> Great that they're thinking about this, but I can't help but think many users will happily just copy-paste their CC details into random sites protected with a

> Great that they're thinking about this, but I can't help but think many users will happily just copy-paste their CC details into random sites protected with a password of "password". To be honest, we’re pretty much incentivised to by the fraud insurance structure. Any fraud is automatically covered through chargebacks. Eventually it’s the merchants that end up paying for this, big time, so they have the incentive to fix it. But since they are so far removed from the actual CC handling, usually (through PSPs, and the place a CC is stolen from is very far from the merchant who eventually is abused by it), there is very little they can actually do. I don’t care two pence about where my CC ends up, to be honest. Beyond perhaps the very minimum I need to, to avoid being held liable for the chargebacks through neglect. Which is essentially never. It’s not healthy for the overall system, but I pay for the privilege (through indirect fees), so I might as well use the comfort :/ tragedy of the commons. CC fraud incentives are a tricky beast.