DotNetInvoice Forums

Your product looks like just what I need, but I had some questions regarding the security:

Are you storing the full credit card information for each customer in the database? If so, is it encrypted?

 What steps have you take to make sure that the application is as secure as possible?

 My primary concern is that if someone hacks into my database server, they will have access to all my client's credit cards thus putting me in a world of hurt...

Thanks!
 

Hi Mike,

In order to run recurring charges we store the client's full encrypted credit card number. The number is encrypted using the .NET Framework's built in encryption classes, and uses the TripleDES algorithm. Here's a snippet on this algorithm from Wikipedia:

"As of 2005, the best attack known on 3-key TDES requires around 232 known plaintexts, 2113 steps, 290 single DES encryptions, and 288 memory. This is not currently practical..."

In other words, it's quite safe.

In addition, per VISA standards we never store the customer's CVV code. We also validate all input for SQL Injection attacks and js injection attacks, and encrypt client passwords using the Microsoft ASP.NET Membership Provider's built-in facility.

Let me know if you have any other questions,