News for hackers. Stuff that matters.

A comment on Harvesting credit card numbers and passwords from websites. Parent comment

Re:Harvesting credit card numbers and passwords from websites by saryant on Saturday January 06, 2018 @01:36PM (#16086721)
This is why, when I recently built a credit card form, we didn't include any trackers or third-party code (beyond our vendor's). No dependencies at all—our vendor also has no dependencies in the JS we use to implement the CC form.

That did mean no jQuery, no Google Analytics, no NPM modules and we had to build it as a standalone page outside our React setup, but it's worth it to be able to definitively inspect every line of code and provide a CSP that locks that page down tight to just our subdomain and our vendor's.

[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by cesarb on Saturday January 06, 2018 @05:02PM (#16087724)
That's the same as protecting just the login page with https. What prevents code outside the form page from replacing the link which goes to the form page?
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by martin-adams on Sunday January 07, 2018 @02:35PM (#16092211)
Exactly my thought. I guess that would mean it would need some intimate knowledge of the target site this reducing the scalability of the attack. But then again, thee are some clever people out there who could automate it.
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by bsilvereagle on Saturday January 06, 2018 @05:52PM (#16087939)
Why not host a validated version of jQuery on your server instead of relying on a CDN?
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by bubble_boi on Saturday January 06, 2018 @07:16PM (#16088272)
Thanks for this. I've added a note to the post. "...consider having dedicated, lightweight pages for login and credit card collection that don’t ship any third party code (npm packages, advertising, analytics, GTM, etc.)"
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by monokrome on Monday January 08, 2018 @03:24AM (#16095407)
Here's hoping you do the same for your login form! :D
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by awq123 on Monday January 08, 2018 @09:27AM (#16096886)
Incredible
[ Parent | on HN ]
Re:Harvesting credit card numbers and passwords from websites by aristeol2000 on Monday January 08, 2018 @11:29AM (#16097803)
very interesting!
[ Parent | on HN ]