Re: Vuln in Verisign PayFlow Link payment service

> Perhaps a fix for VeriSign would be to passback a secret code
(configurable
> through the PayFlow Link admin panel) that does not originate from a cart
> input value, but is stored and sent from PayFlow. Then a simple 'if'
> statement in the cart software could weed out the bad along with an e-mail
> sent to the admin.

I suggested this very idea to Verisign when I initially contacted them. My
suggestion was to use the account password as the 'secret code' (perhaps
encrypted?), but any shared secret would do as long as it is only passed
directly from verisign back to the shopping cart app.
Received on Jan 04 2002