Me and my brother are starting a local business. The purchases will be made online, and we will send the item.
We have everything worked out, except how to safely receive the customer's credit card number. All we need is for it to get from them to us, and the rest is taken care of. However, if even one credit card number is stolen, we are truly screwed.
The safest option, of course, would for them to phone in the credit card number. However, we will not always be around to answer the phone.
So, I'm asking a good programmer or something similar this:
What you advise?
How much would a script cost to SECURELY store or send us the information? I wish I could just have the info emailed to me, but that's just so **** insecure. I'd like it to be in MySQL...as I have had a lot of experience with PHP, and that's what the website will be made it.
PS: I will be using 256bit SSL. Also, whats a good web host for small business?
Double PS: Is this the wrong forum?
Last edited by Arkanos; 03-29-2008 at 06:59 PM.
As long as you know how the data will be encrypted, you could have the ENCRYPTED credit card info emailed to you, but having an admin form that you view with order information would probably be better. Another option is to host the site on your own server, then you can directly access the information with another program without worrying about a second transmission.
Using cryptographical symmetric computer software algorithms (a stream or block cryptographical cipher algorithm) is not a bad idea, although there are some linear and differential cryptanalysis (more specific partial differential, integral and truncated differential cryptanalysis) for block cryptographical cipher algorithms and so on. There is however no need for distrust.
The solutions are more or less as simple as Winged Panther mentioned.
Like an angel without a sense of mercy.
1and1.com is a good stable host, the #1 largest host in the world (they own yahoo's datacenters) and provide all the tools you need to register your ssl certificates and various other security features.
For a beginner, its a good starting point.
They also offer more advanced root controlled packages for the more advanced users.
You should just conduct transactions through PayPal, that's what I do. Customers can send you credit card payments through that and they will be completely secure; you have no worries about the numbers getting stolen. Also, an SSL certificate is good to have.
DevilsCharm is exactly right. Do not store credit card numbers unless you absolutely must. There are legal and contractual issues. Most web sites simply pass the data to their payment processor and do not store it. You can store things like the billing address, but the CC#, CVV, expiration, etc. are simply passed along through the payment processor's API with SSL.
There are currently 1 users browsing this thread. (0 members and 1 guests)
Bookmarks