encryption (of credit cards)

[Joe Van Dyk]

http://monkeycharger.googlecode.com/svn/trunk/app/models/credit_card.rb

Ignore the fact that it's a ActiveRecord model and tell me if the
encryption that I'm using for encrypting the credit card numbers is
reasonable. Did I screw anything up?

What would you change? I imagine I could generalize out the
encryption bits, right?

Thanks,
Joe

 

[Joe Van Dyk]

http://monkeycharger.googlecode.com/svn/trunk/app/models/credit_card.rb

Ignore the fact that it's a ActiveRecord model and tell me if the
encryption that I'm using for encrypting the credit card numbers is
reasonable. Did I screw anything up?

What would you change? I imagine I could generalize out the
encryption bits, right?

One alternative I came up with is to use some combination of a unique
user id, the credit card's cvv, and a secret key on the server for
encrypting the credit card number. So, whenever you wanted to
authorize a card, you had to provide the unique user id and the CVV
for the card. I figure that would make a bit safer.