I would prefer to constrain the discussion to methods of safely storing credit card numbers on a webserver, and stay away from the whole "don't do it" boilerplate.<p>Given that, how would you do it?<p>It seems to me, that any crypto magic you may perform on your data, before storing it into your database, is coded right there for any attacker with access to your source files.  If they have access to your database, I assume they also can access your source files.<p>So, does everybody ignore that fact?  Or do they use compiled code that they were careful to remove the source after they compiled it?<p>I'm envisioning a c program that uses variables like private ip address, ip address, etc, as encryption keys, or just as gates to keep the program from working.  Compile it, remove the source code, and bask in the knowledge that even if your harddrive is cloned, it still won't work when they run it on their system.<p>Is there a better way?
Ask HN: Storing Credit Card Numbers