Re: PCI DSS - VDI (vmware) SAQ-C-VT question

[Mike Osterman <ostermmg () WHITMAN EDU>]

On May 7, 2013, at 12:16 PM, Jessica Odom <odom () LCLARK EDU> wrote:

> > I know, I know, if we would just listen to our users and allow
> > 'square' all would be OK :)
>
> My QSA reports that devices that use the audio jack for the data (ie: Square) are not PCI compliant.  That type 
> converts sound to data and writes it (ie: PAN) in plain text to the device.  I haven't validated this, but I've been 
> told to pick the ones that use the data port (ie: Verifone).

This obviously requires deeper validation than a tech blog post, but it's my understanding that the Square reader now 
comes with hardware encryption:

http://mobile.theverge.com/2012/3/28/2909699/square-dongle-hardware-encryption