Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The anatomy of a credit card form

medium.com

Post reply on HN
Print view View original

101–110 of 129 posts

Re: The anatomy of a credit card form

#101

Post by taejo »

kuschku wrote: post #24
leni536 wrote: post #19

> Is this form safe and secure? We just add a lock icon, sure it's secure. Lock means secure, right? Joke aside sure, it's not the designer's fault. Every time I fill out a credit card form without even pulling out my card I cringe. Why do I need a physical credit card for this, I just authenticated myself with only something I know and not something I own and I know. And my authentication credentials are just writte…

Well, they actually do that – you could just pay per wire transfer (Überweisung) if you live in the SEPA, especially in DACH it’s more common. Bank-Authenticated direct-debit (like giropay.de) is also useful for this.

BTW, DACH here is presumably the trilingual abbreviation "Deutschland, Austria, Confoederatio Helvetica", i.e., Germany, Austria and Switzerland.

Re: The anatomy of a credit card form

#102

Post by kalleboo »

mrweasel wrote: post #11
NolF wrote: post #5

> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...

I don't get the name and zip code requirements, is that standard in some countries? I only ever encounter the "Name on card" when shopping on US and UK sites. Danish online stores don't care. Is the name and zip actually used as part of a validation process? If not it should just be left out.

We implemented our payments with PayPal Website Payments Pro, and we actually get back the name and address verification information and can choose to ignore it (at our own peril re chargebacks)

Re: The anatomy of a credit card form

#103

Post by donarb »

pjc50 wrote: post #62
yc1010 wrote: post #53

Earlier quoted context omitted.

Problem with PayPal is that they ban people (I lost my account years back, still do not know why) and also of course not available in all countries. I was thinking something along the lines of some sort of new HTML "payment" tag so it could signal to the browser things such as "product details, price, available/preferred merchant payment method" and then the browser would pay from an in browser wallet containing stor…

Pre-filled credit card information would be great - if it could be stored securely. PCs are basically far too insecure for this to be accepted by the payment processors, it would just be phished to death. Apple Pay would be the right solution if it weren't so proprietary.

Apple Pay uses industry standard payment tokens, just like Google Wallet, there is nothing stopping any company out there from using the technology. The only thing about Apple Pay that is proprietary is the TouchID fingerprint verification.

Re: The anatomy of a credit card form

#104

Post by thomasrossi »

mynameisvlad wrote: post #89
thomasrossi wrote: post #67

"supports credit card autofill" .. don't use it:) unless you have TouchID!

Uhh... Why not? Generally speaking, password managers are pretty good at encrypting secrets, considering it's their only job and all.

basically there are tons of browser plugins which listens to your keyboard, or anyway see everything you enter in a form. One nice example was facebook color changer;P

Re: The anatomy of a credit card form

#105

Post by kalleboo »

pjc50 wrote: post #62
yc1010 wrote: post #53

Earlier quoted context omitted.

Problem with PayPal is that they ban people (I lost my account years back, still do not know why) and also of course not available in all countries. I was thinking something along the lines of some sort of new HTML "payment" tag so it could signal to the browser things such as "product details, price, available/preferred merchant payment method" and then the browser would pay from an in browser wallet containing stor…

Pre-filled credit card information would be great - if it could be stored securely. PCs are basically far too insecure for this to be accepted by the payment processors, it would just be phished to death. Apple Pay would be the right solution if it weren't so proprietary.

Both Chrome and Safari offer to store, autofill, and cloud sync your card details.

Re: The anatomy of a credit card form

#106

Post by mynameisvlad »

thomasrossi wrote: post #104
mynameisvlad wrote: post #89

Earlier quoted context omitted.

Uhh... Why not? Generally speaking, password managers are pretty good at encrypting secrets, considering it's their only job and all.

basically there are tons of browser plugins which listens to your keyboard, or anyway see everything you enter in a form. One nice example was facebook color changer;P

... And that is a problem with password managers why? It doesn't matter who enters the credit card, you or your password manager, those would still get it.

So I ask again, why not?

Re: The anatomy of a credit card form

#107

Post by abhorrence »

stonogo wrote: post #95
mseebach wrote: post #55

Earlier quoted context omitted.

As opposed to most other text input fields you encounter in the wild, credit cards (and phone numbers) have a singular canonical format. As long as you don't limit HOW it's entered (or pasted), it makes a lot of sense to coerce the input into the canonical format.

They most certainly do not have a singular canonical format. American Express cards use different groupings and a four-digit card security code.

At least for the US, the issuer of a credit card (and thus the format) can frequently be determined from as little as the first digit. For instance, nearly all card numbers starting with '4' are Visa.

Re: The anatomy of a credit card form

#109

Post by david-given »

tommorris wrote: post #97
junto wrote: post #68

Earlier quoted context omitted.

The worst thing about these programs is the liability shift. Normally the merchant is left on the hook for fraudulent transactions. With VbV and 3DS that liability passes back to the credit card company. Since the credit card company doesn't want that liability, and obviously there are no security holes in their system, then only one person can be responsible for not taking adequate care of their card and security de…

Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.

I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it.

If you know how to opt out of it, I'd love to know.

Re: The anatomy of a credit card form

#110

Post by david-given »

joosters wrote: post #75
tommorris wrote: post #46

Earlier quoted context omitted.

> UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions. Ahh, 3D Secure/Verified By Visa/MasterCard SecureCode. It really needs to die right now. Basically it teachers consumers to fill in random iframes on merchant sites. And the fact that the card industry thinks 3D Secure is secure or in any way a good idea is why they'll never make s…

Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!

Worse than that, it's all bounced through a site called securesuite.co.uk. Take a look:

https://securesuite.co.uk/

Impressed?

Post reply on HN