Construct 2 Desktop Games collect Credit Card Information?

Discussion and feedback on Construct 2

Post » Tue Sep 29, 2015 7:48 pm

I just got information about a serious topic:

When you export a game via node.js, in the folder C:\Users\USERNAME\AppData\Local\NameofApp a file is created that is named WebData. If you rename this file into Webdata.txt, the following content can be found:

/tablemetameta CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'; indexsqlite_autoindex_meta_1meta[ƒ tableautofillautofillCREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, date_created INTEGER DEFAULT 0, date_last_used INTEGER DEFAULT 0, count INTEGER DEFAULT 1, PRIMARY KEY (name, value))/C indexsqlite_autoindex_autofill_1autofillN'gindexautofill_nameautofillCREATE INDEX autofill_name ON autofill (name)t?indexautofill_name_value_lowerautofillCREATE INDEX autofill_name_value_lower ON autofill (name, value_lower)‚%%ƒKtablecredit_cardscredit_cardsCREATE TABLE credit_cards ( guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '')7K% indexsqlite_autoindex_credit_cards_1credit_cards ‚i //…tableautofill_profilesautofill_profiles CREATE TABLE autofill_profiles ( guid VARCHAR PRIMARY KEY, company_name VARCHAR, street_address VARCHAR, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zipcode VARCHAR, sorting_code VARCHAR, country_code VARCHAR, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', language_code VARCHAR)A U/ indexsqlite_autoindex_autofill_profiles_1autofill_profiles ; 99‚tableautofill_profile_namesautofill_profile_names CREATE TABLE autofill_profile_names ( guid VARCHAR, first_name VARCHAR, middle_name VARCHAR, last_name VARCHAR, full_name VARCHAR)~ ;;tableautofill_profile_emailsautofill_profile_emails CREATE TABLE autofill_profile_emails ( guid VARCHAR, email VARCHAR) ;;tableautofill_profile_phonesautofill_profile_phonesCREATE TABLE autofill_profile_phones ( guid VARCHAR, number VARCHAR)n;;utableautofill_profiles_trashautofill_profiles_trashCREATE TABLE autofill_profiles_trash ( guid VARCHAR) [/noparse]

It seems like there is credit card information seeked?

I suppose this is phone/mobile related content, still, it's kinda worrying for me. Could you please bringt light into this issue?
B
5
S
1
Posts: 33
Reputation: 462

Post » Tue Sep 29, 2015 7:50 pm

You should ask http://nwjs.io/ really.
B
123
S
43
G
41
Posts: 846
Reputation: 28,204

Post » Tue Sep 29, 2015 8:01 pm

Node.js is delivered within Construct 2, so I think it's not that simple.
We're talking about credit card information here.
B
5
S
1
Posts: 33
Reputation: 462

Post » Tue Sep 29, 2015 8:16 pm

It just appears to be a template to ask for credit card info. Since nw.js is a browser at heart I could see why it's there as that's a common thing to have. At any rate it's no cause for alarm in my opinion.

Also I've never seen a nw.js game ask for credit card info and there's no way for it to get it unless you provide it when it asks.
B
92
S
32
G
106
Posts: 5,272
Reputation: 69,455

Post » Tue Sep 29, 2015 8:28 pm

I guess this can be used for monetisation, microtransactions, etc. And when it comes to online payments, a regular browser feature, I'd rather it to be part of a widely spread technology (Chromium/node.js) rather than having to rely on less-used 3rd party addons which are more likely to have flaws.
Image
Game Producer & Independent Developer - http://raphaelgervaise.com
B
23
S
9
Posts: 237
Reputation: 2,207

Post » Tue Sep 29, 2015 8:40 pm

dhoeke wrote:Node.js is delivered within Construct 2, so I think it's not that simple.
We're talking about credit card information here.


What? I'm saying that Scirra doesn't actually make NW.js (nor it's bundled by default with C2 anymore).

Your best bet is asking them directly, maybe using their Google Group.
https://groups.google.com/forum/#!forum/nwjs-general

I'm not saying what you're saying is not important, but you should talk to the right people about it.
B
123
S
43
G
41
Posts: 846
Reputation: 28,204

Post » Tue Sep 29, 2015 8:43 pm

@andreyin Sorry man, I didn't mean to be rude or ungrateful - yet, I was. Sorry about that!

Yep, I already took the opportunity to speak over there, too.
B
5
S
1
Posts: 33
Reputation: 462

Post » Tue Sep 29, 2015 8:44 pm

@R0J0hound and @Refeuh

What you're saying makes sense. Thank you for the fast and helpful replies, too.

I think I would feel more comfortable with an actual confirmation that it's actually just a passive, inactive template file by someone with insight... :)
B
5
S
1
Posts: 33
Reputation: 462

Post » Tue Sep 29, 2015 8:45 pm

dhoeke wrote:@andreyin Sorry man, I didn't mean to be rude or ungrateful - yet, I was. Sorry about that!

Yep, I already took the opportunity to speak over there, too.


No problem, I think I came out a little strong too. I really want to see how this turns out though, please post it here if you find anything about it!

I tried searching on their old google group about it too but apparently it's closed to the public or something. Too bad, there was a LOT of good info there...
B
123
S
43
G
41
Posts: 846
Reputation: 28,204

Post » Tue Sep 29, 2015 9:32 pm

Found this security report here from 2011:
http://arxiv.org/ftp/arxiv/papers/1112/1112.5760.pdf

Which tells what that file is for chrome:
Web Data:
SQLite file that contains Autocomplete form data in the autofill table; each
record contains the form field name and its value
Credit card data for e-payment Web forms in the credit_cards table

SQL is a way to access a database file somewhere on your pc.

So it's just for auto-complete, so unless you've used your game to get a credit card number before, the info isn't logged in that database.
https://support.google.com/chrome/answer/142893?hl=en
http://www.tomsguide.com/faq/id-1847774 ... hrome.html
B
92
S
32
G
106
Posts: 5,272
Reputation: 69,455

Next

Return to Construct 2 General

Who is online

Users browsing this forum: No registered users and 11 guests