RE: Authorize.net Consolidated v.1.0 for AIM

This message was sent from: Features
http://forums.oscommerce.com/viewtopic.php?p=214234#214234
----------------------------------------------------------------

intelli-net:
No, it isn't at all required.  In the original authorize.net contribution, Bao Nguyen used your administrator password to connect through to the authorize.net gateway.  This is an extremely bad way to do it because if someone compromised your system they would instantly have access to your gateway, and you and all your customers would be in for quite a ride.  By using a transaction key, the absolute worst that a hacker could do after obtaining it is submit credit card charges to be processed on your account, which wouldn't do anything for him/her since you'd be receiving the money.  You should see inside your admin/payments section a blank for your transaction key right below your username, which you would fill in.  You can obtain your transaction key as listed in the readme of that contribution.  If you follow the readme section exactly (for instance, a lot of people don't install curl...), you should be fine, I've tried it multiple times making sure to do nothing more than 
 the readme says.  If you need more help, please feel free to post, pm me, or hit me up on AIM. :D

cmccann:
Yes, it can.  It should be able to be used on all versions since MS1 for that matter.  The method currently packaged with osCommerce is outdated, because authorize.net will be switching to only SIM/AIM shortly.  AIM is much more secure than SIM, keeps the consumer on your site (and is transparent), and is supported by all browsers since it is serverside, versus SIM which is not.  It's also better than the other contributions out there for the security issue I list above...plus I tried to make it a bit easier in the admin section for everyone...

Austin519