处理信用卡和IOS

Question

I am using NSUrlConnection asyncronous request to transmit credit card information to a secure third party server.

I do the following:

1. I get the credit card number, cvv, etc from the uitextfields.

2. Encode the credit card information into a json format. Set as httpd body of the NSURLConnection request as follows:

    NSDictionary * params = @{"creditCardNumber": @"4242....", @"cvv": @"455".... NSURL * url = [[NSURL URLWithString: "https://www.example.com"]; NSMutableURLRequest * request = [[NSMutableURLRequest alloc] initWithURL: url]; [request setHTTPMethod: @"POST"]; [request setValue:@"application/json" forHTTPHeaderField:@"Accept"]; [request setValue:@"application/json" forHTTPHeaderField:@"Content-Type"]; [request setHTTPBody: [NSJSONSerialization dataWithJSONObject: params options: kNilOptions error: &parseError]]; 

3. Send this information via asynchronous request to a secure third party server:

     [NSURLConnection sendAsynchronousRequest:request queue: queue completionHandler:^(NSURLResponse *response, NSData *data, NSError * requestError) { 

What should I be considering to send user credit card information to a third party server using nsurlconnection asynchronous request?

Is this the right way to send credit card information from a mobile app?

What can I do to prevent man in the middle attack?

Answer 1

Depending on what you are doing you may need to comply with a standard like PCI, PADSS, etc.

Besides communicating over HTTPS, the general flow of hardening against man-in-the-middle attacks involves:

• Do not store any details on the device. Storing in RAM is ok.
• The back-end instruct you to use one of many pre-fetched public encryption keys. Each key is associated with an id. You will fetch the key that it instructs you to use from your local store. You will create a hash of your deta using that key. And then send to the back-end.

For encryption, I recommend checking out the CoocaSecurity project. It wraps some of the lower level APIs making them easier to "digest" (excuse the pun).

Answer 2

Your request looks good, just make sure you are accessing via https and not http. This means your server must support https

Answer 3

Assuming you have some king of secure authentication scheme in place for your web service, you've at least cleared the basics. Your biggest weakness is HTTPS. Especially in the mobile world, HTTPS is easily penetrated. I know that sounds a bit paranoid, but you have to think that way to stay ahead.

The next step would be apply an additional level of encryption to the payload of the request. Blowfish would be a simple and easy way to encrypt the payload.