LifeLock snaps shut Wallet mobile app over credit card leak fears

This is crazy, how can they do this without asking the customer? Imagine someone coming to your house and taking your car, because it is not safe enough. Absolute customer disrespect. Luckily I use an offline password manager Sticky Password which does the same like LifeLock and no data can be deleted without my notice or permission.

"We have determined that certain aspects of the mobile app may not be fully compliant with payment card industry (PCI) security standards."

What? The PCI standard is such a minimal level of security (like don't store the user's PIN in plaintext) that if the app weren't compliant it would deserve to be shut down.

"Lifelock"

You mean this Lifelock:

http://www.phoenixnewtimes.com/2010-05-13/news/cracking-life-lock-even-after-a-12-million-penalty-for-deceptive-advertising-the-tempe-company-can-t-be-honest-about-its-identity-theft-protection-service/full/

What else is new!

IIRC, they can't offer that 'guarantee' in New York state.

Lemon

Was just looking at when this service launched and apparently they got the product by acquiring a company named "Lemon" for $42M late last year.

What an ironic name

When I was looking for an 'electronic wallet', one of the key manditory features I was looking for, was local storage of the encrypted file. The key never leaves the phone, I'm the only one responsable for keeping it backed up, and backing it up is as easy as copying a file.

The cloud serves many places, this is not one of them.

PCI rules

Actually, the PCI rules say that you can't store the PIN number at all.

Clarity on things PCI

* PCI has no jurisdiction over you the consumer. It only has a say for companies/banks (and 3rd parties) involved with issuing cards and accepting transactions. If your phone or PC is insecure PCI has no say. If your retailer wants to use a phone to take payments they do.

* It sounds like Lifelock may have a problem with the cloud part. The challenge is where do they fit in the industry. All those companies/banks are under contract to the likes of Visa and MC or to someone who is. They may not even be allowed to keep that data unless they are under contract. I've no idea how that works but I'm sure the card companies have done everything they can legally and contractually to keep control. Perhaps, it may be as simple as Lifelock taking payments with cards means everything they do with cards must comply. If they didn't expect to have to meet all the security requirements they could have had a big surprise during an audit.

* On the whole mobile wallet security has been far worse than PCI. So many have been developed without even considering PCI let alone trying to meet the requirements. Once companies realize they aren't subject to it they can make up their own rules. Consumers should realise this. Caveat emptor.

* PCI doesn't even consider phones or tablets secureable. COTS payment applications running on them can't be certified.

* PCI does allow for secure devices and applications that encrypt the data for the bank before giving it to the phone/tablet. Most devices that claim to do this aren't certified. In fact world wide there are something like 4 or 5 such certified devices.

* Companies that get breached aren't compliant with PCI. Most of the headlines you read scream at you that more than one critical requirement was not met. Not the dot the i's and cross the t's stuff either.

* While it's easy to dis PCI, the thing is very big, very complicated, and burdensome (If you don't believe me, go to the site there are like 4 or 5 standards a couple of hundred pages each and hundreds of supporting documents. Light bed time reading indeed). There's a ton of room for honest mistake and for screwups let alone bad actors. It will never be perfect; they do keep toughening it up, and they'll probably always be behind. That isn't excusing anyone - it just is what it is.

Clarity on things PCI

Wow, nice to see somebody who knows what they are talking about around PCI but also tempers it with some reality.

PCI does however recommend using PA (payment application) DSS document as a guide when developing/deploying mobile payment/issuing applications. I found the P2PE (point-to-point-encryption) docs useful too.