Comment by corndoge

3 hours ago

I think the evidence contradicts you at this point

So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)

  • To be fair, for the vast majority of cases, no you don't.

    It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.

    • Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?

      How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?

      Can I store your SSN in plain text in a text file? Why not?

      The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???

      2 replies →

  • To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/*

    (indeed that first wildcard means any account)