Hacker News new | ask | show | jobs
by dogma1138 2993 days ago
Card data isn’t the only data that is covered by PCI SSC standards.

Card holder PII is also covered and is even considered more important these days since CC numbers are easy to rotate but your identify isn’t.

Also even if the PoS doesn’t sees the card details it is part of the payment acceptance process and if it’s compromised the payment process can be affected even with P2PE devices.

If the PED is complete separated from the payment process e.g. those in which the vendor has to type in the amount separately and the PoS doesn’t take any any any customer PII ever you may be able to get away with using something like ReactOS on it.