WebApp Sec: Re: storing SSNs, CCNs, password in the DB

["Andrew van der Stock" <vanderaj () greebo net>]

Francesco said:
> It's for a web-based financial application (users accessing credit-card
> transaction information, signing in with their card number, PIN and last
> 4 of SSN) so we pretty much *have* to have that information in the DB to
> compare at logon.
Unless you're the employer of these people, proving welfare services, or
require the SSN for mandated government reporting you must NOT collect or
use the SSN for authentication purposes as you can't repurpose the
collection from its primary purpose. The SSN is also available in many
semi-public ways, so it's not a good authenticator and is officially
frowned upon.

http://www.ssa.gov/pubs/10064.html

The card number is a poor account identifier as attackers can loop through
your institution's BIN numbers and DoS lockout your application trivially.

The CCV (the three digit validator) is ephemeral data only. You must not
use this in a persistent way unless you are the issuing institution, and
even then you should take appropriate steps to protect the confidentiality
of this data.

Try again. :)

Andrew