Charlie says a security failure involving financial services can expose bank account information, with consequences more serious than leaking email addresses. He frames payment security as an especially high-stakes responsibility.
Security aspect of mobile payments
Speaker
Charlie discusses mobile payment security on Callstack; his role and any co-speakers are not stated.
Charlie says losing a device should not automatically give an attacker access to its payment method. He describes safeguards such as two-factor authentication and says app developers need to understand and follow the relevant security measures.
Charlie says developers also need to ensure their payment processor has appropriate protections. He points to Stripe’s use of HTTPS, which encrypts requests so attackers cannot readily read their contents.
Charlie describes Stripe’s use of HSTS, which makes browsers use HTTPS when connecting to Stripe. He says browsers otherwise will not work with the site over an insecure connection, and notes that Google and Mozilla maintain lists of domains that require HTTPS.
Takeaways
- Treat payment data exposure as a high-impact user risk, beyond the loss of email addresses.
- Design safeguards so a lost device does not automatically expose its payment method.
- Learn and follow the payment security measures required in your app.
- Verify that your processor uses HTTPS and enforces secure connections.
Mentioned in this talk
Search inside this talk
What was claimed 3
- uses
“Stripe uses HTTPS for all connections and traffic.”
YouTube Verified2 sources· Talk
- featureHSTS: Forces browsers interacting with a domain to use HTTPS.
“HSTS forces all browsers interacting with Stripe to use HTTPS”
YouTube Unverified1 source· Talk
- uses
“Stripe also uses something called HSTS.”
YouTube Verified2 sources· Talk
