Re: using mySQL to store credit card info

[Michael Plourde]

Could it be a good idea to store the key in a "web-application only readable" file in a non-web accessible directory ?

Example:

The path to the web site: /home/httpd/www/

The path to the key: /home/httpd/include/

The web-application is running as "webd" user and the file is readable only by that user.

File could be binary and encrypted to increase security using web-application or a binary program on the server itself.

Path to the file-encoder:

/usr/sbin/

So the only way to read the file would be to loggon the server itself as "super user". Credit card data or other data is then protect by web-application encryption using a key that is stored in a file encrypted.

Any comment ? Is it a good idea ? Is there some leak point ?

Michael Plourde