Digikey Website Security Issue

[BobEllis]

Be aware that the credit card information you enter on Digikey's site is stored by Internet Explorer's autocomplete feature - completely open. I went to check out on another website and found my credit card number and CCV code a click away.

Anyone using your computer will be able to access your credit card information, including the security code, unless you clear your autocomplete file.

When I complained to Digikey's webmaster, I was told "just turn off autocomplete" When I told them that autocomplete is handy, other sites are able to replace the characters or prevent autocomplete from remembering the entry, and I might take my business elsewhere if I had to mess with my settings to use their site they said they'd look into it. Nothing has changed in the 5 weeks since I complained.

[jackinnj]

i like to talk to the girls at DK -- as you can imagine, it gets cold in Minesooooootaaaaaaah in da winter.

[poobah]

I don't think Digi-Key can do anything about it... that info is in your computer.

Auto complete should always be off. And when "Would you like to remember this password?" pops up... say NO.

Having that info stored is how data-miner viruses get the info?

[BobEllis]

I never store passwords for places I spend money, but it's nice not to have to log in to DIYAudio and others.

Yes, the information is on my computer, but there are sites that require entry of card information each time - and the autocomplete list never pops up when entering. I know nothing about html programming, but it seems to be possible to prevent autocomplete recognizing that a field is a field so nothing is stored.

[jackinnj]

how does Amazon do their auto-complete?

[poobah]

I am certainly no expert here... I make it a point to learn as little as possible about Windows etc... (well, sort of).

Some of my software buddies are pretty adamant about not letting your computer "know" anything.

Maybe some experts will come along here...

[jacco vermeulen]

Originally posted by jackinnj
i like to talk to the girls at DK

Jack,
that explains why you dress up.
Personally, i like to clean-sweep my hard drives once a week for all tits and bits. (yeah, programming and system control bought my meals once)

[poobah]

Bob,

You can easily set up your computer for multiple user's. You log in to your user which can also be the administrator. You can create a user called "guest" with limited powers... they can't see your stuff or autocompletes.

[BobEllis]

Amazon requires that you re-enter your password before going to checkout. Great for those who accidentally checked "remember me." They would love to store your credit card on their servers so you can one click your way to spending, but they let you opt out.

Digikey will let you just proceed to checkout without using your account and you can click on the credit card number box to bring it up. What really got me concerned was going to a site that I had never visited and finding my credit card info available in their form.

The other "feature" of Digikey's site is that it automatically remembers your login unless you manually log out. Simply closing the browser window isn't good enough. All you need to do is click the log in button and you're in if you didn't hit the log out link.

I guess I am going to have to give up autocomplete for forms.

Password protecting your user account in XP is a good idea. It's a pain to wait so long to get to the point that you can enter the password and then wait the same time to get to usable state.

My concern was if my laptop gets stolen. My son knows he'll be in for it if he uses my credit card without permission.

[poobah]

Yep, that laptop is an issue.

There's a program called Winternals ($1200) that can crack into any machine... its for repair pro's... but you know the bad guys have it too.

Best to keep your laptop "dumb" as possible. Keep the wife pictures off of there too!

I never let a computer leave the house here without the hard drive flat as a pancake... data can be recovered from a reformatted drive... so I'm told anyway.