Chrome needs to understand when an <input type="password"> field is used for verification numbers on credit cards (CVC). It has a local heuristic which is not particularly reliable. It has no automatic ways to generate autofill server hints about CVC and for parsing password forms currently also ignores manually added field classifications as CVC.

This tracks the work to improve Chrome's reliability in detecting CVC fields. There is a (Google-only, because talking about internal server support) design doc: https://docs.google.com/document/d/15VCazN-8FjeApxK66zoidLEgbJMGNAWekR22vfVxeDA/edit?usp=sharing

The steps tracked here are the following:

(1) Finish the above design and get it approved.

(2) Ensure that CREDIT_CARD_VERIFICATION_CODE hints from the server lead to <input type="password"> fields being ignored by password manager.

(3) Add overrides for popular sites with this issue (see blocked bugs), if needed.

(4) Teach Chrome to send a CREDIT_CARD_VERIFICATION_CODE vote for forms which have a "password" field with 3-4 digits values and another field classified as credit card number.

(5) After some time after (4), check that the data gathered on the server leads to correct predictions.

(6) Optionally, also add sending the CREDIT_CARD_NUMBER vote, if we see that it would improve the current quality of classifying CC card numbers (which is already high) and not lead to reinforcing bad classifications.
 

Chrome needs to understand when an <input type="password"> field is used for verification numbers on credit cards (CVC). It has a local heuristic which is not particularly reliable. It has no automatic ways to generate autofill server hints about CVC and for parsing password forms currently also ignores manually added field classifications as CVC.

This tracks the work to improve Chrome's reliability in detecting CVC fields. There is a (Google-only, because talking about internal server support) design doc: https://docs.google.com/document/d/15VCazN-8FjeApxK66zoidLEgbJMGNAWekR22vfVxeDA/edit?usp=sharing

The steps tracked here are the following:

(1) Finish the above design and get it approved.

(2) Ensure that CREDIT_CARD_VERIFICATION_CODE hints from the server lead to <input type="password"> fields being ignored by password manager.

(3) Add overrides for popular sites with this issue (e.g., bug 770708), if needed.

(4) Teach Chrome to send a CREDIT_CARD_VERIFICATION_CODE vote for forms which have a "password" field with 3-4 digits values and another field classified as credit card number.

(5) After some time after (4), check that the data gathered on the server leads to correct predictions.

(6) If data looks good (check, in particular, if bug 860700 was fixed), remove the IsFieldCVC-related code from components/password_manager/core/browser/form_parsing/form_parser.cc.

(7) Optionally, also add sending the CREDIT_CARD_NUMBER vote, if we see that it would improve the current quality of classifying CC card numbers (which is already high) and not lead to reinforcing bad classifications.