通过 PHP 脚本通过电子邮件发送信用卡信息安全吗？
我正在构建一个接受信用卡订单但不以编程方式授权付款的应用程序。相反，管理员必须检查每个订单并将其信息手动输入支付网关以完成付款（他们的决定，而不是我的决定）。我想知道存储（即使是临时的）他们的信息并将其传递给管理员的最佳方式是什么。
可以通过电子邮件发送未加密的此类信息吗？如果我对信息进行加密，通过管理面板向他们提供无风险的最佳方式是什么？
并且请不要告诉我 Google“PCI 合规性”。
I'm building an application that accepts credit card orders, but does not programatically authorize payments. Instead, an administrator MUST review each order and manually type their information into a payment gateway to complete the payment (their decision, not mine). I'm wondering what the best way to store (even if it is temporary) their information and deliver it to the admin.
Is it OK to email this sort of information unencrypted? If I encrypt the information, what is the best way to serve it to them through an admin panel without risk?
And please don't tell me to Google "PCI Compliance".
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
否
如果接收计算机上有病毒怎么办？如果附近有一个数据包嗅探器怎么办（不太可能，但仍然......）。无论如何，您为什么要在电子邮件中发送如此不稳定的信息？难道持卡人不知道自己卡上的号码吗？我想如果您想说“您有[这张]卡”，只需发送号码的最后四位数字，例如“Visa Debitending in 1234”或“Solo，expiring 7/15”。
NO
What if there are viruses on the receiving computer? What if there is a packet sniffer near by (unlikely, but still...). Why would you want to send such volatile information in an email anyway? Wouldn't the card holder know the numbers on their own card? I suppose if you wanted to say "you have [this] card", only send the last four digits of the number, for example "Visa Debit ending in 1234" or "Solo, expiring 7/15".
简而言之：没有什么好的办法。让我们明确一点：
不。好的。方法。没有任何。零。没有。曾经。
Long：你只能在潜在的黑客和这些数据之间设置尽可能多的障碍。
编辑：
事实上，最薄弱的环节是用户的计算机。但当他被指控价值 10,000 美元的可卡因和卡拉什尼科夫冲锋枪时，他会说
Short : No good ways. Let's make it clear:
NO. GOOD. WAYS. NONE. ZERO. NADA. EVER.
Long : You can only place as many hurdles you can between a potential hacker and these datas.
Edit:
In fact the weakest point would be the user's computer. But when he'll be charged for $10,000 of cocaïne and kalashnikov, he'll say
不 - 它不安全。
即使你对电子邮件进行加密，我也不会向你购买任何东西。但话又说回来，即使你只通过 HTTPS 发送数据，我也不太可能从你那里购买东西 - 我只将我的抄送号码提供给我可以合理信任的公司（Google、Worldpay、Paypal、Sagepay、Netbanx.. .)
No - it's not secure.
Even if you encrypt the emails, I wouldn't buy anything from you. But then again, I'm not much more likely to buy stuff from you even if you only ship the data over HTTPS - I only give my cc number to companies I can reasonably trust (Google, Worldpay, Paypal, Sagepay, Netbanx...)