Slashdot Mirror
Browsers Will Store Credit Card Details Similar To How They Save Passwords (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: A new W3C standard is slowly creeping into current browser implementations, a standard that will simplify the way people make payments online. Called the Payment Request API, this new standard relies on users entering and storing payment card details inside browsers, just like they currently do with passwords. The API is also a godsend for the security and e-commerce industry since it spares store owners from having to store payment card data on their servers. This means less regulation and no more fears that an online store might expose card data when getting hacked. By moving the storage of payment card details in the browser, the responsibility of keeping these details safe is moved to the browser and the user. Browsers that support the Payment Request API include Google Chrome, who first added support for it in Chrome for Android 53 in August 2016, and added desktop support last month with the release of Chrome 61. Microsoft Edge also supports the Payment Request API since September 2016, but the feature requires that users register a Microsoft Wallet account before using it. Firefox and Safari are still working on supporting the API, and so are browser implementations from Facebook and Samsung, both eager to provide a simpler payment mechanism than the one in use today.
With the greatest respect:
How about no.
... just like they currently do with passwords
I don't trust any browser to store even my Slashdot login password. Why in the world would I trust it with my credit card? In fact, I don't even let merchants store my credit card if at all possible (I either choose the option not to save the card or manually delete the card after the purchase).
It seems like nobody who understands and actually values privacy and security would do this.
In NO way should ANY browser store Credit Cards!
Does this mean that browsers are going to have to be PCI DSS certified?
That would certainly be interesting, because PCI for example prohibits using anything less than TLS1.2 for secure comms, which might bleed-over into general communications. Could this be the end of non-HTTPS web traffic and SSL/TLS before v1.2? Will browser vendors have to choose between interoperability with (old, shitty) servers and providing storage and transmission of credit card info?
It would be kind of awesome if one DID imply the other, because the internet would get a lot less shitty really quickly.
Payment providers like PayPal or Amazon might not be on board with this new API since it makes them obsolete, but almost everyone else is.
Or because, in the case of something like Amazon Payments or "Pay with Amazon" they actually need to store your payment information to process transactions that occur outside the browser. If I'm using that, I don't need my browser to handle it too.
In many ways, the Payment Request API is a much secure method of handling online transactions, but it's not perfect either.
For starters, browser makers now have a full view of your finances and transactions, a situation that some people might not like, and will refuse to store any such information in their browser.
Ya think? I imagine the above will be a non-starter for many. Like I want Mozilla, Microsoft or Google accessing my CC transactions.
It must have been something you assimilated. . . .
The researcher notes that sites that don't sell any products or advertisers could abuse the API to fingerprint and profile users (detect what payment options each user/browser has stored in its settings), or detect when the user is paying from a normal or incognito mode session.
Just great. Then any website could query your browser for available payment information.
It must have been something you assimilated. . . .
very long since we have to change numbers pretty often because of fraud. With my Chase card, I think my number changed three times since I got it six years ago. With my Barclays card, I've already changed number three times just this year! Neither card has a chip, so I swipe them at a lot of places. Food trucks seem to be the worst since twice immediately after I bought something from a taco truck, I had charges from FAST STOP 1107 in Texas three different times.
The government has a program in place that you can take advantage of to prevent credit card fraud at high-risk situations like taco trucks. It's a paper certificate called a "Federal Reserve Note", and it's now widely available.
Do you even need to ask that question?
The funz will really start when they extend the APIs to allow for recurring charges, one of the common billing scams - it wont be long I am sure.
'WE JUST NEED TO VERIFY YOUR CCARD WITH A $0.01 CHARGE TO VALIDATE YOU' (tinyprint hidden, we will also start charging you $39.95 per month for an email telling you our monthly lucky numbers, and it is basically impossible to cancel).
So yes, the ONLY valid answer to this if 'NO F'in WAY'
This story is not news. I've stored my credit cards along with information for other important accounts in Lastpass for a long time using it's "form fills" feature. And, better than storing it in a browser, it is available across all browsers I use on all devices as well as with the standalone app.
In addition to bank accounts it's very convenient to store things like your AAA account info, insurance accounts, etc. This way it's always readily available to you on any device.
Conversion rates in the checkout flow are a key measure for ecommerce sites. 46% of e-commerce shoppers abandon the checkout process during the payment phase, signaling frustration with the complexity and redundancy of re-entering form data or tracking down payment information. Even a small increase in the success rate of checkout make a direct impact on your site’s bottom line, while improving the shopping experience for customers.
From Payment Request API
Many problems related to online purchase abandonment can be traced to checkout forms, which are user-intensive, difficult to use, slow to load and refresh, and require multiple steps to complete.
Sure, this API may make things simpler for you -- the purchaser -- but it seems the focus is on benefiting the seller. Perhaps a narrow distinction, but one that may matter if/when push comes to shove and a side must be chosen by the developers.
Another thing to consider: Since this is implemented in the browser, if you use multiple browsers to shop, then you'll have to store your information in each browser rather than once on the websites on which you shop -- unless the browser vendors can cooperate on a single, shared data storage method.
It must have been something you assimilated. . . .
The browser is the one component in my system I trust less. I mean: its job is to go around the Intratubes picking up every bit of dirt out there and *executing it*?
I don't put my banking data into that now. Much less when there's a standard with a clear label on it "BANKING DATA HERE".
"But, but" "Sandboxes". Yeah, right. Ponies. Rainbows. Farts.
No. Fucking. Way.
There is an insidious and non-obvious way that it will likely be worse than the existing system. In the current system, when your credit card number is stolen and misused, you usually are not responsible to pay because the credit card company would have to prove that it was your computer that was compromised rather than the merchant. That would require an expensive forensic investigation. But with these new systems like ShopSafe, Verified by Visa, or this new browser API, the merchant never gets your card number, and so they can't be blamed for losing your card number. That means it was either your system or the card company's system that was compromised. Of course they're sure it wasn't their system that was compromised. So that just leaves yours.
Of course in the bold print they claim there is zero dollar deductible fraud coverage on your card. However, in the fine print, the contract you agreed to, says it doesn't apply if you fail to protect your password. And if you dispute their demand that you pay, you have agreed to go before an arbitrator who the card company has probably kept track of his record for "business friendly" decisions. And when you lose the dispute, you get to pay thousands of dollars for the arbitrator's fee, and for the expensive forensic investigation of your computer as well.
It would be a great security improvement to the system to eliminate the merchants as possible leak points for payment credentials. The existing system, where you give lots of random merchants and their untrustworthy employees, all they need to take money from your account, is crazy insecure. But operating systems like Windows, Linux, Android, IOS etc. are far too complicated to ever have much hope they can be made secure for consumers. The only way I can think of for a reasonably secure system, is something to connect to your computer, with an extremely simple operating system, like a smart card, but with a display to verify who the payment will go to, and a physical button or pin to authorize the transaction. Only an extremely simple operating system, or better, no real operating system at all, has a hope of being reasonably secure. Although even smart cards have been compromised in a number of instances, they do a tolerably secure job, and much better than general purpose computer operating systems. I would feel sorry for the credit card companies taking losses from compromise of consumer computers, except they have the power to secure the system by the only known way, but they won't give us secure payment devices with a display and buttons.
I read quite a few of the comments, and noticed that people here are well aware of the problems with having a browser store this kind of information. And yet, I have a bad, bad feeling that in a few years, it's going to be ubiquitous, perhaps even compulsory. I'm surprised they actually spelled it out so clearly:
"By moving the storage of payment card details in the browser, the responsibility of keeping these details safe is moved to the browser and the user."
That's it right there. The banks and credit card companies have been trying ever since plastic was invented to make consumers responsible for losses due to fraud and theft. This is their ticket to paradise.
So watch for deep discounts. Watch for a flood of trolls masquerading as coolest-of-the-cool tech lords explaining how everybody who isn't a doddering old fool is using it. Watch for laws drafted to force you to use it. Like when you have to renew your driver's license, you get a choice of waiting in an endless line during business hours at a single tiny government office, or bringing your smart phone and an app to a no-wait kiosk in a mall, or doing it from home...ONLY if you use the browser function. Watch for more and more stores refusing to accept bills larger than $10 for cash transactions "because counterfeit" or "because security".
I'm sure there's a dozen more ways, all based around that "well, nobody's forcing you" lie that's been used so often and so well.
Let's hope that for once people get together and shut this down before it gets started. Right now liability for fraudulent financial transactions is right where it belongs. We need to keep it that way.
I've calculated my velocity with such exquisite precision that I have no idea where I am.