Hacker News Reader

Comment by Etheryte | Hacker News Reader

> User agents (e.g., browsers) facilitate the payment flow between merchant and user.

I'm very torn on how to feel about this. On one hand, it would be better than the current bonanza where every online shop has their own home-rolled thing for credit cards, on the other, I don't like the idea of having my CC info stacked on top of the already massive trove of data Google is gathering about me.

View on HN

Why not switch to a different browser then, such as Firefox?

Worth saying today Chrome already supports storing credit card details for auto-fill.

There is absolutely no way I would let Google (or any other browser provider for that matter) have a copy of my Credit Card Details.

Nobody is forcing you to do that. Your browser is very likely going to have a "Don't remember" option.

You're free to keep your credit card details in your password manager or type it out every time.

You do realise that storing them (be it Google, LastPass, or any other hopefully trusty manager) is safer than carrying them around on you, right?

The parent is concerned about privacy, not security.

Really? I remember over a decade ago credit card information was being stored in inputbox history in Firefox and they added patches to prevent from storing cc info. Of course that was a side-effect/bug of the autocomplete fields and I'm sure in Chrome it was a planned addition, but still...

That’s more a failure of the form creator as password fields were never persisted to the history. If you don’t tell the browser that the input is for sensitive data it won’t protect it of course.

Chrome can already manage CC data. If it recognizes a CC form, then it will prompt a dialog where you enter your CVV code and it will fill the form for you.

It’s opt-in though. This would effectively make it mandatory no?

No? It won't obliterate other forms of payment processing in the medium term. And I'd be very surprised if a "gpay is now mandatory for online shopping" monopoly was left to develop.

> every online shop has their own home-rolled thing for credit cards

Who is out there hand-rolling credit card auth?

Use Stripe, Paypal, Amazon, or something similar folks, PCI compliance is a nightmare.

> Who is out there hand-rolling credit card auth?

It's extremely common, and few of them get PCI compliance right. In my experience they usually just feed a website form directly into email.

This is your mom and pops, local bed and breakfast, small specialty store type websites. They hire someone to just make it work.

More to the point, aren't both Mozilla and Google looking to deprecate user agents? Why are new features being built on top of them?

They're deprecating the "User Agent String", but they are still considered "User Agents".

Ah, I mis-conflated. Thanks for the correction.

Reply on news.ycombinator.com