Kryptronic Software Support Forum

rachaelseven · 02-23-2006 19:39:37

I've been having a very strange effect in my FireFox browser on my home machine, ever since I started using CCP51. Allow me to explain...

When I visit our ccp driven website from the home machine and run a test transaction, I find that FireFox has somehow captured some of my customer's information. You know how when you're filling in a form field and the little list drops down with all the things you've typed in that field before... well when I fill in fields on the site checkout, my little list has things my customers have typed in those spots that I've never typed myself! If I choose the PayPal checkout (on the paypal site), my dropdown lists for those form fields has all their information there too... even credit card numbers! Sometimes, when I try to fill in a form on a completely unrelated site, if the field has the same name as one on the ccp site (address1, for example), my list might give me choices of customer's information there too.

For the sake of debugging information, the CCP driven website is actually running on a host far, far away - the affected machine is only used to access the admin area, check the site for functionality, and FTP updates to the scripts. So the "link" is very indirect somehow, which is what really has me confused. In addition to the sheer confusion of it all, it's rather worrisome from a security standpoint - customer's credit card numbers and other information are somehow being transmitted to FireFox's list of stored form data on my home machine and I have no idea how... but I seriously doubt it's a secure link.

Has this ever happened to anyone else? Can anyone explain why? Is there a way to stop it? It makes things rather annoying when I try to buy something on a website and I get a list with 50 different last names pop up instead of just my own. I know I can clear the stored form data (with the associated loss of all the conveniences), but why does this happen in the first place and how do I stop it?

Vexedly yours,
Rachael

dtwg · 02-23-2006 20:11:59

Hi Rachael,

Check out this thread. Not sure if that's what's happening with you, but maybe...

Good luck,

Dave - dtwg

celdirect · 02-23-2006 21:33:52

Rachael

the same is happening to me - I had a customer with last name (lets call him - Bloggs) order from me.

and the name Bloggs appears in the drop down box for last name on ccp.

Like you I know i have never typed that in that field or anyother ever on this PC.

strange

Charlie

rachaelseven · 02-23-2006 21:55:10

Hi Dave - that's not quite the same issue as I'm having, but thanks for the link, it was very close to my problem.

I have an idea about how some of this is occuring: When I click the order update link for a given order, a form is opened with the customer's information already filled in. Then, I can amend the information, change the status, etc, and submit the form. It's possible that the browser is taking that form submission and storing the field values for future use. That would explain the checkout fields on our site having drop down lists with customer information in them.

That wouldn't explain the fields on PayPal's site having customer-populated drop down lists though. The customers' credit card numbers are never stored in CCP (I do only online processing), so there is no way that same mechanism is responsible for that behavior. And it's very disconcerting... anyone have any theories about how that is getting in there?

Rachael

Ed_H · 02-24-2006 01:53:20

This is a head scratcher! What version of Firefox is this and do you have any of the auto-fill extensions installed?

osluk · 02-24-2006 04:20:30

Does the same happen in IE? Or any other browser?
I have had strange behaviour before but not enough to replicate.
Cheers Chris

rachaelseven · 02-24-2006 07:43:14

Currently FF version 1.5.0.1, but was also happening with previous versions. I don't think I have any extensions installed currently that would cause it. I did have an auto-fill extension until pretty recently, so I suppose that could help explain captured fields from the order management. But I still don't get how I can capture fields that I've never even seen (like CC numbers on PayPal's site).

I can't seem to replicate the problem in IE - I hate the thing, so I rarely use it, but it didn't seem to show any evidence of unexpected information.

Rachael

Ed_H · 02-24-2006 11:17:03

It seems very difficult to find even to this.

When you are on an 'Update Online Order' does the credit number show up as a hidden field in the source code as
<INPUT TYPE="HIDDEN" NAME="tracking_cardnum" VALUE="blah">

Seems like Firefox or an auto-fill type extension would have to be grabbing and saving a hidden field from that page and populating subsequent similar fields with it.

rachaelseven · 02-24-2006 12:44:04

Thanks for the link, Ed - that's about the closest reference I've seen. I think you're basically right about grabbing a form field, either hidden or visible; but I'm still at a loss for the cc numbers. Since I use online processing (paypal pro and standard methods), the numbers are never stored at all. And when I try a test transaction using the paypal standard method (on the paypal site), I'm sure my saved form entries list contains credit card numbers that I've never typed. Baffling. Oh well, I'll just keep clearing things to kill the security risk and not worry about it.

Rachael

osluk · 02-24-2006 15:52:54

Rachael,

Just so I have this straight you have cached in your local browser, a dropdown field is poulated as if you have made the payments but the payments have only been entered in a secure session once the client has left your server and are making payment on a remote site (I dont even want to mention the CC word) included.

If that is the case it has to be a very starange set of circumstances as it doesn't seem right at all! If you can replicate it there might be a market there, to our friends on the dark side.

The only common factor is CCP and the clients browser. They are on your site they order they are transferred for payment they are returned. So their browser and CCP are surely in some way involved in the cause.

FF is then in some way seeing this information as a result of we dont know what. It doesnt even seem CCP is in really in the frame as the user has by that time passed to the remote server - I think.

Cheers Chris

rachaelseven · 02-24-2006 17:19:09

I'm stil trying to replicate the situation. I think it may have been a few isolated cases. I've been trying to pour through my records and see if and when those cc numbers might have been entered on this machine, maybe when I took phone orders or something. I know the vast bulk of the information is getting cached as a result of my using this browser to access the admin area and FF is then seeing the form fields containing the customer's information and caching it. I think maybe the remote site stuff is a fluke, but I'm still testing.

Rachael

osluk · 02-25-2006 05:50:13

Can you tell FF never to remember data for a given site?

I think you can for passwords.

I would say that short of something really really odd - taking a local phone order or a postal order or someone phoning because they messed their online order and it being entered locally - has to be the most likely explanation.

Cheers Chris

Ed_H · 02-25-2006 11:30:58

In FF 1.5 you can disable form completion.

Tools > Options > Privacy

Uncheck 'Save information I enter in forms and the Search Bar'

It would probably be a good idea to also 'Clear Saved Form Data Now' at least until this is diagnosed.

celdirect · 02-25-2006 11:34:04

Hi,

I have this problem too with FF - We do not take orders over the phone or post all orders are automatic.

it must be picking up the info when you view the orders in admin.

dont have a problem with CC info showing

charlie

rachaelseven · 02-25-2006 11:35:25

Thanks for the advice. I've cleared the stored data and added an extension to FF that allows me to blacklist certain form fields/sites so the data there doesn't get saved. Hopefully that will take care of the problem.

Rachael

Kryptronic Software Support Forum

#1 02-23-2006 19:39:37

Firefox Storing Customer Information

#2 02-23-2006 20:11:59

Re: Firefox Storing Customer Information

#3 02-23-2006 21:33:52

Re: Firefox Storing Customer Information

#4 02-23-2006 21:55:10

Re: Firefox Storing Customer Information

#5 02-24-2006 01:53:20

Re: Firefox Storing Customer Information

#6 02-24-2006 04:20:30

Re: Firefox Storing Customer Information

#7 02-24-2006 07:43:14

Re: Firefox Storing Customer Information

#8 02-24-2006 11:17:03

Re: Firefox Storing Customer Information

#9 02-24-2006 12:44:04

Re: Firefox Storing Customer Information

#10 02-24-2006 15:52:54

Re: Firefox Storing Customer Information

#11 02-24-2006 17:19:09

Re: Firefox Storing Customer Information

#12 02-25-2006 05:50:13

Re: Firefox Storing Customer Information

#13 02-25-2006 11:30:58

Re: Firefox Storing Customer Information

#14 02-25-2006 11:34:04

Re: Firefox Storing Customer Information

#15 02-25-2006 11:35:25

Re: Firefox Storing Customer Information

Board footer