PCI, verified..hacker safe?

[ryanb4614]

Okay Let me explain what I have here first, Blue Host-Zen-Cart, bluehost offeres "hacker safe" ScanAlert is a full service PCI compliance program - from the world's largest web site security certification company.... I signed up for it but I dont get the "hacker safe certificate" with the subscription paid by bluehost... Through zen-cart I have linkpoint... The McAfee "hacker safe" said i need this pci in order to process credit cards on my website? And if i wanted to upgrade it would only cost $950 a year! So anyways, The reason I am looking into this I had a comply comments for my page that, how do i know its safe, etc stuff like that, I was looking into get the "Hacker Safe" Certificate or the "Verified Certificate" on my website, anyone have experience with these? Does link point offer any certificate i can post... Thanks Just starting out the store, okay with design but this stuff no so good with. Thanks!

[kobra]

PCI is a controversial subject for online shops operators.

IMO: The only requirement stated for the transmission of CC information is that this ONLY be done using SSL(Secure Sockets Layer) encryption.

Different rules if you STORE any data.

This is IMO, a demon created to scare small shop owners into thinking that they must have ALL SAFEGUARDS in place as though they were storing this data like a large company might.

That aside, You can state in your own text that your site is safe and transaction data is secure with "enter your SSL Cert provider text" or you can use the expensive services that are available and display their assurance items.

Choice is yours

[toritaiyo]

This is IMO, a demon created to scare small shop owners into thinking that they must have ALL SAFEGUARDS in place as though they were storing this data like a large company might.

stupid scare-marketing!

unfortunately they (hacker-safe, etc.) have a little network-effect going for them. The more sites they get "hacker-safe" on the more the sites without hacker safe look bad.

Newbie question -
I only offer paypal as a payment option. So as far as credit cards data goes its all processed off my site. So SSL is not necessary, right?

[kobra]

I only offer paypal as a payment option. So as far as credit cards data goes its all processed off my site. So SSL is not necessary, right?

Don't know what you sell - but you are correct if using only IPN -

SSL does provide a bit secure feeling to many shoppers and as cheap as it is if you lose say one sale per month or a potential customer that never returns for that reason only what have you saved??

It does indicate l - like at login - that you/your company takes measures to protect their privacy...

[xt0rt]

This is why I like Comodo SSL certificates so much, the cert image is displayed in the lower right of every page on the site, scrolling along with the window. The customer sees the image every time. And, unlike the "hacker-safe" programs (which are highly scrutinized by the security community), SSL actually works.

On another note, it is not hard to do a little delving into security exploits to run against your own site. That is really all these hacker-safe programs do anyway. Many scripts exist for this - anybody with some experience in Linux/*BSD or related OS's can do it.

[toritaiyo]

good points, thanks!

@xt0rt,
I like your signature