Reply to comment

PCI - DSS

https://www.pcisecuritystandards.org/tech/

http://www.the-logic-group.com/Downloads/PCI_FAQ.pdf

If you start taking card payments via ATM, you will be bound and subject to the above. I would for a start question if the existing source payment method for second life (using the website not SL INGAME) is pci-dss. As it is outsourced one assumes its is.

However the moment you can enter a 'card detail' in SL and it propogates across the SL Metaverse to an aquirer it needs to be covered by PCI-DSS.

Just remind me how SL communicates with the outside world, oh

"LSL receives XML-RPC requests and passes them to the prim specified. It may not establish this connect, but it may reply and keep two-way communication with that server. These responses seem to be able to transport a largest amount of data out of Second Life (vs. Email and HTTP Requests)"

Note the HTTP not HTTPS, thats un encrypted data transfer. For it to be HTTPS every atm would need a secured certificate, or proxied server that was secured.

There is absolutely no way that this solution can meet PCI-DSS, Unless they bypass it by considering the 'cards to be gift vouchers'.

Zal.