Credit Card number format (in view mode)
Hello, I'd love to see credit card numbers displayed with spaces every 4 chars when in view mode. This would make it much easier to eye-track when reading a credit card to someone over the phone (making a hotel reservation, etc.).
Comments
-
Hi Alex,
Thanks for taking the time to write in! You should be able to add either spaces or dashes to your credit card number to make it easier to read. 1Password will strip those out when copying and pasting. I've just tested here and it seems to behave properly, but please do let me know if you're seeing something different. :)
0 -
Thanks for the workaround, but it would be great if 1Password would do the work for me.
0 -
Hi Alex,
I'll be sure to let our developers know that you'd appreciate a more spaced out view for your credit card numbers. :)
0 -
I'd like this too. Adding spaces or dashes makes copy/paste problematic in many web forms, esp. those that truncate beyond, say 16 characters.
0 -
You should be able to add either spaces or dashes to your credit card number to make it easier to read. 1Password will strip those out when copying and pasting. I've just tested here and it seems to behave properly, but please do let me know if you're seeing something different.
In my experience, blanks in credit card numbers are stripped by 1P/Mac but not by 1P/iOS. The usefulness of this feature is severely limited if it does not work across all platforms.
0 -
You're correct, @benfdc
It's the same issue that you reported in Spaces in credit card numbers, which is filed as a bug and not an improvement. :)
internal reference number: OPI-1138
0 -
I posted about the problem in this thread because @Megan did not mention it and because the other participants in this 1P/Mac thread may not be aware of the other thread, which is in the 1P/iOS forum.
I am very pleased to learn that the issue has been escalated from a desirable improvement (as @JasperP and @bwoodruff characterized it in the other thread) to a bug.
This thread raises an interesting design issue—is it better to have the software strip out spaces that users add to enhance readability, or would it be better if numbers were entered without spaces but displayed by 1Password as though spaces were there? Or should you do both?
My preference has been stated repeatedly over the years—1Password should not be displaying these numbers at all, at least in the first instance. Credit card and bank account numbers (or at a minumum the leading digits of those numbers) should be obscured by default (and optionally revealed) in the same way that passwords and SSNs are obscured by default (and optionally revealed). Credit card and bank account numbers must be obscured (at least partially) for exactly the same reason that 1Password has always obscured SSNs. That reason—the regrettably common [mis]use of identification information for authentication—and its applicability to SSNs, credit card numbers, and bank account numbers, were explored in depth by @jpgoldberg in a blog post two years ago. Perhaps it is time for this “improvement” to be escalated to a bug. :)
p.s. The discussion link at the end of Jeff’s blog post is broken.
0 -
Hi @benfdc,
It is currently filed as an iOS bug. I searched through our issue tracker and did not find any mention of it affecting other platforms. (However, since I spend most of my day in the Mac/iOS forums, there is a chance I may have missed a report of it somewhere else.)
0 -
One user interface consideration (other than visibility) for credit card numbers -- Not all CC numbers are created equal.
Many cards display 4 groups: 4, 4, 4, 4, giving a total of 16 digits
Other cards display 3 groups: 4, 6, 5, giving a total of 15 digits
Yet other cards may have other formatsRather than burden 1Password with conditional display code, it should simply display CC numbers as entered, just like any other data.
0 -
With respect to treating Credit Card numbers as passwords --
I have found no eCommerce web sites that hide either datum upon entry.
Based on this web site behavior, the added risk is minimal.
I would rather the 1Password developers work on stability, bug fixes, and Yosemite/IOS8 compatibility.
0 -
Hi @xz4gb8,
Do you prefer the current behavior with 1Password for Mac that allows spaces and other characters in the card number field that are removed when the field is copied?
The field is already partly masked in the item list:
Like @benfdc, et al, I would prefer it and other "sensitive" fields to be fully masked in item details.
0 -
I had not really noticed before the way that card numbers are displayed in the item list. Interesting.
In my keychain, 1P/Mac displays all of the card numbers in the item list with the first four digits, some stars, and then the final four digits. But sometimes there are four stars, sometimes eight, and sometimes eleven. At first I thought that it might depend on whether or not I had included spaces when I entered an item’s card number, but that does not seem to be the case. Try as I might, I cannot detect a pattern.
0 -
Many cards display 4 groups: 4, 4, 4, 4, giving a total of 16 digits
Other cards display 3 groups: 4, 6, 5, giving a total of 15 digitsAll of my 4 – 4 – 4 – 4 cards have three-digit security codes, for a total of 19 digits.
All of my 4 – 6 – 5 cards have four-digit security codes, for a total of … well, you can do the math!Coincidence? I have absolutely no idea.
0 -
sjk asked, "Do you prefer the current behavior with 1Password for Mac that allows spaces and other characters in the card number field that are removed when the field is copied?"
Yes,
As pointed out before:
-- The CC# Display is for the convenience of the user. NO database program should alter an entered string arbitrarily.
-- Spaces are not part of the definition of the CC# string.
-- Typical web data entry forms accept CC# string with no spaces. Many reject CC# strings with embedded spaces. Some don't.
-- Current 1Password4 behavior is to copy only the contiguous digit string into the paste buffer,
---- resulting in a contiguous string of digits pasted into the web form and successful data entry.0 -
More about display/hide for Credit Card Numbers
Often, it is convenient to find and hover over a list element and hover until the popup allows clicking on an appropriate Copy button. This is equally true for many element parameters including, but not limited to, username, password, and CC#.
-- The full 1Password app helpfully displays the last four digits of the CC# in the list. This means differentiation of CC#s is easy but also means that the full app should be used only in more private surroundings.
-- 1Password mini and the browser extension lists do not display even the first 4 and last 4 digits which is good.
-- Hovering over any CC# list element does display the entered CC# field in clear text, which is not good, especially when the popup is anchored.
The last observation is the driving force for requesting default hiding of the CC# field as is done with the password field.
0 -
Thanks for the followups, guys.
In my keychain, 1P/Mac displays all of the card numbers in the item list with the first four digits, some stars, and then the final four digits. But sometimes there are four stars, sometimes eight, and sometimes eleven. At first I thought that it might depend on whether or not I had included spaces when I entered an item’s card number, but that does not seem to be the case. Try as I might, I cannot detect a pattern.
I've never seen more than four asterisks in masked card number fields displayed under the item list. And those fields are omitted entirely from the list when they contain 10 characters or less.
Do you have a sample field value that I can test here where you're see more than four asterisks there?
…
- Current 1Password4 behavior is to copy only the contiguous digit string into the paste buffer, …
Yup, and there seems to be no compelling reason to change that. :)
-- The full 1Password app helpfully displays the last four digits of the CC# in the list.
It appears to display any first and last four of over 10 characters in the field. Here are a couple atypical examples:
The first item's field has three spaces, then digits 123, then another three spaces. The second item's field is a copy of the first with first and last spaces replaced with a and z. Kind of like this:
123a 123 z-- Hovering over any CC# list element does display the entered CC# field in clear text, which is not good, especially when the popup is anchored.
>
The last observation is the driving force for requesting default hiding of the CC# field as is done with the password field.
It's not only when hovering. The concern for some folks, including @benfdc, is how certain fields are unconditionally fully displayed when details are visible for a selected item, in both the main application and mini.
0 -
If I may diverge on a rant, I can't wait until the US adopts "chip and pin" for credit cards.
I've already written about how credit card numbers make very poor authentication tokens because they were never designed to be such. Credit card numbers are easy to steal and the verification numbers are not that much harder. Mostly they are stolen from brick and mortar retailers. Hotel reservation systems are notorious.
Anyway, because of the terrible choice of using credit cards numbers as secrets, we are stuck now with them being routinely stolen. Sure the issuers are liable for the fraud, but the victim is put in a nasty position if they've set up automatic payments from the card. (I had to get a new credit card number in the beginning of June, and now half way through July I am still dealing with the problems.)
I recall a discussion in the late 90s about whether the UK and Europe (where credit cards were not so widely used) should go with "chip and PIN" and the improved security that comes with it or use a system that would remain compatible with what the US did. We all knew that it would be enormously expensive for the US systems to upgrade, but the consensus then was that the US would start to upgrade "in a few years". Well, it's been 15 years and requires an act to Congress.
0 -
After the Target breach, the tide of ambivalence has been shifting.
0 -
Interesting — I didn't realized chip cards aren't very widely used in the US. Here in Canada, pretty much all credit and debit cards have chips (they have for a couple years).
0 -
@JasperP—Even the chipped cards that are most readily available in the U.S. (I have two) are chip-and-signature, not chip-and-PIN. Change is in the air, but so far as I am aware the only way for a U.S. consumer to get a free chip-and-PIN card today is to join a credit union that caters to Americans who often travel overseas, most notably the State Department FCU (which pretty much anyone can join).
0
