I think it depends on how strong the merchant credential is to communicate to GW. Usually here we are looking at network security (VPN, TLS etc) plus some additional data security (encryption or signature). Either one of them is strong enough. I think even if token goes to wrong hand he would not be able to identify the PSP and have merchant credentials. This can be discussed with existing merchants who are integrated to GW. My point was on subsequent transaction you were still passing id stored in browser. so you are still having static value in browser which is sent to merchant. Then relying on merchant to get token. So here you are relying on merchant credentials. if they get compromised then hacker can use static id to get token. I think we are creating extra security here which would not useful and make the transaction take longer to process. Also I think of GW as payment processor so basically merchant would request the GW to process the payment of X amount and they would need merchant info for that. We can simplify this further I think and improve user experience without compromising on security. we can have a call to discuss further. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/w3c/webpayments-methods-tokenization/issues/8#issuecomment-307172096
Received on Thursday, 8 June 2017 17:28:42 UTC