5 ms·

The credit card one is cool, but when I clicked it and Chrome offered to autofill my credit card, the first thing that popped into my head was "hmm, this would

The credit card one is cool, but when I clicked it and Chrome offered to autofill my credit card, the first thing that popped into my head was "hmm, this would be a sneaky way to siphon some credit card numbers." Paranoid? Maybe. It made me ponder how I seem to be growing more suspicious of things on the modern web though.

kamikaz1k 8y ago
Can you elaborate on how you expect them to siphon Credit Card numbers? Are you speaking of the demo, or are you saying of potential users of the library?
- folkhack 8y ago
  Chrome offered to auto-fill his CC number that is stored with his expiry, name on card, and (maybe) payment address/zip... everything but the CVV, (card verification number, usually three digits). Chrome is pretty clever these days with payment details and tries to help you keep a "wallet" so-to-speak which acts like an "autofill" feature. Do some searches around Web Payments, Payment Request API, W3C Payment Request, blah blah - let's just say it goes a lot deeper than basic autofill =) Now for siphoning. That attack (as far as I know) wouldn't be allowed to happen. Chrome WILL NOT autofill your details or inject ANYTHING into the DOM until you've entered/verified your CVV. Due to security with how payments work there has to be some sort of a user interaction before any PAN is allowed to populate the DOM. This is to avoid his exact paranoia where a CC num gets entered automatically w/o a user's knowledge. Since this is enforced by the browser I consider it to be pretty safe, and appreciate the feature in my day-to-day browsing activities =) Back to the Cleave.js lib though - that thing is going to BARF on things like CC num autofill driven by browsers/etc. Trying to be super clever is just going to screw-up native browser capabilities.
deleted 8y ago
[deleted]
wsgeorge 8y ago
I had a similar thought when trying the phone number field. I immediately thought "hey, this is what I've been keeping away from Yahoo for years..."
sam_goody 8y ago
Of course, if you were just a tad _more_ paranoid you might not be so thrilled that Chrome is storing your credit card details, your address and the passwords to every sites you trust it with in a way that is accessible to Google. They are not just storing a hash, as that would prevent them from offering the data back to you to fill in passwords et al. And they are not just storing it locally * , I assume that is for your benefit as well, maybe if you switch computers? * This I know from a popup on Vivaldi, which never informed me it is sending my passwords to Google for "safe"keeping, until I tried to change a password and it told me I need to login to my Google account....

kamikaz1k 8y ago

Can you elaborate on how you expect them to siphon Credit Card numbers? Are you speaking of the demo, or are you saying of potential users of the library?

folkhack 8y ago
Chrome offered to auto-fill his CC number that is stored with his expiry, name on card, and (maybe) payment address/zip... everything but the CVV, (card verification number, usually three digits). Chrome is pretty clever these days with payment details and tries to help you keep a "wallet" so-to-speak which acts like an "autofill" feature. Do some searches around Web Payments, Payment Request API, W3C Payment Request, blah blah - let's just say it goes a lot deeper than basic autofill =) Now for siphoning. That attack (as far as I know) wouldn't be allowed to happen. Chrome WILL NOT autofill your details or inject ANYTHING into the DOM until you've entered/verified your CVV. Due to security with how payments work there has to be some sort of a user interaction before any PAN is allowed to populate the DOM. This is to avoid his exact paranoia where a CC num gets entered automatically w/o a user's knowledge. Since this is enforced by the browser I consider it to be pretty safe, and appreciate the feature in my day-to-day browsing activities =) Back to the Cleave.js lib though - that thing is going to BARF on things like CC num autofill driven by browsers/etc. Trying to be super clever is just going to screw-up native browser capabilities.

deleted 8y ago

[deleted]

wsgeorge 8y ago

I had a similar thought when trying the phone number field. I immediately thought "hey, this is what I've been keeping away from Yahoo for years..."

sam_goody 8y ago

Of course, if you were just a tad _more_ paranoid you might not be so thrilled that Chrome is storing your credit card details, your address and the passwords to every sites you trust it with in a way that is accessible to Google. They are not just storing a hash, as that would prevent them from offering the data back to you to fill in passwords et al. And they are not just storing it locally * , I assume that is for your benefit as well, maybe if you switch computers? * This I know from a popup on Vivaldi, which never informed me it is sending my passwords to Google for "safe"keeping, until I tried to change a password and it told me I need to login to my Google account....