111–120 of 129 posts
> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...
> There goes Australia and their 4 digit zip codes... To say nothing of Iceland, the Faroes or Madagascar (3 digits) let alone Jamaica (2 digits, and only in Kingston and St Andrew elsewhere there's no zip code) or Somalia (2 letters)
Earlier quoted context omitted.
basically there are tons of browser plugins which listens to your keyboard, or anyway see everything you enter in a form. One nice example was facebook color changer;P
... And that is a problem with password managers why? It doesn't matter who enters the credit card, you or your password manager, those would still get it. So I ask again, why not?
Earlier quoted context omitted.
Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.
I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it. If you know how to opt out of it, I'd love to know.
Earlier quoted context omitted.
... And that is a problem with password managers why? It doesn't matter who enters the credit card, you or your password manager, those would still get it. So I ask again, why not?
About the plugins, you are right, it's weak anyway, my bad. To better answer your question this is a paper explaining some critical vulnerabilities in the concept of password managers (let alone the implementation) http://devd.me/papers/pwdmgr-usenix14.pdf
Earlier quoted context omitted.
Judging from the screenshots with filled inputs, they automatically add spaces making the card number look exactly like it is on the physical card. https://medium2.global.ssl.fastly.net/max/800/1*QzxyS4KGIvCw...
The live demo linked flat the end of the blog post makes a feeble attempt to insert a space after the first 4 digits, but ultimately fails (on Firefox 38 on Windows).
Earlier quoted context omitted.
Well, they actually do that – you could just pay per wire transfer (Überweisung) if you live in the SEPA, especially in DACH it’s more common. Bank-Authenticated direct-debit (like giropay.de) is also useful for this.
BTW, DACH here is presumably the trilingual abbreviation "Deutschland, Austria, Confoederatio Helvetica", i.e., Germany, Austria and Switzerland.
> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...
I wonder if they have customer beyond US/Canada that they mention. Otherwise this would fail spectacularly in other countries in general (eg, UK: both letters + numbers, Taiwan: 3 digit zip code)
Too many or few characters, like you point out as the case for Taiwan, would be the problem.
> “My card number has spaces. Do I enter my card number with spaces, or without?” To solve for this, we limit the input values to numbers only, so 0–9. So if a user types a space, it does not register and it does not affect the number format. They failed, at the most important part of the form. The correct, i.e. the most user friendly solution is, obviously, to allow spaces (and optionally other characters, like "-,.…
For postal codes, they're even doing the right thing for the wrong reason. They believe they're only going to encounter US or Canadian postal codes. Billing addresses can be anywhere, of course.
... Except I don't have a zip code. Which usually meant I either had to prepay inside (and then go back inside to receive the remaining balance as cash) or leave my credit card unattended with the clerk while I filled.
> “My card number has spaces. Do I enter my card number with spaces, or without?” To solve for this, we limit the input values to numbers only, so 0–9. So if a user types a space, it does not register and it does not affect the number format. They failed, at the most important part of the form. The correct, i.e. the most user friendly solution is, obviously, to allow spaces (and optionally other characters, like "-,.…
Right now, the only "does this credit card number look right" validation they do in JS is to look for a known prefix digit, and the length of the number. Otherwise the send it to the server for processing.
This is silly. In 1954, the Mod 10 (AKA Luhn Algorithm) was designed specifically to catch people mistyping in account numbers and all credit cards use it. It's a check digit, where the last digit of your credit card number is based on the all the other numbers. It catches transposed digits, and mistyped digits, which are super common when asking a human to type in 15+ digits.
Earlier quoted context omitted.
Another example of doing it wrong is when the form splits the cc number into 4 separate boxes, and automatically skips along merrily to the next box as you type it in. This might look nice and everything, but usually breaks if you try to backspace your entry, or paste etc
Also, dealing with AMEX screws up a lot of forms. 15 numbers, 4 then 6 then 5. Yes, only 3 groups. And the CVV2/CVC2/CID is on the front and four digits, not three.