14

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the credit card numbers:

enter image description here

My questions are a few :

  1. Is it possible for to breach Google Chrome and take my credit card information?

  2. As per my understanding the credit card number is not stored with any type of encryption, so is it really secure to store in autofill data?

How does Chrome handles this type of data? I agree it's good in terms of usability to store and fill the credit card details, but I doubt its not good in terms of security.

Improve this question
2
  • You can enable client side encryption in Chrome by setting a password in your sync options. That will secure the password on transit and on the server. Still vulnerable on the client.
    – Neil Smithline
    Jun 22, 2015 at 16:32
  • I would be concerned about what conditions trigger auto completion because if a website has an invisible "cc" and "cvs" fields, it might get auto completed and submitted to another website using JavaScript (XSS) without the user knowing.
    – Lewis Nakao
    Jan 10, 2018 at 22:40

3 Answers 3

Reset to default
11

Is it possible for breaching google chrome and take my credit card information?

Yes.

As long as Chrome can use your number for auto completion, it has to be possible for Chrome to access it. If one program on your computer can do this, another program or a least humans can do it too.

it's not stored with any type of encryption

Even with encryption, the statement above holds. Chrome would need the key, and this key has to be somewhere on your computer so that Chrome can use it.

As long as someone can physically access your computer, few things actually help. Encrypting your whole hard drive and taking the key away with you is one possibility. Downside 1: It´s a pain to insert flash drive and password each time to turn it on. Downside 2: If someone gets your computer while it is turned on, everything is futile again.

If you only want to protect against attacks form the internet, this is much better, but nonetheless there is no 100% protection. Not entering your card number (or any sensitive data) in the computer is the only reliable way.

Improve this answer
9
  • 2
    They could encrypt the information and require a password to access it instead of storing the key locally. Typing a password is still easier and faster than reading the credit card number, expiration date etc.
    – Ariel
    Jun 5, 2016 at 11:19
  • Do you have any piece of technical evidence to support what you are saying, or is this answer pure assumptions? I can see ways of implementing a safe CC storage off-computer, having the browser request the info from the server in an encrypted way. Not sure if it works this way, though, but I wouldn't speculate either way.
    – Seb
    Mar 5, 2017 at 3:32
  • @Seb It's not speculation, but just common sense plus some knowledge about computers. ... The feature basically is to write the (plain, readable) credit card data number into a HTML form when the user wants it. As long as this isn't changed, how could you ever hide the number from Chrome (and with it, other client-side access)? ... Sure, telling server A to ask server B for the number could be done, but that's something different (and it isn't supported by standards, browsers, servers, etc., and would imply huge privacy problems etc.)
    – deviantfan
    Mar 5, 2017 at 4:16
  • @deviantfan As I suggested, data can be stored in Google's servers, requested when needed.That doesn't mean it's saved locally. I think you misinterpreted my suggestion. I find it troubling that the accepted answer has no evidence whatsoever to support its statements, just "some knowledge about computers" and assumptions.
    – Seb
    Mar 6, 2017 at 7:44
  • @Seb And I find it troubling that you didn't understood my last comment. I'm talking about local autocompletion, that Chrome is using (period). If another solution is better wasn't the problem. For evidence, read Chromes code. You could also send me a computer and I get the numbers out of it, would that be proof enough? ... Btw., no, storing your credit card data on Googles servers is neither better nor allowed. If you want evidence, read about PCIDSS
    – deviantfan
    Mar 6, 2017 at 7:54
2

1) Yes, it is possible to breach Google Chrome. Even with the encryption, there would be somewhere password or private key.

2) It is not secure as not using autofill, however, you do not type in the autofill your CVV code, which is needed for a successful operation with the card. You can find more about CVV here: https://www.cvvnumber.com/

Improve this answer
1
  • 1
    CVV is not always needed (try Amazon, for example).
    – domen
    Jun 6, 2016 at 10:08
1

I started having my credit card info autofill in Chrome on my Android tablet. I could go into Chrome settings and turn off this feature, but if anyone got my tablet they would have access to the card info simply by turning autofill on again. The only way to get rid of this info showing up on my tablet was to go into my Google account and delete my card info. What a pain!

Improve this answer
1
  • 1
    Yes, as long as your CC is linked to Google Wallet it will be accessible to autofill via that on/off option in Chrome's settings.
    – jsejcksn
    Dec 7, 2015 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .