> vendor-specific passcodes could solve that. You could go to your credit card website and request a passcode to provide to a specific online store. If their da

> vendor-specific passcodes could solve that. You could go to your credit card website and request a passcode to provide to a specific online store. If their database gets compromised, you can revoke the password. If it's vendor specific then it shouldn't matter if anyone else has it. Only that vendor should be able to use it. If that's not possible then if their database gets compromised, the vendor should be able to invalidate their password.