Palemoon Browser and Banking

[Moggie]

I've just started banking with BMO and am having trouble getting Palemoon to remember my banking online login 'Remember my card'. This feature worked find with my previous banks on Palemoon, but for some reason isn't working on the BMO online banking page. I just tried it with Firefox Portable and it works fine remembering my card number.

I'm using Windows 7 and the fully installed Pale Moon browser. Any help would be welcomed.

[Moonchild]

It depends on how the card number is requested, but I believe there is a safeguard in the form fill code we inherited from Mozilla that prevents recognized CC numbers from being stored as-is in form history (since that won't be protected by anything).

[Moggie]

Hi,

It's a debit card/bank card, not a credit card. According to BMO, the 'remember card number' is supposed to work. They suggested my browser was the problem. As I said, the Firefox browser remembers the card number, so I believe the issue is with Pale Moon.

The BMO login page looks like that of any online banking system. There are two entry lines. The first line asks you to enter your bank card number. Right below it there is a little box you can check if you want it to remember your number. This number will show up encrypted, but for the first and last digits. (The second line asks for your password.)

As my home computer is a trusted PC, I have always used the check box to remember my card number. I currently use this feature with CIBC and it has always worked fine. I'm in the process of switching banks now and can't get this 'remember' feature to work on the BMO site.

[Moonchild]

It depends on if your debit card is issued by a credit card company or not, and/or if the card number has characteristics of a CC.
If so, then this behavior is "by design". It is quite possible that Firefox has done away with this restriction over time.

the "encrypted" display is display only. It's obviously not encrypted, just has the display of it masked. But what is passed on to the bank login won't be masked, of course, and that is the actual "log in" that would normally be stored in plain text in form history. That is a risk.

I looked up the bug and it's bug #188285 where this check was introduced (a very long time ago). This has been an integral part of form history security for the longest time.

[Moggie]

I understand full well that the number is encrypted on the screen only and is not encrypted as far as the bank reading the card number goes.

I don't see saving my card number as a 'risk', because anyone sitting at my PC and accessing that page would still need to know my password to access my online banking. I NEVER save passwords to banking or other financial sites, and have never had a security issue in choosing to have a banking site remember my card number in the decade and more since I have been using this feature.

Cheers

[Moonchild]

"Someone" doesn't have to sit at your PC or know your password for your online banking. Someone can get to the stored data and download it (e.g trojan, virus), and it will have your full credit card number stored in plaintext to use; since form history commonly also includes full name and address data, that tends to be enough to use the card number for illegitimate purchases...

As such, it's a common sense precaution for the browser to recognize CC numbers and not store them in history.

[John connor]

Try the add-on informenter. https://addons.mozilla.org/en-US/firefo ... src=search