An HTML attribute potentially worth $4.4M to Chipotle • Hacker News Board

Re: An HTML attribute potentially worth $4.4M to Chipotle

#31

Post by Leftium » Thu, Sep 26, 2019, 3:46 PM UTC

slg wrote: post #22

Side question, does not displaying the credit card number and CVV provide any real security value? An overwhelming majority of sites that accept credit cards don't do that and I can't say I have ever been worried about that fact. At least the expiration year is displayed to the user so it is possible to notice if something is entered incorrectly And considering the expiration year masking issue only impacts people wh…

Aside from not displaying it, the browser will also not autofill/cache the sensitive information for future visits.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#32

Post by Kye » Thu, Sep 26, 2019, 3:49 PM UTC

kayfox wrote: post #2

In the race to use fancier and fancier tools to make web user interfaces go I think we loose out a lot by avoiding the browser's inbuilt support for these things. Like how eBay's new search feature does not allow me to click in it and type in one motion. I have to click, wait for it to redraw without the magnifying glass, and then click again to put the cursor where I wanted it, before editing the query. Or how some…

The remapping of middle click is a scourge. I want it to open a new tab, not behave like a left click or do nothing.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#33

Post by boomlinde » Thu, Sep 26, 2019, 5:00 PM UTC

a0zU wrote: post #30

I understand why maxlength would be appealing but it takes the hacking skills of a fourth grader to change it in the browser's html and submitting any number that they'd like.

So? That is true for either client side option, which is why you need server side validation as well.