Hacker News Reader

Comment by legrande | Hacker News Reader

> The second payload of the noblesse family is an “Autocomplete” information stealer. All modern browsers support saving passwords and credit card information for the user:

> Browser support for saving passwords and credit card information

> This is very convenient, but the downside is that this information can be leaked by malicious software that got access to the local machine.

I never store CC deets anywhere, not even in a secure password manager vault. I typically manually type it out from the card, as I rarely use a CC (Every month or so I use it). I can see why automatically filling in CC info would be useful for people who use their CC a lot.

If I was using it a lot, I would use a non-browser password manager however, since browser secrets can be exfil'd via various means and I trust a non-browser password manager vault more.

View on HN

Credit cards are insecure by design and worrying about having them stolen from your browser or vault is not worth it in my opinion. You're far more likely to have it compromised from the retailer side no matter how careful you are. Also, it's easy to set up a notification on your phone for every time a card is used, so you can report fraud before any harm is done.

Some online banks (don't know how widespread this is) allow you to create "virtual card" that expire either after 1 purchase or at a specific date (and with a set maximum of budget). I use them for every single purchase I make online, it's inconvenient but at least i've never entered my real card info anywhere.

That sounds like a lot of work. At least in the US you are not responsible for fraud. (I think the law may have like a $50 liability thing, but Visa/MC waive). So it's better to just not do this, and every 3-4 years when my CC is stolen, call them up - dispute the charges, get a new number. Takes < 5 minutes and I keep going.

For what it's worth, the 2 times my number got stolen in the last 6 years, one was from a rogue agent at a hotel in Chicago, and one was from a bad website that stored credit cards.

> That sounds like a lot of work.

My bank has a browser plugin that can create virtual cards with just a few clicks.

> dispute the charges, get a new number. Takes < 5 minutes and I keep going.

This isn't the case for me, it would take me quite a bit of time over a period of several weeks to update all of the places i use my card if I were using the same number everywhere and it was compromised. I handle a lot of billing. I've had cards compromised at least three times in the past and it's very unpleasant. (for me)

In Portugal, you basically open the app, scan fingerprint to give permission and get a new card.

You can even scan the card via webcam or copy the details to clipboard.

The virtual card also limits itself either to single transaction or single store so it can't be used even if compromised on store level.

It's pretty simple process (<30sec) and it's really useful.

Privacy (dot) com offers that as a service and you can use their extension to generate a card without leaving the page.

Exactly this. I just assume my credit card will be stolen or leaked. Nearly every credit card has zero liability protection too so there is no use in worrying, this is why I use credit cards.

Liability and protection provided by credit cards is one of the reasons some people suggest using them and never using a debit card. Easier to get money back if it gets stolen from a credit card (assuming some YouTube video I saw was accurate).

I definitely want to avoid having my credit card details stolen. The inconvenience of calling the bank to report fraudulent transactions and then waiting a few weeks for a replacement card to arrive is something to avoid if you value your time.

I save most passwords in the browser, including discord, but not important things like banks and emails. Password manager for that. I think it's foolish of Chrome to offer to save CC details.

In the US, CC has, by law, almost no liability for fraud - it's capped at 50 bucks, and is 0 bucks if you report it before it gets used. They are also easily replaced, so i think many wouldn't go as far as you are.

Debit cards are weirder in their liability (and are extracting money from your bank account, which is harder to get back).

If you report them lost/stolen before someone uses them, it's 0 bucks Within 2 days of learning about it, it's 50 bucks. More than 2 days, but less than 60, 500 bucks. More than 60 days - unlimited liability.

So i'd be a lot more careful with debit cards, at least in the US.

(You are never liable on either for unauthorized transactions when your card is not lost/stolen as long as you report them within 60 days)

Hmm. I understood this to be different, but realizing now I don’t have sources for where I learned this:

* Bank accounts, savings accounts, brokerage accounts, etc. are all unlimited liability

* Lines of credit are all zero liability

I’ve used this as a rule of thumb for many years, and was the initial reason for me switching to 100% credit cards for transactions.

Yeah, i'm telling you based on what the statutes say (the FCBA covers credit cards, the EFTA covers debit)

A short version of it is here: https://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cr...

I would never ever use a debit card outside of the ATM of the bank I belong to.

Credit card? Go wild, use it everywhere.

I use CC for everything. Shop tons online, multiple sites . Store my CC on browser and share that across desktop, laptop, ipad and phones.

In last 10 years I've had one incident were CC company did not automatically deny fraud. Two purchases both refunded to me.

I've been thinking I should probably just memorising my card number. Would take a bit of effort but can't be much harder than memorising a phone number, and possibly faster than entering my master password to unlock my password manager

I’ve done it a number of times without even trying. Problem is if you have to replace it a lot.

I've memorized my last 2 credit card numbers. Takes about 5-10 minutes and is absolutely worth it!

What I like about the Mac implementation of storing credit cards is that it requires using touch ID to autofill the credit card info. There's no autofill without explicit user interaction.

Reply on news.ycombinator.com