Slashdot Mirror
Browsers Will Store Credit Card Details Similar To How They Save Passwords (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: A new W3C standard is slowly creeping into current browser implementations, a standard that will simplify the way people make payments online. Called the Payment Request API, this new standard relies on users entering and storing payment card details inside browsers, just like they currently do with passwords. The API is also a godsend for the security and e-commerce industry since it spares store owners from having to store payment card data on their servers. This means less regulation and no more fears that an online store might expose card data when getting hacked. By moving the storage of payment card details in the browser, the responsibility of keeping these details safe is moved to the browser and the user. Browsers that support the Payment Request API include Google Chrome, who first added support for it in Chrome for Android 53 in August 2016, and added desktop support last month with the release of Chrome 61. Microsoft Edge also supports the Payment Request API since September 2016, but the feature requires that users register a Microsoft Wallet account before using it. Firefox and Safari are still working on supporting the API, and so are browser implementations from Facebook and Samsung, both eager to provide a simpler payment mechanism than the one in use today.
In what world is storing credit card info not worse than not storing credit card info?
Just enter your credit card number? are we that fucking lazy?
yes, it is very stupid to store stuff like this in the browser; but you're fooling yourself if you believe that by not 'saving' the card or by 'deleting' the card at the merchant site you're preventing the merchant from retaining the card details. they ALL store that shit anyway, regardless of what the user does. and a lot of them also retain cvv security code as well, even though they aren't supposed to.
the only thing you can do is use virtual numbers (like what paypal used to offer years ago, or what a few banks provide today) that you can expire or set limits on directly with the issuer.
Do you even need to ask that question?
The funz will really start when they extend the APIs to allow for recurring charges, one of the common billing scams - it wont be long I am sure.
'WE JUST NEED TO VERIFY YOUR CCARD WITH A $0.01 CHARGE TO VALIDATE YOU' (tinyprint hidden, we will also start charging you $39.95 per month for an email telling you our monthly lucky numbers, and it is basically impossible to cancel).
So yes, the ONLY valid answer to this if 'NO F'in WAY'
How about YES. It is implausible that this will be any worse than the existing system.
Having standardized interfaces malware can leverage to trivially extract card details from user systems has the potential to lead to worse outcomes. We already see malware looking for bitcoin wallets which on a realitive basis very few people have. A future in which everyone is storing card details in their browsers does not seem productive.
Neither is encouraging use of dead-end inherently dangerous pull based technology (credit cards) when push based systems (e.g. PayPal) are MUCH safer only leads to worse outcomes for all.
Statements like: "The PaymentRequest API does not directly support encryption of data fields. Individual payment methods may choose to include support for encrypted data but it is not mandatory that all payment methods support this."
Indicates developers of the API are not serious and are just going to punt on security.
They don't seem to care very much about privacy allowing payment type data to be probed without explicit permission at the whim of the browser vendor.
The overall approach is pedestrian. Shoving complex ecommerce workflows and interfaces into browser APIs is a ridiculous nonstarter. Why not work on something useful like native browser support for distributed authorization or common information request profiles? The approach reeks.
In NO way should ANY browser store Credit Cards!
Why not?
I'd rather have someone steal my credit card info than my slashdot credentials.
I can always cancel (and get a full refund for) any fraudulent CC charges. But a slashdot post under my name is permanent.
Have you ever tried to cancel a payment? It can take many months. During this time you will no doubt have to get a new card/account details, update regular payments and quite likely be without any spending cash for several days. I think the inconvenience factor and being observant enough to catch fraud before you're rendered bankrupt far out weighs potential gain vs risk.
Why UNIX?
There is an insidious and non-obvious way that it will likely be worse than the existing system. In the current system, when your credit card number is stolen and misused, you usually are not responsible to pay because the credit card company would have to prove that it was your computer that was compromised rather than the merchant. That would require an expensive forensic investigation. But with these new systems like ShopSafe, Verified by Visa, or this new browser API, the merchant never gets your card number, and so they can't be blamed for losing your card number. That means it was either your system or the card company's system that was compromised. Of course they're sure it wasn't their system that was compromised. So that just leaves yours.
Of course in the bold print they claim there is zero dollar deductible fraud coverage on your card. However, in the fine print, the contract you agreed to, says it doesn't apply if you fail to protect your password. And if you dispute their demand that you pay, you have agreed to go before an arbitrator who the card company has probably kept track of his record for "business friendly" decisions. And when you lose the dispute, you get to pay thousands of dollars for the arbitrator's fee, and for the expensive forensic investigation of your computer as well.
It would be a great security improvement to the system to eliminate the merchants as possible leak points for payment credentials. The existing system, where you give lots of random merchants and their untrustworthy employees, all they need to take money from your account, is crazy insecure. But operating systems like Windows, Linux, Android, IOS etc. are far too complicated to ever have much hope they can be made secure for consumers. The only way I can think of for a reasonably secure system, is something to connect to your computer, with an extremely simple operating system, like a smart card, but with a display to verify who the payment will go to, and a physical button or pin to authorize the transaction. Only an extremely simple operating system, or better, no real operating system at all, has a hope of being reasonably secure. Although even smart cards have been compromised in a number of instances, they do a tolerably secure job, and much better than general purpose computer operating systems. I would feel sorry for the credit card companies taking losses from compromise of consumer computers, except they have the power to secure the system by the only known way, but they won't give us secure payment devices with a display and buttons.
If the payment info is stored in the browser, then *any* website can query your browser for available payment info. In addition, the browser maker - Mozilla, Microsoft, Google, etc... - could (will) have access to this info and any transactions.
Okay so since this features has been available for a while why not look at how it actually works:
- The browser implementation never hands over the CC info without checking with the user.
- The browser does not hand over the CVV code.
- Google's implementation at least handles the CC info exactly the same was as it does on Google's Play store so if you already have a mobile phone and purchased an app on it, you're level of trust does not change between using this new system vs buying an app on your phone.
- Additionally Google's implementation won't hand over any CC info if the security chain isn't perfect which is a damn sight better and more secure than how the vast majority of users handle their credit card online.
As it is now, for me at least, is that, with the exception of Amazon, I don't save my payment information on any website and prefer to re-enter it whenever I make a payment.
Then you should love this system.
Furthermore, on sites other than Amazon, I almost always use a virtual credit card (ShopSafe) so the CC info is different for each vendor/purchase - rendering storing it in the browser useless.
Why? I know the USA lack all sorts of basic consumer protection laws, but I was under the impression that your quite well covered for credit card fraud.
Just enter your credit card number? are we that fucking lazy?
Do you write your pin code on your credit card?
Do you post-it your password to your screen?
I honestly can't believe you would carry around a card with a bunch of numbers on it that allows someone to buy something without any additional checks. Lazy doesn't come into it. I can't remember 19 digits, but I can remember 3 (CVV code) and when I do then I can stop carrying a stealable physical item around that anyone who pick pocket me can use to run up charges.
What has this got to do with lazy?
I read quite a few of the comments, and noticed that people here are well aware of the problems with having a browser store this kind of information. And yet, I have a bad, bad feeling that in a few years, it's going to be ubiquitous, perhaps even compulsory. I'm surprised they actually spelled it out so clearly:
"By moving the storage of payment card details in the browser, the responsibility of keeping these details safe is moved to the browser and the user."
That's it right there. The banks and credit card companies have been trying ever since plastic was invented to make consumers responsible for losses due to fraud and theft. This is their ticket to paradise.
So watch for deep discounts. Watch for a flood of trolls masquerading as coolest-of-the-cool tech lords explaining how everybody who isn't a doddering old fool is using it. Watch for laws drafted to force you to use it. Like when you have to renew your driver's license, you get a choice of waiting in an endless line during business hours at a single tiny government office, or bringing your smart phone and an app to a no-wait kiosk in a mall, or doing it from home...ONLY if you use the browser function. Watch for more and more stores refusing to accept bills larger than $10 for cash transactions "because counterfeit" or "because security".
I'm sure there's a dozen more ways, all based around that "well, nobody's forcing you" lie that's been used so often and so well.
Let's hope that for once people get together and shut this down before it gets started. Right now liability for fraudulent financial transactions is right where it belongs. We need to keep it that way.
I've calculated my velocity with such exquisite precision that I have no idea where I am.