title: Credit card payments (card-present, swiped) with ASP.NET MVC
body: <p>I need to take credit card payments with physical cards swiped in an ASP.NET MVC app.</p>
  
  <p>The easiest approach would likely be to have a simple "keyboard-wedge" swipe (USB now days), so that the track data gets sent as keyboard input to a password-type input field.</p>
  
  <p>I have some security concerns with this method, though:</p>
  
  <ul>
  <li>If they swipe the card when the cursor is in the wrong field, full track data is displayed in clear text.</li>
  <li>No end-to-end encryption (=card data sitting in clear text in memory / browser cache), and could be grabbed by keyboard sniffer.</li>
  <li>Full track data has to be sent to server, from where it will be sent to whatever payment gateway.  Of course over SSL in both cases, but this adds the Web server to the attack surface.  Interaction directly with payment processor from client would avoid this (if feasible), so that only the masked card # + authorization number or token, etc. would have to go to the server.</li>
  </ul>
  
  <p>I have some ideas of possibly better options, but I am not sure if they are feasible:</p>
  
  <ul>
  <li>A stand-alone credit card device that talks directly to payment processor and integrates somehow with the PC with the ASP.NET app.  Perhaps a credit card device that listen on a TCP port through which the ASP.NET app could communicate to it client-side.  Or attached via USB and interacted with via a browser plugin or similar.</li>
  <li>an small iframe or similar to use a payment processor's "payment widget" directly</li>
  <li>use a USB swipe (despite sniffability) + some client-side library to interact with payment processor directly.</li>
  </ul>
  
  <p>I am looking for some feedback and ideas on good ways (reliable and secure) to accomplish this (I plan to also contact some payment processors to see what I can find out from them).  </p>
  
  <p>Thanks.</p>