514125 - Heuristically detect credit card numbers and don't save them in form memory

Status: RESOLVED DUPLICATE of bug 188285

(Toolkit :: Form Manager, enhancement)

Description

[Zack Weinberg (:zwol)]

It might improve user security to avoid saving credit card numbers in the form autocomplete memory.  The primary benefit I see is that malware running on the  computer could not trawl the database for such numbers.  It might also help in situations where a computer is casually shared (i.e. nobody has bothered to set up profile or user-account isolation or history clearing on exit), such as a family computer where the parents would really rather their 12-year-old child not buy things online without permission.

There's no surefire way to detect credit card numbers, but we could do heuristics on the field name and/or <label> (look for "credit", "card", "account", etc), and we could also simply avoid remembering 20-digit numbers that obey the credit-card-number checksum rule.

Comment 1

[Dave Garrett]

I do agree with you, but this is a long old dupe.