TxTag payment security concerns arise as contractor loses compliance
kxan.com/news/investigations/txtag-payment-se...
kxan.comPosted Sep 13, 2018, 4:55 PM UTC
16250
kxan.comFuck TxTag. Fuck toll roads. Fuck Rick Perry.
30
Don't forget: Fuck our idiot, hill-country, redneck neighbors.
14
I'll drink to that
8
I'll drink to you drinking to that.
6
Color me shocked.
NTTA FTW
29
Are they really that much better?
3
I mean...you would have to actively try to be worse than TxTag. There's nowhere to go but up. If you can login to your account online without having to spend 3 hours waiting for a rep online or in person, you're already miles ahead.
14
Yes. They’re online bill pay/account management is light years better.
10
Just because you responded, and I need to get something for my new car, their tag is honored anywhere?
2
NTTA works across the state. Avoid TxTag at all costs.
3
I've had to tangentially deal with PCI compliance, and it is pretty non-trivial. They require you to do a lot of things in specific ways and provide evidence of it. It isn't shocking that this sort of thing happens.
That said, payment processing is a key part of this company's core business. It's a really poor excuse to say "a data center transition delayed the timeline". That's like a winery saying oops, we can't make any wine this year because we forgot we were going to need to hire workers to harvest the grapes. It may not be super easy, but it also isn't the tiniest bit optional.
26
Yes, PCI compliance is not simple. However I can tell you from working with my customers that are required to be PCI compliant (on new software projects), they take it very seriously. They're not supposed to be processing any payments without this certification. If VISA or Mastercard get wind of this it could lead to $5k-100k per month in fines.
15
lol I'm gonna blast em both with emails and tweets now
3
They have sent me bills with my first and last names transposed. I don't even open them because I'm not that person.
If they want to sue Nathan_Hobo, fine. I'm not that person.
13
that won't hold up in court. but good luck anyway.
4
IANAL but in order to be sued or arrested they have to name you correctly or suggest the name is a alias. I have never gone by the name that is listed therefore that letter was sent to an incorrect person.
If you have a factual counter-argument, I'd love to hear it.
That said, I also avoid toll-roads like the plague so I'm not out there using the road with the intent of not paying either. The times I have used toll roads are mostly from when someone else was driving my car.
2
God dammit I've been getting your bills! The Hobo's won't let this go on!
1
Yet again we are reminded that toll roads are a poor solution to our traffic problems. The foreign investors profiting from them give no fucks about accuracy of billing nor about providing decent customer service. Have not been on a toll road in years, fuck'em. If they were not a hacker target before they sure are now.
10
Same! I refuse to drive on them.
3
Let alone it’s foreign contractors showing how easy it is to bend us over. 45 is such a shitty toll. When it downpours, it literally floods sections of the road. No draining was thought through.
2
I just refuse to pay them. Their inability to have basic compliance just adds to the fire.
1
Another disaster from the private sector... these contractors are probably making bank too.
8
It is as much a "government organization" as Boeing.
2
>actually thinking this is private sector
-3
This is a government entity contracting with a corporation that's on the NYSE, so yes, this is the private scetor.
10
It's a private company that handles the txtag "business", extracts their fee, fucks shit up, and sends the state it's share. So yeah, it's a private sector company contracted by the government.
4
TxTag is an irresponsible, lying slice of vomit? Shocker.
4
Toll roads have been a scam from the beginning. The state itself should have take advantage of all that cheap money while it was cheap. Now the company that owned 130 has gone bankrupt and is mostly owned by Strategic Value Partners LLC, a multinational "distressed debt" company. They are buying up failed privatized infrastructure projects for pennies on the dollar. Apparently they are "recession proof" and lots of smart money thinks we are headed for another one within two years.
4
It amazes me how much time and resources are spent on having toll roads. Everything I hear is a result of having a payment system integrated into a road. Which seems to be a result of poor planning. I guess if you have to drive in traffic. It's a sacrifice you are willing to make. If you want to know how to quit gooberism, let me know.
3
Honestly, I wish that I could use my EZPass tag that I have. Never had a problem with that system.
3
I work in the industry and losing PCI compliance only happens 2 ways if they have been PCI compliant in the past.
-
They forgot to login to a website and answer a simple questionnaire at a regular interval which recertifies them after receiving email reminders to get it done.
-
They made a change to an information system that resulted in noncompliance.
I’m betting someone deleted the email reminder, or that person who would have received the email reminder moved to a different job and the replacement didn’t know anything about it.
2
There are a lot of different levels of compliance. You're talking about the simplest form. Others a far far more stringent and include on-site visits by auditors and multiple levels of assurance.
2
Absolutely, just trying to simplify things for people to understand the level of incompetence by TxTag.
2
Anybody who just ASSUMES the private sector is superior is an idiot! Eff these effin toll roads. Think about all the human time they waste. Is it not worth something? This is just one more thing you'll be bothered with, but don't worry all that is free. It comes of some stupidity tree somewhere.
2
lol just switched to NTTA, tired of this shit. I've had no issues but screw this :) . Hopefully it doesn't take too long for my new tags to arrive in the mail.
1
This is why I switched to NTTA
1
So, who wants to do a "complementary" pentest on their servers and share the results with the public? I would be surprised if it didn't turn up something interesting.
1
Random question. What could happen if someone never pays the tolls fees mailed out to them? Asking for a friend...
1
#SHUT IT DOWWWWWWWWWN
#LET'S GO HOOOOOOME
-1
This is actually a huge deal. PCI compliance is the BARE MINIMUM security requirement for credit card transactions, I can't even imagine what sort of shit they must be doing to not be able to maintain that.
Having said that TXTag website seems to have been designed in 1999 but people who have never seen another website, so I'm not shocked. You can't even fucking reset your password normally on TXtag's site...and it's a 50/50 shot if their credit card processing is even functioning on any given day.
These people need to be kicked out of this state and should be nowhere near government contracts.
Florida has already made efforts to kick them out.
What I found amusing about the article itself is how it's inferred that PCI compliance can be lost just by making some silly mistakes. That isn't really how it works at all. Any competent PCI auditor will point out deficiencies and allow (or demand) corrections to be made, they wouldn't just walk out and deny certification and the company would go "Oops we left a door open, hehe!" In short, this company fucked up big time which is really not surprising in TxTag world I would imagine.
Also, most PCI requirements revolve around properly protecting cardholder data, so if you think your CC info is safe with this company, ha ha ha ha.
Source: Am PCI audited every other year. It's miserable but it works.
Not even. It's all bullshit smoke and mirrors scope shifting.
I'm not following. I think maybe scope wasn't the word you were looking for. Do you mean shifting responsibility?
In the world of PCI, they mean the same thing. Scope in this context refers to what servers are "in scope" of PCI rules. The whole game is to say "well I don't store any actual data on these computers, only these two servers are actually in scope and have to comply to the PCI standards."
That means that 99% of their network can be insecure as fuck, but the handful of servers they've said house their scary data are "totally secure you guys, I promise."
Yes, but so long as those things aren't connected I'm not sure I follow what the problem with that is. PCI compliance is intended to make sure that wherever transaction data is stored is secure...not that the places it is not stored are secure.