<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p> Well,</p>
<p> Once you get the Expiry Date (which is the most prevalent
data that is not encoded with the CHD)<br>
</p>
<p> CVV is only 3 digits, we saw ppl using parallelizing tactics
to find the correct sequence using acquirers around the world.</p>
<p> With the delays in the reporting pipeline, they have the time
to completely abuse that CHD/Date/CVV before getting caught.</p>
<p>For chipless markets ( You know who you are )<br>
</p>
<p> I'm way more worried about Pinpads carrying Track1+Track2
unencrypted thru Serial, USB, Bluetooth, Wireless custom
connection...</p>
<p> ( I snooped Serial, USB, Bluetooth for a Pinpad PA-DSS
project )<br>
</p>
<p> And with the PA-DSS spec being dropped by 2020 it will become
worst.<br>
</p>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 10/10/18 10:32, Brian Kantor wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20181010143214.GA73218@meow.BKantor.net">
<pre wrap="">On Wed, Oct 10, 2018 at 02:21:40PM +0000, Naslund, Steve wrote:
</pre>
<blockquote type="cite">
<pre wrap="">For example, with tokenization there is no reason at all for any
retailer to be storing your credit card data (card number, CVV, exp
date) at all (let alone unencrypted) but it keeps happening over
and over.
</pre>
</blockquote>
<pre wrap="">
It's been a while since I've had to professionally worry about this,
but as I recall, compliance with PCI [Payment Card Industry] Data
Security Standards prohibit EVER storing the CVV. Companies which
do may find themselves banned from being able to process card
payments if they're found out (which is unlikely).
- Brian
</pre>
</blockquote>
<br>
</body>
</html>