Closed Bug 448847 Opened 16 years ago Closed 16 years ago

complete 16-digit credit card number memorized on fill-in form

Categories

(Firefox :: Security, defect)

x86
Windows XP
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 188285

People

(Reporter: philip-b, Unassigned)

References

()

Details

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 The form "Credit Card Number" entry is memorized. If someone were to steal my memorized forms information cache, they would have my credit card. Note that I set options to clear cache at the end of every FF session, so this information is persistent. Reproducible: Always Steps to Reproduce: 1. Make a reservation for a SuperShuttle van pickup (e. g. to the Airport). 2. Pick your pickup time. 3. Click on the button to make the reservation and pay with a credit card. 4. Fill in the fields on the "Payment" screen, using autocomplete as much as possible Actual Results: My credit card number was memorized, so that I could auto-complete that field entry just by typing the first digit of the card number. Expected Results: I expect that I would have to fill in the entire c/card number, as I do on other sites. I should _not_ see my credit card number autocompleted. If you want, I can send you a screen shot. But you can try to do this yourself. Make a reservation, and proceed until you get to the Payment Window. It won't cost you anything if you don't click on the "Pay" button.
Please don't send me a screenshot -- I don't need your credit card number :)
Group: core-security
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
I'm not sure if bug 188285 mentions it, but this data is not stored in the web page cache so clearing the cache doesn't affect it. The "Clear Private Data" dialog has a separate "Saved Form and Search History" item that will clear saved form data.
You need to log in before you can comment on or make changes to this bug.