search

w3c / src

Other
7 stars 7 forks source link

Provide full data instead of masked with user consent? #12

Open ianbjacobs opened 5 years ago

ianbjacobs commented 5 years ago

The draft SRC data model includes some masked response data for display: maskedEmailAddress, maskedPhoneNumber, maskedCountryCode.

There was a proposal to return the complete (unmasked) data with user consent. Further comment: "Consumer consent may be explicit / implicit depending on DCF policy."

tblachowicz commented 5 years ago

The EMVCo SRC API specification 1.0 [1] maintains the approach that neither card nor consumer personal details cannot be retrieved from SRC System in complete and clear form. Instead, the data is either masked, e.g. MaskedCard, MaskedConusmer or encrypted Payload.

What is the purpose of getting access to full and clear data in the payment handler/payment sheet?

[1] https://www.emvco.com/terms-of-use/?u=/wp-content/uploads/documents/EMVCo-Secure-Remote-Commerce-Specifications-API-1.0.pdf