Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

I already gave Google my payment info, though, because I use Google Wallet. And I actually find that more secure, because IIRC the credit card number that is stored in Google Wallet is a virtual credit card number, not the real number that is printed on the physical card (which Rakuten Kobo would store).

Even when I buy books from Kobo, I never stored my credit card with them. I always bought gift cards and loaded the balance onto my account. That would occasionally get cumbersome, since the only vendor for those cards in the US used to be Wal-Mart, until they discontinued their relationship. Now I think Kobo might sell them directly out of Amazon.com--but either way, for the odd $2 and $3 purchases that I do on impulse buys (because a book may be on sale), just having it go through Google Wallet is much easier.

View on HN

> not the real number that is printed on the physical card (which Rakuten Kobo would store).

Citation needed!

In 2014 I worked for a small, unimportant ecommerce retailer. We migrated at around that time to storing only a token, using our payment processor (Braintree at the time) - and no longer kept any card numbers in our database whatsoever. If someone had dumped our 'credit_cards' table after that migration, they'd have nothing but useless garbage (the token could only be used by our own merchant account). I think even Braintree didn't need to store the card number itself either, but I'm not so sure of their internals.

Storing a payment card number in your database is considered an incredibly bad practice, is not PCI compliant, and probably violates other important "compliance" things you have to regularly certify as well.

My bank gives me virtual credit cards. Google is just unnecessary expensive middle man. But I live in Europe so US situation might be different.

Why would I want a virtual credit card - US law gives me strong fraud protection and so if my number is compromised I just call my bank and dispute the charges and then I get a new number.

Though I've never had the above happen. I've had a few times where my number was compromised but the bank found out and gave me a new card before whoever got the number was able to use it.

It's great and I'd say essential to have those protections, but a virtual card makes that whole thing much more efficient plus doesn't cause you to have to update your card on file with all the "good" vendors where you have it stored.

You can proactively decide when a card will expire and how much it can be billed ("Sure, NY Times, I'll take a subscription for the trial offer of $4 a month, so let's make sure this card only allows a charge of $4 every month and/or expires when that offer expires.")

I agree. In 20 years I've only had a single fraudulent charge on my card. I called my credit union and it was taken care of immediately. I don't need more, I don't want more. Google is trying to make me afraid to get my personal information.

Reply on news.ycombinator.com