Forgot your password?
typodupeerror
Android Google Security Social Networks Technology

Google Wallet Stores Card Data In Plain Text 213

Posted by samzenpus
from the read-it-and-weep dept.
nut writes "The much-hyped payment application from Google on Android has been examined by viaForensics and appears to store some cardholder data in plaintext. Google wallet is the first real payment system to use NFC on Android. Version 2 of the PCI DSS (the current standard) mandates the encryption of transmitted cardholder data encourages strong encryption for its storage. viaForensics suggest that the data stored in plain text might be sufficient to allow social engineering to obtain a credit card number."
This discussion has been archived. No new comments can be posted.

Google Wallet Stores Card Data In Plain Text

Comments Filter:
  • by bobwrit (1232148) on Friday December 16, 2011 @02:40AM (#38394560) Homepage Journal
    At least it's not storing, oh say, your login details in plain text... which certain(*cough* Sony) companies do. The details that it stores aren't anything that can be actually used to formally break into an account(yeah, sure, it can be used for stalking purposes/phishing, but that's almost always a vulnerability).
    • by Fritzed (634646) <Fritzed@@@gmail...com> on Friday December 16, 2011 @04:47AM (#38395108) Homepage
      One important difference is that in the credit card industry there are published rules that you must comply with called the Payment Card Industry Data Security Standard (PCI-DSS), or in the case of an application, Payment Application Data Security Standard (PA-DSS). If TFA is accurate, then Google Wallet is not following the PCI guidelines.

      However, it is worth noting that even if they ignore all of the best practices, they are probably technically in the clear right now. Mobile Applications are currently exempted from PCI and PA enforcement pending an update to the rules. As they are currently written, they acknowledge that they were not designed with mobile devices in mind. Mobile payment application developers are encouraged to follow the general guidelines of PCI, but they are somewhat left to their best judgement.
      • by Anonymous Coward on Friday December 16, 2011 @09:45AM (#38396568)

        Actually even if PCI does apply to the mobile app, based on the article the storage does meet the PCI storage guidelines, which are not as stringent as you might imagine. PCI actually does not require encryption of the credit card number as long as it is truncated to the last 4 digits. And cardholder name and expiration date may be plain text. This is explained on p. 8 of the PCI-DSS v2.0 spec, and in Requirement 3.4.

        That said, the plain-text storage is incredibly stupid, and any payment apps on a phone should go above and beyond PCI requirements. And apart from the storage, the rest of the data path needs to be examined to look for other unencrypted links.

    • by unapersson (38207) on Friday December 16, 2011 @05:40AM (#38395316) Homepage

      The passwords were *cough* hashed. I suppose that's a kind of plain text.

    • by abigsmurf (919188)
      Except Sony hashed the passwords, encrypted the CC info and didn't store the security codes.

      How long has it been and people are still spreading the "ZOMG PASSWORDS IN PLAIN TEXT!!" rubbish?
    • by History's Coming To (1059484) on Friday December 16, 2011 @09:14AM (#38396362) Journal
      My bank stores my password in plain text. It's clearly not even hashed as they only need (eg) the third and fifth characters to give me access. I queried this with them and the person couldn't understand what I meant, and I wasn't allowed to talk to anyone who might understand for "security reasons". Interesting policy.
      • Banks are kind of different because you need to be able to access your account over the phone. However, in my country we have always used account number + one-time PIN numbers to access accounts ever since Internet banking was introduced. For confirming transactions there is also second, reusable PIN number list. And both of these lists are changed and resent to you after you've used all the one-time PIN numbers.
      • My bank stores my password in plain text. It's clearly not even hashed as they only need (eg) the third and fifth characters to give me access.

        no they do encrypt it but they encrypt each letter seperately!

  • NFC (Score:5, Funny)

    by ferrisoxide.com (1935296) on Friday December 16, 2011 @02:41AM (#38394562) Homepage
    No Fucking Clue?
    • Nearfeild communication 1-4 cm transmission devices. Like pay pass.

  • Stupid headline (Score:5, Insightful)

    by Ultra64 (318705) on Friday December 16, 2011 @02:43AM (#38394568)

    "Stores Card Data In Plain Text"

    isn't quite the same thing as

    "suggest that the data stored in plain text might be sufficient to allow social engineering to obtain a credit card number"

    • Re: (Score:2, Informative)

      by Anonymous Coward

      RTFL: "The much-hyped payment application from Google on Android has been examined by viaForensics and appears to store some cardholder data in plaintext."

    • Re:Stupid headline (Score:5, Informative)

      by Anonymous Coward on Friday December 16, 2011 @03:01AM (#38394658)

      Neither statement is completely clear, but as I see it Google Wallet is storing (some) data about the card in plain text, which may be enough for anyone that discovers it to obtain further details about that person and their card from the financial institution via social engineering.

      To me this means if you lose your phone, it may have enough information on it to enable the finder to then get your credit card details through social engineering.

      • by AmiMoJo (196126)

        That's why it is important to report it lost as soon as possible.

        Lost credit card statements are worse as if intercepted in the post because you won't even realise it until it has been missing for a few days.

      • Re:Stupid headline (Score:4, Insightful)

        by neokushan (932374) on Friday December 16, 2011 @05:39AM (#38395314)

        I'm curious as to what social engineering technique could be used to find a card number? I have never seen a website that will reveal credit card info as anything other than **** **** **** 1234, nor have I ever heard of a bank that will give out your number over the phone. The only thing they ever do is post you out a new card and disable the current one.

        Seriously, phone up your bank and say "Hey it's Mr Smith here, I left home without my card today and I absolutely must buy this cute thingymabob on the internet, I know the last 4 digits are 1234 but that's it - could you help a brother out?" and see what happens. Then there's the CVN which shouldn't be stored in ANY payment system - except maybe the card authenticator themselves (i.e. Visa/Mastercard).

        • Re:Stupid headline (Score:5, Insightful)

          by WrongSizeGlass (838941) on Friday December 16, 2011 @08:54AM (#38396236)

          I'm curious as to what social engineering technique could be used to find a card number?

          The target is not the bank or credit card company - it is the owner of the phone ... and remember, it doesn't have to work often (or on /.ers):
          - Someone with malicious intent gets your Google Wallet info from your phone (either via malware or acquiring your phone).
          - They contact the owner of the phone claiming to be from one of the stores that is listed in the plain text Google Wallet transaction history.
          - They tell the owner of the phone that their records show that your Google Wallet was charged <insert excessive amount here by moving the decimal two places to the right> and surely that amount is not correct.
          - They blame the error on the new payment technology (e.g., "they still haven't worked all the bugs out", etc).
          - The remind the owner of the phone to pay close attention to their next statement just in case this happened with any other retailer.
          - They tell the owner of the phone that they need the CC# and CCV to issue the credit because "they don't store that information for security reasons".
          - If they've played their role correctly the owner of the phone may provide the requested information.

          • by Bill Dimm (463823)

            You could play out that entire scenario without the Google Wallet info. Look up the phone number from some random person in the phone book, call them, and say "Good morning Mr. Smith, I'm with your bank's fraud unit, and we saw a large transaction on your Mastercard and wanted to verify that it is legitimate..." Sure, it might be a little more convincing if you knew the last 4 digits of the card and info about an actual transaction, but that just bumps up your probability of success a bit.

            • by Pieroxy (222434)

              Pretending to be the bank out of the blue is going to raise more eyebrows than pretending to be the store the dude went to the day before, especially when the caller can substantiate his claim by citing what the user bought there.

          • by PGGreens (1699764)
            I tried contacting them a bunch of times, but they never answer their phone...
          • "I"m at work right now, and my credit card is at home, can I get your phone number so that I can call you back with that information once I get it? Thanks."

        • Re: (Score:3, Insightful)

          by um... Lucas (13147)

          Phone call:

          " hi this is the chase anti fraud department. We've noticed some suspicious activity on your account. Can you verify if you initiated the following charges? Oh you did that's great. I just need to verify if you're in possession of your card right now. Can you please read the 16 digits off the front of it for me?"

          I wouldn't fall for it. You and most slashdotters probably wouldn't either. But rest assured there are still millions who would. Those same people who go clicking every link they find in

          • by Ultra64 (318705)

            > It's safe because only someone with root access can access it.

            Just like anyone with your wallet can access all of your credit cards.

      • Re:Stupid headline (Score:5, Insightful)

        by Splab (574204) on Friday December 16, 2011 @07:42AM (#38395844)

        If I have your mobile phone with access why would I bother trying to get to your creditcard when I can get pretty much anything I want - it has access to E-mail, SMS, friends and family.

        I could just try and grab all your passwords, getting to your online email client before you do I can probably change settings enough for you to be unable to quickly recover anything. From that point I can start initiating scam mails at your friends and family.

        Having a credit card number is only useful for a limited time; having access to all your personal data will enable an attacker to keep stealing.

      • by MrMickS (568778)

        Its actually a bit worse than this. It gives a bonafide target for a trojan.

      • by Idbar (1034346)
        Isn't this, the same that happens if you lose your wallet? I guess that's part of the reason is called "wallet". It acts like one. The question is if there's enough information available to those just "looking"
    • Re:Stupid headline (Score:5, Informative)

      by stephanruby (542433) on Friday December 16, 2011 @03:17AM (#38394722)

      Also it cites the PCI standard, but that applies only to a full credit card number that has been transmitted already.

      In this case, it only keeps the 4 digits of the card number and the expiration date in plain text on your own phone. It's not bad compared to a regular wallet that will keep the full credit card number, the expiration date, the full name, and the verification code as well, all written in plain text on some flat piece of plastic.

      • Re:Stupid headline (Score:4, Insightful)

        by Nick Ives (317) on Friday December 16, 2011 @03:45AM (#38394844)

        Oh, so this is on a users phone? (Yea I didn't read FTA).

        If so, this is right up there with the previous scandal about Android keeping passwords in plaintext. In that case you had to be root to gain access them, meaning whether or not they were stored as plaintext would be a moot point. If you're root, then surely you can do anything including invoke any methods used for decryption. Same goes for this.

        • This 'social engineering' attack requires root on the user's phone as well by the way. A lot of effort just to get someone's credit card number.

        • by swillden (191260)

          Oh, so this is on a users phone? (Yea I didn't read FTA).

          If so, this is right up there with the previous scandal about Android keeping passwords in plaintext. In that case you had to be root to gain access them, meaning whether or not they were stored as plaintext would be a moot point. If you're root, then surely you can do anything including invoke any methods used for decryption. Same goes for this.

          Root access is also required for this attack. Without root, a person with your phone can't get the unencrypted data. Rooting the phone via normal means (i.e. not exploiting some other security defect) will wipe the data.

        • by Sloppy (14984)

          If you're root, then surely you can do anything including invoke any methods used for decryption

          On your laptop, if someone steals it while it's turned off, they can do anything they want, including becoming root, and they still don't get to read any of the files in your home directory without the [LUKS|truecrypt|whatever_you're_using] decryption key. Having both root and physical access isn't enough unless they manage to get the system while it's already up.

          "Invoking the methods used for decryption" is poi

      • by Nimey (114278)

        Oh, so this is another "google is evil!" non-story that the editors didn't bother to fact-check, but is good for driving page hits.

        This never happened before Taco left.

    • The following is the data listed by the article as being stored in plain text:

      [data] such as a cardholder's name, transaction dates, email address, and account balance

      Maybe enough for social engineering, probably not.

    • I'm confused because you don't explain why "Stores Card Data In Plain Text" is a stupid headline. The statement you apparently cited as evidence restates that the data is stored in plain text and therefore may be vulnerable to social engineering attacks. Are you suggesting the headline is somehow contradictory to that? I mean, they both say that the data is stored in plain text, so what exactly is stupid about the headline?

  • by Todamont (1034534) on Friday December 16, 2011 @02:45AM (#38394582) Journal
    Bitcoin uses encrypted wallets which are not linked to your name or address. It is the strongest computer in the world and it supports p2p DNS through namecoin. It is much more secure than online banking with ACH, and much harder to usurp than centralized BIND servers. Plus they won't print 1,000,000,000,000 of them this year.
  • No kidding. (Score:5, Insightful)

    by SeaFox (739806) on Friday December 16, 2011 @02:46AM (#38394592)

    viaForensics suggest that the data stored in plain text might be sufficient to allow social engineering to obtain a credit card number.

    Correct me if I'm wrong, but isn't social engineering the art of tricking people into giving information or access they wouldn't normally? If the security is breached through human gullibility I don't see what method of storing the data is going to protect against that, unless it's storing it where nobody but PCs have access to it and no humans have access to said PC's.

    I can socially engineer the card holder to give me their card info and you can't encrypt against that.

    • Re:No kidding. (Score:4, Insightful)

      by geminidomino (614729) on Friday December 16, 2011 @02:49AM (#38394602) Journal

      I think the point being that if you can trick someone into giving you a file that they don't know contains their credit card number in plain text, unlike giving you the card number directly, they don't even know what you have.

      • Except that the plain-text file contains only the last 4 digits of the CC info, fully missing the other 12 digits. Hell, almost every bill auto-pay system I use regularly sends me an email containing my CC's last 4-digits. But otherwise, yeah, exactly like you describe.

        Here's one of my CC numbers: xxxx-xxxx-xxxx-2932. Have fun with it.

    • Re:No kidding. (Score:5, Insightful)

      by caladine (1290184) on Friday December 16, 2011 @02:51AM (#38394614)
      I think the point was that it makes it easier to pull off the "social engineering" if you have access to information only privileged parties should have. They should still be encrypting the locally stored data, and it's just lazy not to.
      • by swillden (191260)

        I think the point was that it makes it easier to pull off the "social engineering" if you have access to information only privileged parties should have. They should still be encrypting the locally stored data, and it's just lazy not to.

        Encrypt it with what key?

        This attack already requires a rooted phone. If the attacker has your phone, and has rooted it, then he has access to any key stored on the phone.

        The key could be derived from your PIN, but that's four digits. How long does it take to brute force search 10^4 possibilities? Milliseconds. This would be a ciphertext-only attack, so the the attacker would need to be able to recognize the correct plaintext. If all of the potentially-sensitive data were encrypted, picking the cor

        • Yes, that's it. I don't understand why would you want to encrypt anything unless you have passphrase support for it, or some other form of secret that makes the encryption do something. If you don't protect the key with a secret, the encryption is no longer an encryption.

          Unless you have your phone ask you for a very long passphrase, any encryption is pointless. So you have only three options:
          1) Use an encrypted key chain or better full disk encryption with a really long passphrase which is incredibly inconv

        • by gnapster (1401889)

          (Disclaimer: I work for Google, and part of my work is related to Wallet, but I have carefully restricted my comments to exactly what I would have said based on the knowledge I had before joining Google.)

          Partitioning your knowledge like this is an interesting and valuable skill. Did they teach you this before or after teaching you the secret of levitation?

          • by swillden (191260)

            (Disclaimer: I work for Google, and part of my work is related to Wallet, but I have carefully restricted my comments to exactly what I would have said based on the knowledge I had before joining Google.)

            Partitioning your knowledge like this is an interesting and valuable skill. Did they teach you this before or after teaching you the secret of levitation?

            It's not that hard. I just thought about what I would have said if presented with this same story a year ago. Since I was actively thinking and discussing such things at that time, it wasn't difficult.

    • Re:No kidding. (Score:5, Insightful)

      by Jah-Wren Ryel (80510) on Friday December 16, 2011 @02:54AM (#38394630)

      You are only seeing the little picture. The idea is that if someone can get ahold of this data (like say they snatch your phone) then they can use that data to trick you into believing that they are someone trustworthy, like a rep at your bank.

      For example, they get your payment transaction history and then they call you up - tell you your transaction history as a means of authenticating themselves as someone who works for your bank and then get you to disclose your online banking username and password, at which point they empty your entire savings account.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Wouldn't you be kind of suspicious if your phone gets snatched and suddenly someone calls you up about your Google Wallet account?

        Credit card transaction data is not that hard to get by just going through someone's trash too. This isn't really a new problem.

      • by SeaFox (739806)

        You shouldn't trust they are who they say they are if they call you anyway. Lots of people throw out old bank statements without shredding them, and even if they did with their bank statements collecting enough random receipts all paid with the same debit card would give you enough transactions for a time period to make you sounds official. You should request to call the bank back about the matter and then dial them yourself -- from a known general customer service number for the institution, not a direct n

        • You would think businesses would encourage this. Here in Canada, we have a phone company, Bell Canada, which states on their web site that reputable businesses won't call you and ask for credit card information. Yet, one time I forgot to pay my bill and they called up and asked for my credit card information over the phone. It sounded very legitimate. I asked to talk to the manager and they directed me towards another person who apparently didn't see anything wrong with the practice.

          It is businesses lik

      • Indeed, but if someone steals your phone and it isn't protected they probably have a lot more information than what is being described here. The information stored is about the same as you might find on an ATM receipt with the addition of the expiration date. All of which I can probably get from your e-mail/facebook/sms/etc

  • by Anonymous Coward on Friday December 16, 2011 @02:52AM (#38394618)

    It stores the last 4 digits of the credit card, so you know which card was used in your google wallet. My telephone company does this, as does paypal if I remember correctly. Whilst it may not be stored easily in plain view of anyone, I think someone breaking into either of those accounts would be more likely than someone first stealing my phone, rooting it then access the sqlite DB.

    To be honest, I am more afraid of my local 7/11 employee who swipes my credit card every day in plain view when I buy milk, newspaper and mamma noodles. I think even some POS systems display the card number on their terminal screen!

    These days, I think most credit cards have secondary verification systems in place so even if someone did get my card number, it would be very difficult to use. I already have a hard enough time booking airline tickets online and trying to remember what my Verified by Visa password is. Stupid story and I read somewhere that even some stupid phone provider in the US (Verizon maybe?) has delayed the sale of the Nexus because of this.

    • by X0563511 (793323)

      You are not required to hide the first 6 digits or the last 4. That part of the card is not "sensitive"

    • by swillden (191260)

      Stupid story and I read somewhere that even some stupid phone provider in the US (Verizon maybe?) has delayed the sale of the Nexus because of this.

      I think what you're referring to is that Verizon has refused to allow Google Wallet on the new Galaxy Nexus, and has used this as part of their justification. However, it seems more likely that their real concern with Google Wallet is that they're part of a consortium (ISIS) which is developing a competitor to Google Wallet. Verizon wants to be able to rent space on the secure elements in the phones on their network. They figure credit card issuers and others will pay for the right to get their stuff ins

  • by asdbffg (1902686) on Friday December 16, 2011 @02:53AM (#38394620)

    Caller: Hi, I'm calling from... er... Google... and it says here in this text file that you have a credit card number on file with us. Is that right?

    Victim: Yes, that's right.

    Caller: Cool. Would you mind giving me that account number so I can verify your identity?

    Victim: Let me get my card...

    • Victim: Funny, this guy with a Nigerian accent called me yesterday and said the same exact thing! Well, here you go... *reads number loudly into cellphone in a public area*
    • by hawguy (1600213) on Friday December 16, 2011 @03:43AM (#38394828)

      I think it goes more like this:

      Caller: Hi, this is Judy from Visa. We have reason to believe that your credit card number has been stolen, do you have the card in your possession now?

      Victim: Yes

      Caller: Can you verify that the last 4 digits are 1234?

      Victim: Yes, that's my card

      Caller: Can you verify the answer to your security question?

      Victim: My mother's maiden name is "Cartwright"

      Caller: yes, that is correct, thank you for verifying your identify. Our system has detected $17,372 of fraudulent charges on your card. but don't worry Mr Smith, we can immediately block the card and reverse the charges. We'll just need to you read the full 16 digit card number and security code so we can get started.

      Many people will fall for the scam - the caller obviously knows the last 4 digits of their card number and their security question. (which, of course they don't, but it sounds like they do), so they must be legit.

      • by tagno25 (1518033)

        Last 4 digits and issuer are printed on most receipts. Sometimes even the name and expiration date are printed.

      • by L4t3r4lu5 (1216702) on Friday December 16, 2011 @08:31AM (#38396096)
        I don't answer the questions. I say "I'll save us both some time. If this is a sales call, I'm not interested, and you should remove my details from your marketing list. If there is an issue with my accounts, I'll call the number on my bank statement, because frankly I don't trust cold callers. Which is it?"

        They seem quite accommodating. They've done their job by contacting me, and I avoid all social engineering attacks.
        • by Tim C (15259)
          I applied for and received a new credit card with a provider here in the UK a couple of years ago (name omitted). A few days later someone phoned me, claiming to be from them, wanting to discuss something about my card - but first I needed to answer a couple of security questions to confirm my identity.

          I challenged him to confirm his identity; all he did was reaffirm his claim to be calling from my card provider but without offering any proof beyond that. I refused to proceed, pointing out that I had no
  • by hawguy (1600213) on Friday December 16, 2011 @02:57AM (#38394646)

    From TFA:

    While Google Wallet hides the full credit-card account number, the last four digits reside in plain text in the app's local SQLite database.

    The same last 4 digits that are printed on your credit card receipts and show up as plain text on many web sites that store credit cards.

    Doesn't seem like a big deal - people should know better than to give their card number to someone that has the last 4 digits of their card number since they could have gotten them anywhere. (or just guessed - send a spam email to 10 million people with a randomly generated 4 digit number, and you'll have guessed right for 1000 of those people.)

  • And so? (Score:5, Insightful)

    by Cyberax (705495) on Friday December 16, 2011 @02:58AM (#38394648)

    And so what? Your phone must be able to decode the stored data, so it must somehow acquire decryption key.

    That means that this decryption key must be transmitted over the network or stored on the device itself. And if it's stored on the device, then the whole encryption scheme is nothing more than complex obfuscation.

    • Well, they could possibly encrypt it with your PIN, no? Although since AFAIK most people use 4 digit PINs, it'd take about a second to decrypt it.

  • iaForensics suggest that the data stored in plain text might be sufficient to allow social engineering to obtain a credit card number.

    This is very, very vague.. Something as simple as a email address could be used for this purpose.

  • It's not plain data!

    It's rot32 encrypted.

    *twice*.

    'Cause it's the only way to be sure...

    • Re: (Score:2, Funny)

      by Frankie70 (803801)

      It's not plain data!

      It's rot32 encrypted.

      rot32 was broken 6 months back. I have moved to rot128 since then. It is 4 times stronger - sure it takes a little more power, but I can sleep well at night now.

  • by Anonymous Coward on Friday December 16, 2011 @04:17AM (#38394966)

    to even follow the link and lookup the summary..... here it is:
    - A fair amount of data is stored in various SQLite databases including credit card balance, limits, expiration date, name on card, transaction dates and locations and more.
    - The name on the card, the expiration date, last 4 card digits and email account are all recoverable
    - [Fixed in Version 1.1-R41v8] When transactions are deleted or Google Wallet is reset, the data is still recoverable.
    - The Google Analytic tracking provides insights into the Google Wallet activity. While I know Google tracks what I do, it’s a little frustrating to find it scattered everywhere and perhaps in a way that can be intercepted on the wire (non-SSL GET request) or on the phone (logs, databases, etc.)
    - [Fixed in Version 1.0-R33v6] The application created a recoverable image of my credit card which gave away a little more info than needed (name, expiration date and last 4 digits). While this is not enough to use a card, it’s likely enough to launch a social engineering attack.

    So it is as safe as anything else you use to pay stuff!
    Shit... it is easier to just swipe someone's credit card bill! ^^

  • FTFA: "While Google Wallet hides the full credit-card account number, the last four digits reside in plain text in the app's local SQLite database."

    Sheesh, big deal about nothing. You know how many gasoline sales receipts end up in the garbage can next to the automated upmp.

  • by HaeMaker (221642) on Friday December 16, 2011 @06:13AM (#38395464) Homepage

    My credit card.

    I'm going to steal someone's phone to get their credit card number? Why not take their wallet?

    • by Bill Dimm (463823)

      I would assume the concern is more with malware harvesting the info from thousands of phones via some security hole, rather than someone stealing phones one at a time.

    • by esocid (946821)

      The good news is that viaForensics confirmed that the app does repel man-in-the-middle attacks, and is protected by a PIN to conduct transactions with the cards.

      Isn't that the important part? If someone steals my phone (which is encrypted btw - galaxy nexus ftw) they're going to have an easier time just grabbing my wallet to make fraudulent charges.

  • by JohnnyMindcrime (2487092) on Friday December 16, 2011 @07:15AM (#38395710)

    ...I do work in security for a telecoms product manufacturer and maintainer and there are a HUGE number of companies out there that store credit card data in plain text.

    However, you cannot just look at that one particular issue to make a determination as to whether or not the data is secure - it's also about how the system on which that data is stored is isolated from the real world, what firewalling and access controls are in place to restrict who can get to that data, whether or not they update the systems regularly, etc. etc.

    This is NOT a security exploit, there's no report of any security hole that makes that data available to the rest of the world, unlike what happened to Sony - so some prespective needs to be put on this.

    Any wise company conducts regular Risk Assessments on their infrastructure to determine what potential security risks exists, how big those risks are and how much it will cost to fix it. In this particular case, it might be that using encrypted credit card information might entail having to upgrade very expensive applications to a later version, all of which will factor into the cost of fixing the issue. If Google has determined that the risk of an outside party getting to that data is extremely low, then they may not consider it worth the expense of the upgrade.

    Every company will do this, even Apple and Microsoft, and many of them do choose to adopt PCI (Payment Card Industry) guidelines on storing this kind of data correctly.

    It could be argued that someone stealing a file of encrypted credit card data from a company is a much bigger issue than someone (so far) not being able to steal unencrypted data from a company - so it's always wise to put some perspective around these kinds of statements.

  • by Kartu (1490911)

    The last 4 digits of your credit card number, that are often printed on your receipts as "plain text" are also stored as plain text by Google Wallet.
    So?

  • If they have your phone and have gained enough access to gather this information, why don't they just use your phone to empty your accounts? Why bother going through all the trouble to snarf data and social engineer the owner? The article should be more clear on if an installed application other than Google Wallet can access the Sqlite3 file. If that is the case, encrypted or not, it is broken. If that is not the case then they didn't find anything very useful. Who, that is capable of rooting a phone a

  • AFAIK Google is only 1 notch more trustworthy than Facebook. I can't see anyone in their right mind, who isn't rationalizing to accept a convenience, willingly turning over their financial information to either organization.

"I have just one word for you, my boy...plastics." - from "The Graduate"

Working...