4 ms·

> The second payload of the noblesse family is an “Autocomplete” information stealer. All modern browsers support saving passwords and credit card information f

> The second payload of the noblesse family is an “Autocomplete” information stealer. All modern browsers support saving passwords and credit card information for the user: > Browser support for saving passwords and credit card information > This is very convenient, but the downside is that this information can be leaked by malicious software that got access to the local machine. I never store CC deets anywhere, not even in a secure password manager vault. I typically manually type it out from the card, as I rarely use a CC (Every month or so I use it). I can see why automatically filling in CC info would be useful for people who use their CC a lot. If I was using it a lot, I would use a non-browser password manager however, since browser secrets can be exfil'd via various means and I trust a non-browser password manager vault more.

DannyBee 5y ago
In the US, CC has, by law, almost no liability for fraud - it's capped at 50 bucks, and is 0 bucks if you report it before it gets used. They are also easily replaced, so i think many wouldn't go as far as you are. Debit cards are weirder in their liability (and are extracting money from your bank account, which is harder to get back). If you report them lost/stolen before someone uses them, it's 0 bucks Within 2 days of learning about it, it's 50 bucks. More than 2 days, but less than 60, 500 bucks. More than 60 days - unlimited liability. So i'd be a lot more careful with debit cards, at least in the US. (You are never liable on either for unauthorized transactions when your card is not lost/stolen as long as you report them within 60 days)
- r3trohack3r 5y ago
  Hmm. I understood this to be different, but realizing now I don’t have sources for where I learned this: * Bank accounts, savings accounts, brokerage accounts, etc. are all unlimited liability * Lines of credit are all zero liability I’ve used this as a rule of thumb for many years, and was the initial reason for me switching to 100% credit cards for transactions.
  - DannyBee 5y ago
    Yeah, i'm telling you based on what the statutes say (the FCBA covers credit cards, the EFTA covers debit) A short version of it is here: https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-credit-atm-and-debit-cards https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr...
- brianwawok 5y ago
  I would never ever use a debit card outside of the ATM of the bank I belong to. Credit card? Go wild, use it everywhere.
jetrink 5y ago
Credit cards are insecure by design and worrying about having them stolen from your browser or vault is not worth it in my opinion. You're far more likely to have it compromised from the retailer side no matter how careful you are. Also, it's easy to set up a notification on your phone for every time a card is used, so you can report fraud before any harm is done.
- prower 5y ago
  Some online banks (don't know how widespread this is) allow you to create "virtual card" that expire either after 1 purchase or at a specific date (and with a set maximum of budget). I use them for every single purchase I make online, it's inconvenient but at least i've never entered my real card info anywhere.
  - brianwawok 5y ago
    That sounds like a lot of work. At least in the US you are not responsible for fraud. (I think the law may have like a $50 liability thing, but Visa/MC waive). So it's better to just not do this, and every 3-4 years when my CC is stolen, call them up - dispute the charges, get a new number. Takes < 5 minutes and I keep going. For what it's worth, the 2 times my number got stolen in the last 6 years, one was from a rogue agent at a hotel in Chicago, and one was from a bad website that stored credit cards.
    - hggythhdtr 5y ago
      > That sounds like a lot of work. My bank has a browser plugin that can create virtual cards with just a few clicks. > dispute the charges, get a new number. Takes < 5 minutes and I keep going. This isn't the case for me, it would take me quite a bit of time over a period of several weeks to update all of the places i use my card if I were using the same number everywhere and it was compromised. I handle a lot of billing. I've had cards compromised at least three times in the past and it's very unpleasant. (for me)
    - trepatudo 5y ago
      In Portugal, you basically open the app, scan fingerprint to give permission and get a new card. You can even scan the card via webcam or copy the details to clipboard. The virtual card also limits itself either to single transaction or single store so it can't be used even if compromised on store level. It's pretty simple process (<30sec) and it's really useful.
williamdclt 5y ago
I've been thinking I should probably just memorising my card number. Would take a bit of effort but can't be much harder than memorising a phone number, and possibly faster than entering my master password to unlock my password manager
- the_only_law 5y ago
  I’ve done it a number of times without even trying. Problem is if you have to replace it a lot.
- dbrgn 5y ago
  I've memorized my last 2 credit card numbers. Takes about 5-10 minutes and is absolutely worth it!
njharman 5y ago
I use CC for everything. Shop tons online, multiple sites . Store my CC on browser and share that across desktop, laptop, ipad and phones. In last 10 years I've had one incident were CC company did not automatically deny fraud. Two purchases both refunded to me.
dhosek 5y ago
What I like about the Mac implementation of storing credit cards is that it requires using touch ID to autofill the credit card info. There's no autofill without explicit user interaction.

DannyBee 5y ago

In the US, CC has, by law, almost no liability for fraud - it's capped at 50 bucks, and is 0 bucks if you report it before it gets used. They are also easily replaced, so i think many wouldn't go as far as you are. Debit cards are weirder in their liability (and are extracting money from your bank account, which is harder to get back). If you report them lost/stolen before someone uses them, it's 0 bucks Within 2 days of learning about it, it's 50 bucks. More than 2 days, but less than 60, 500 bucks. More than 60 days - unlimited liability. So i'd be a lot more careful with debit cards, at least in the US. (You are never liable on either for unauthorized transactions when your card is not lost/stolen as long as you report them within 60 days)

r3trohack3r 5y ago
Hmm. I understood this to be different, but realizing now I don’t have sources for where I learned this: * Bank accounts, savings accounts, brokerage accounts, etc. are all unlimited liability * Lines of credit are all zero liability I’ve used this as a rule of thumb for many years, and was the initial reason for me switching to 100% credit cards for transactions.
- DannyBee 5y ago
  Yeah, i'm telling you based on what the statutes say (the FCBA covers credit cards, the EFTA covers debit) A short version of it is here: https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-credit-atm-and-debit-cards https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr...
brianwawok 5y ago
I would never ever use a debit card outside of the ATM of the bank I belong to. Credit card? Go wild, use it everywhere.

jetrink 5y ago

Credit cards are insecure by design and worrying about having them stolen from your browser or vault is not worth it in my opinion. You're far more likely to have it compromised from the retailer side no matter how careful you are. Also, it's easy to set up a notification on your phone for every time a card is used, so you can report fraud before any harm is done.

prower 5y ago
Some online banks (don't know how widespread this is) allow you to create "virtual card" that expire either after 1 purchase or at a specific date (and with a set maximum of budget). I use them for every single purchase I make online, it's inconvenient but at least i've never entered my real card info anywhere.
- brianwawok 5y ago
  That sounds like a lot of work. At least in the US you are not responsible for fraud. (I think the law may have like a $50 liability thing, but Visa/MC waive). So it's better to just not do this, and every 3-4 years when my CC is stolen, call them up - dispute the charges, get a new number. Takes < 5 minutes and I keep going. For what it's worth, the 2 times my number got stolen in the last 6 years, one was from a rogue agent at a hotel in Chicago, and one was from a bad website that stored credit cards.
  - hggythhdtr 5y ago
    > That sounds like a lot of work. My bank has a browser plugin that can create virtual cards with just a few clicks. > dispute the charges, get a new number. Takes < 5 minutes and I keep going. This isn't the case for me, it would take me quite a bit of time over a period of several weeks to update all of the places i use my card if I were using the same number everywhere and it was compromised. I handle a lot of billing. I've had cards compromised at least three times in the past and it's very unpleasant. (for me)
  - trepatudo 5y ago
    In Portugal, you basically open the app, scan fingerprint to give permission and get a new card. You can even scan the card via webcam or copy the details to clipboard. The virtual card also limits itself either to single transaction or single store so it can't be used even if compromised on store level. It's pretty simple process (<30sec) and it's really useful.

williamdclt 5y ago

I've been thinking I should probably just memorising my card number. Would take a bit of effort but can't be much harder than memorising a phone number, and possibly faster than entering my master password to unlock my password manager

the_only_law 5y ago
I’ve done it a number of times without even trying. Problem is if you have to replace it a lot.
dbrgn 5y ago
I've memorized my last 2 credit card numbers. Takes about 5-10 minutes and is absolutely worth it!

njharman 5y ago

I use CC for everything. Shop tons online, multiple sites . Store my CC on browser and share that across desktop, laptop, ipad and phones. In last 10 years I've had one incident were CC company did not automatically deny fraud. Two purchases both refunded to me.

dhosek 5y ago

What I like about the Mac implementation of storing credit cards is that it requires using touch ID to autofill the credit card info. There's no autofill without explicit user interaction.