credit card security

[jkinz-+hffLmS/kj4 at public.gmane.org (jkinz-+hffLmS/kj4 at public.gmane.org)]

On Mon, Jan 05, 2009 at 09:24:00AM -0500, Gregory Boyce wrote:
> On Mon, 5 Jan 2009, jkinz-+hffLmS/kj4 at public.gmane.org wrote:
> 
> > If there were a public web site sharing the names of the leaky
> > merchants with the dates of when breaches occurred I wonder if it would
> > have any effect on how fast said merchants would address the issue...
> 
> http://www.privacyrights.org/ar/ChronDataBreaches.htm#CP

Hi Greg,

No, that site isn't sufficient. (IMHO)

Why? 

[[ this all just me thinking out loud, any contribs/critiques
welcome ]]

First - the site must be dedicated to just the one issue 
(at privacyrights.org its just one of many diluting the focus)

It also needs:

CC entities only:  (again focus on one issue.)
That would be card companies, processors and merchants

ratings of the CC entities:  
For any who have lost info/had it stolen : DANGER
for any who have had their security certified: SAFE
for those who don't meet the first two: UNKNOWN


First criteria trumps second. 

needs place for comments on how the data was breached and places
for company to respond about how they fixed the problem

Any responses that are simply a PR flack saying :
"Its fixed, your data is safe! trust us!.  Would 
incur a negative rating :-) 

[We would also need to maintain a fund to sponsor
"pie in the face" style hits on such PR flacks..]


Places for consumers to publish details of problems they have
with the CC entities getting things fixed (or good experiences as
well).






--