Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The anatomy of a credit card form

medium.com

Post reply on HN
Print view View original

31–40 of 129 posts

Re: The anatomy of a credit card form

#31

Post by provemewrong »

tomp wrote: post #2

> “My card number has spaces. Do I enter my card number with spaces, or without?” To solve for this, we limit the input values to numbers only, so 0–9. So if a user types a space, it does not register and it does not affect the number format. They failed, at the most important part of the form. The correct, i.e. the most user friendly solution is, obviously, to allow spaces (and optionally other characters, like "-,.…

Yeah, seriously. The expiry date field fails as well.

>Note that the placeholder text includes a “/”, but this is not required to be typed by the user. We limit the input value to numbers only, so if a user does type a forward slash, it is not registered.

Frankly, I'd prefer that field to be split into two, but I'd be fine with a single field, if they didn't ignore slash. It's pretty annoying to see a form silently fail and ignore characters that the form itself seemingly required (by showing them in the placeholder). A cluster of numbers like 0515 for date is not very intuitive either.

In my opinion much better way is to allow characters like spaces, dashes and slashes, show them when they are typed, but strip them on validation and further operations, working with only numbers.

Re: The anatomy of a credit card form

#32

Post by nothrabannosir »

leni536 wrote: post #19

> Is this form safe and secure? We just add a lock icon, sure it's secure. Lock means secure, right? Joke aside sure, it's not the designer's fault. Every time I fill out a credit card form without even pulling out my card I cringe. Why do I need a physical credit card for this, I just authenticated myself with only something I know and not something I own and I know. And my authentication credentials are just writte…

Mastercard SecureCode does this. I'm seeing it more and more. My bank implements it using hardware 2fa; a separate dongle that reads my CC, asks for my PIN and a transaction salt (or QR scan) and computes some hash (?) from it.

It's actually very frustrating when I don't have the 2fa device on me.

Re: The anatomy of a credit card form

#34

Post by prof_hobart »

>But we realized that the credit card number is not a “secret”. You can’t do much with just a card number.

I think I know what they're trying to get at in the context of the form, but this doesn't do much for my confidence in how much care they take in protecting my number at the backend.

Re: The anatomy of a credit card form

#35

Post by pjc50 »

kuschku wrote: post #24
leni536 wrote: post #19

> Is this form safe and secure? We just add a lock icon, sure it's secure. Lock means secure, right? Joke aside sure, it's not the designer's fault. Every time I fill out a credit card form without even pulling out my card I cringe. Why do I need a physical credit card for this, I just authenticated myself with only something I know and not something I own and I know. And my authentication credentials are just writte…

Well, they actually do that – you could just pay per wire transfer (Überweisung) if you live in the SEPA, especially in DACH it’s more common. Bank-Authenticated direct-debit (like giropay.de) is also useful for this.

Interesting. I was going to say "there's no web UI for driving the SEPA system from a merchant's site", but is that what Giropay is?

Bank authentication systems themselves aren't great here in the UK. I'd be much happier with a USB/Bluetooth gizmo that behaved like a chip+pin terminal+card combo: display the value on the device, confirm payment with a pin/password on the device, bypass the PC's possibly-compromised keyboard and display entirely.

Re: The anatomy of a credit card form

#36

Post by leni536 »

nothrabannosir wrote: post #32
leni536 wrote: post #19

> Is this form safe and secure? We just add a lock icon, sure it's secure. Lock means secure, right? Joke aside sure, it's not the designer's fault. Every time I fill out a credit card form without even pulling out my card I cringe. Why do I need a physical credit card for this, I just authenticated myself with only something I know and not something I own and I know. And my authentication credentials are just writte…

Mastercard SecureCode does this. I'm seeing it more and more. My bank implements it using hardware 2fa; a separate dongle that reads my CC, asks for my PIN and a transaction salt (or QR scan) and computes some hash (?) from it. It's actually very frustrating when I don't have the 2fa device on me.

Yeah, I know MasterCard SecureCode. I have two bank accounts, one bank implements it using 2fa and uses SMS as the second factor, still no need for the card. The other bank doesn't implement it at all. And you still have to enter your credit card info, while the actual authentication actually has little to do with it.

Re: The anatomy of a credit card form

#37

Post by pjc50 »

TheOtherHobbes wrote: post #20

UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions. I don't think this form is going to work with those banks. A couple of takeaways: 1. This has been a standard problem for twenty years now. Why are designers and developers still having to reinvent the wheel? 2. Reinventing the wheel is really hard. If you want to support internation…

This is why people use payment gateways.

Re: The anatomy of a credit card form

#38

Post by Kiro »

> Nothing beats tapping/swiping your card at a physical terminal. Zero typing required.

What does tapping mean? And in what countries do you swipe nowadays? I also need to type in my pin so wouldn't say zero typing.

Re: The anatomy of a credit card form

#39

Post by pjc50 »

jordigh wrote: post #23

Ever since we've had cryptography, money on the internet has always seemed unnecessarily clunky to me. Everyone should have a password, then it's just a matter of encrypting who has how much money. While people make fun of how "fake" bitcoins are (as if any other money were not just a slightly more consensual mass hallucination), I really do like how they have demonstrated that internet money can be a lot more conven…

Bitcoin has shown how critical the fraud problem is. Between wallet loss and exit fraud by bitcoin companies, bitcoin users have lost vast amounts.

Re: The anatomy of a credit card form

#40

Post by namdnay »

Kiro wrote: post #38

> Nothing beats tapping/swiping your card at a physical terminal. Zero typing required. What does tapping mean? And in what countries do you swipe nowadays? I also need to type in my pin so wouldn't say zero typing.

Maybe "tap" refers to NFC payment? You can usually pay small sums by NFC in Europe.
Post reply on HN