrypted then decryptable and reuses it in payments. PCI‑DSS gaps and reliance on home‑rolled protocols appear repeatedly. Recommendations are concrete: use TLS, bcrypt, vetted libraries (NaCl / NL and Google keysar), audit for PCI where applicable, and eliminate recoverable CVV storage.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:03Payment gateway interactions
- 1:24Useless security example
- 3:36Never implement own crypto
- 4:40Broken confidentiality in encryption
- 8:54Message integrity failure with HMAC
- 12:30Should have gotten it reviewed
- 14:19PCI DSS violations with CVV
- 18:51Key learnings
- 21:00Q&A
related talks
47mBreakout Session
47mCommon security pitfalls in payment apps
28mKeeping the Bank Happy: PCI DSS v4
44mCryptography Pitfalls
59mHow Smartcard Payment Systems Fail
32mE-Banking Transaction Authorization - Common Vulnerabilities, ...
47mKey Trends in the Shifting Threats to Payments as Blended Commerce Returns
54mBroken Crypto is Broken