# Encryption (of credit cards)

**URL:** <https://www.ruby-forum.com/t/encryption-of-credit-cards/110825>\
**Category:** Ruby\
**Created:** [July 31, 2007, 11:36am UTC](https://www.ruby-forum.com/t/encryption-of-credit-cards/110825 "2007-07-31T11:36:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joe-dumoulin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9dc877/32.png) [@joe-dumoulin](https://www.ruby-forum.com/u/joe-dumoulin)\
**Post date:** [July 31, 2007, 11:36am UTC](https://www.ruby-forum.com/t/encryption-of-credit-cards/110825/1 "2007-07-31T11:36:09Z")

</div>

[http://monkeycharger.googlecode.com/svn/trunk/app/models/credit\_card.rb](http://monkeycharger.googlecode.com/svn/trunk/app/models/credit_card.rb)

Ignore the fact that it’s a ActiveRecord model and tell me if the  
encryption that I’m using for encrypting the credit card numbers is  
reasonable. Did I screw anything up?

What would you change? I imagine I could generalize out the  
encryption bits, right?

Thanks,  
Joe

---

<div class="post-metadata">

**Author:** ![joe-dumoulin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/9dc877/32.png) [@joe-dumoulin](https://www.ruby-forum.com/u/joe-dumoulin)\
**Post date:** [July 31, 2007, 12:58pm UTC](https://www.ruby-forum.com/t/encryption-of-credit-cards/110825/2 "2007-07-31T12:58:22Z")

</div>

On Jul 31, 2:32 am, Joe Van D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> [http://monkeycharger.googlecode.com/svn/trunk/app/models/credit\_card.rb](http://monkeycharger.googlecode.com/svn/trunk/app/models/credit_card.rb)
> 
> Ignore the fact that it’s a ActiveRecord model and tell me if the  
> encryption that I’m using for encrypting the credit card numbers is  
> reasonable. Did I screw anything up?
> 
> What would you change? I imagine I could generalize out the  
> encryption bits, right?

One alternative I came up with is to use some combination of a unique  
user id, the credit card’s cvv, and a secret key on the server for  
encrypting the credit card number. So, whenever you wanted to  
authorize a card, you had to provide the unique user id and the CVV  
for the card. I figure that would make a bit safer.