topic Re: CIM security concern in Integration and Testing

CIM security concern

Christophe — Sat, 23 Mar 2013 08:15:11 GMT

I am adding CIM to my account and will use it for recurring billing.

With CIM in place, I have heightened concerns about the vulnerability of the Authorize.net merchant login portal. If somebody breaks in with a bad intent they could do a lot of more damage now (like creating transactions) than what was possible before. We use best security practices to protect passwords but this is not sufficient in my opinion.

Is there any way to require more secure access to the Authorize.net portal (like two factor authentication or IP restricted ?)

Re: CIM security concern

Joy — Wed, 27 Mar 2013 21:13:26 GMT

Hi Christophe,

Authorize.Net does not currently offer 2-factor authentication or IP address access restrictions. We enforce a strict password policy and encourage you to follow the best practices outlined in that policy found here: http://www.authorize.net/resources/files/PasswordPolicy.pdf.

Thanks,

Joy

Re: CIM security concern

Potter — Sat, 24 Jan 2015 15:53:33 GMT

Is there any update on this?

We use CIM as well. With such valuable information on hand there seems like quite a bit of potential for damage.

We've ensured that all other elements of our billing system require 2-factor authentication. Would be very nice to see this on top of the password policies that you enforce.

Re: CIM security concern

RichardH — Sat, 24 Jan 2015 16:39:48 GMT

Hello @Potter

You are welcome to post this as a new feature using our Ideas forum. This will allow others to vote on and make suggestions to improve the request.

Richard

Re: CIM security concern

Christophe — Thu, 30 Apr 2015 14:50:02 GMT

You can vote for this on the Ideas board.

Re: CIM security concern

RichardH — Thu, 30 Apr 2015 15:14:11 GMT

Thanks @Christophe for creating the new product idea.

Richard

Re: CIM security concern

Christophe — Wed, 21 Sep 2016 16:32:42 GMT

This is a gentle reminder to investigate two-factor authentication. This is a critical security issue for companies using CIM. Is this feature on the way ?

Thank you

Re: CIM security concern

Christophe — Fri, 22 Dec 2017 14:11:32 GMT

I opened this request for two-factor authentication almost 5 years ago! and also entered in the "Ideas" section:

https://community.developer.authorize.net/t5/Ideas/Authorize-net-portal-2-factor-authentication/idi-p/50492

It was marked as 'accepted' but nothing happened.

It is 2018, how can a portal to control payments and credit cards rely solely on username/password ? This is reckless.

Re: CIM security concern

Anurag — Fri, 22 Dec 2017 17:42:48 GMT

Hi @Christophe

Thanks for your feedback .

We have Merchant Interface refresh planned in FY 18 and this will be addressed in it .

Re: CIM security concern

Christophe — Fri, 28 Feb 2020 02:39:30 GMT

So the enhancement was planned for 2018 according to the latest post, and we are in 2020. I opened the request 7 years ago.

In the meantime, many websites have two-factor. Even my daughter's school website has two-factor available. It's so easy to implement with many kits available, for example from Twilio.

I am a fan of Authorize.net, but we may walk out because compliance absolutely requires two-factor. Please get your act together!