From: Joe Van Dyk <joevandyk@...>
Date: 2007-07-31T19:55:16+09:00
Subject: Re: encryption (of credit cards)

On Jul 31, 2:32 am, Joe Van Dyk <joevan...@gmail.com> wrote:
> http://monkeycharger.googlecode.com/svn/trunk/app/models/credit_card.rb
>
> Ignore the fact that it's a ActiveRecord model and tell me if the
> encryption that I'm using for encrypting the credit card numbers is
> reasonable.  Did I screw anything up?
>
> What would you change?  I imagine I could generalize out the
> encryption bits, right?

One alternative I came up with is to use some combination of a unique
user id, the credit card's cvv, and a secret key on the server for
encrypting the credit card number.  So, whenever you wanted to
authorize a card, you had to provide the unique user id and the CVV
for the card.  I figure that would make a bit safer.