PC Alamode
Reviews Columns Features Archives

 PC Alamode

I Want Your Credit Card Number
and I'm Looking Over Your Shoulder!

Susan Ives is a former president of Alamo PC.


They’re just trying to make life easier. Really. Newer versions of Microsoft Internet Explorer and Netscape Navigator — the most popular Internet Web browsers — have memories like elephants. Forget your password? They’ll remember it for you. Forget your credit card number? Ditto.

If all of your computing is done from home, this probably isn’t a big problem. But if you ever send e-mail from a friend’s computer, use your credit card to buy something online from a public terminal at the library, or check your bank balance from the office machine, you are making yourself vulnerable. Very vulnerable.

Newer versions of both browsers — version 6.0 and above — remember stuff. When I log into one of my Web-based e-mail programs, for example, all I have to do is click once on the entry box for user name, and (in Internet Explorer, at least) a drop-down menu appears that lists all the e-mail addresses I have ever entered before. When I select the correct address, the password is automatically entered. Whoa Nelly!

Only once — but once was enough — I typed in the first digit of my credit card onto a site and the rest of it was automatically filled in. The numbers weren’t even masked — they were there for all the world to see.

Automatic credit card completion seems to be an unintended feature on the Alamo PC online registration form in Internet Explorer. If you want to test it, here’s how.

Using Internet Explorer (it won’t happen in Netscape Navigator), go to this page. Note that the URL begins with https. The “s” means secure.

Scroll down to the bottom of the form where it asks for a credit card number. Type in a random string of numbers.

Click on the submit button. You will get an error message because you didn’t fill out all the fields. Now, shut down Internet Explorer. Open it up again and go back to that same page it should be blank. Now pretend you are the next person using a public terminal.

Scroll down to the credit card block and double-click on it. That random string of numbers you typed in should appear in a drop down box for all the world to see — and use. On this form, at least, every bit of data you type in is stored, so our mythical rubbernecker will have all the information they need to steal your credit card number.

I have read that in some public terminals hackers have surreptitiously installed keystroke recording programs that record and transmit every keystroke to the crooks. This apparently has been more of a problem in Europe, where more people use public terminals, but it could happen here.

So here’s my advice:

First, NEVER do online banking from a public terminal. The risks are too great. If you are that carefree with your money, just send it all to me and avoid the middleman. I will put it to good use.

Second, if you are using a public terminal — any computer that strangers may have access to — ALWAYS log out after you are finished using a site that requires a user name and password. Think about it. Do you read your e-mail on a Web-based system such as Hotmail? Do you have personalized pages on portals like Yahoo, mysan antonio.Com or Quicken that might contain confidential information such as your stock portfolio? If you walk away from a terminal and are still logged into a site the next person can see, change and use this information.

Third, if you are entering a user name and password or (even worse) a credit card number from a public terminal, clear the password cache before leaving the computer. Here’s how to do it:

Internet Explorer: On a public terminal. always answer No to IE's prompt to remember your password. If IE is already set to store passwords, you can clear the passwords and turn off that feature as follows: From the Tools menu, select "Internet Options...", then select the Content tab. In the Personal Information section, click on "AutoComplete...". Then click on "Clear Passwords", and OK to the "Clear all previously saved form passwords" prompt.

Netscape Navigator: From the Edit menu, select "Preferences...", then select the Web Passwords subcategory under the Privacy & Security category. In the Password Manager section, click on "View Stored Passwords", then click on "Remove All", to clear all previously saved form passwords. Click OK to return to the Password Manager section.

If you can’t get to these screens, odds are that the computer you are using has an older version of the browser installed that doesn’t have the “remember” features. On just about any software you can check the version number by clicking on the HELP tab then selecting ABOUT… For Internet Explorer and Netscape Navigator, only versions 6 and above have the persistent memory.

Your privacy is precious — protect it!


Copyright© 1996-2010
Alamo PC Organization, Inc.
San Antonio, TX USA