Construct 2 Desktop Games collect Credit Card Information?

I just got information about a serious topic:

When you export a game via node.js, in the folder C:\Users\USERNAME\AppData\Local\NameofApp a file is created that is named WebData. If you rename this file into Webdata.txt, the following content can be found:

/tablemetameta CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)';
indexsqlite_autoindex_meta_1meta[
ƒ tableautofillautofillCREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, date_created INTEGER DEFAULT 0, date_last_used INTEGER DEFAULT 0, count INTEGER DEFAULT 1, PRIMARY KEY (name, value))/C
indexsqlite_autoindex_autofill_1autofillN'
gindexautofill_nameautofillCREATE INDEX autofill_name ON autofill (name)t?
indexautofill_name_value_lowerautofillCREATE INDEX autofill_name_value_lower ON autofill (name, value_lower)‚%%
ƒKtablecredit_cardscredit_cardsCREATE TABLE credit_cards ( guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '')7K%
indexsqlite_autoindex_credit_cards_1credit_cards ‚i //
…
tableautofill_profilesautofill_profiles CREATE TABLE autofill_profiles ( guid VARCHAR PRIMARY KEY, company_name VARCHAR, street_address VARCHAR, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zipcode VARCHAR, sorting_code VARCHAR, country_code VARCHAR, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', language_code VARCHAR)A U/
indexsqlite_autoindex_autofill_profiles_1autofill_profiles;99
‚tableautofill_profile_namesautofill_profile_namesCREATE TABLE autofill_profile_names ( guid VARCHAR, first_name VARCHAR, middle_name VARCHAR, last_name VARCHAR, full_name VARCHAR)~;;
tableautofill_profile_emailsautofill_profile_emails CREATE TABLE autofill_profile_emails ( guid VARCHAR, email VARCHAR) ;;
tableautofill_profile_phonesautofill_profile_phonesCREATE TABLE autofill_profile_phones ( guid VARCHAR, number VARCHAR)n;;
utableautofill_profiles_trashautofill_profiles_trashCREATE TABLE autofill_profiles_trash ( guid VARCHAR) [/noparse]

It seems like there is credit card information seeked?

I suppose this is phone/mobile related content, still, it's kinda worrying for me. Could you please bringt light into this issue?

You should ask http://nwjs.io/ really.

Node.js is delivered within Construct 2, so I think it's not that simple.

We're talking about credit card information here.

It just appears to be a template to ask for credit card info. Since nw.js is a browser at heart I could see why it's there as that's a common thing to have. At any rate it's no cause for alarm in my opinion.

Also I've never seen a nw.js game ask for credit card info and there's no way for it to get it unless you provide it when it asks.

I guess this can be used for monetisation, microtransactions, etc. And when it comes to online payments, a regular browser feature, I'd rather it to be part of a widely spread technology (Chromium/node.js) rather than having to rely on less-used 3rd party addons which are more likely to have flaws.

Node.js is delivered within Construct 2, so I think it's not that simple.

We're talking about credit card information here.

What? I'm saying that Scirra doesn't actually make NW.js (nor it's bundled by default with C2 anymore).

Your best bet is asking them directly, maybe using their Google Group.

https://groups.google.com/forum/#!forum/nwjs-general

I'm not saying what you're saying is not important, but you should talk to the right people about it.

andreyin Sorry man, I didn't mean to be rude or ungrateful - yet, I was. Sorry about that!

Yep, I already took the opportunity to speak over there, too.

R0J0hound and Refeuh

What you're saying makes sense. Thank you for the fast and helpful replies, too.

I think I would feel more comfortable with an actual confirmation that it's actually just a passive, inactive template file by someone with insight...

andreyin Sorry man, I didn't mean to be rude or ungrateful - yet, I was. Sorry about that!

Yep, I already took the opportunity to speak over there, too.

No problem, I think I came out a little strong too. I really want to see how this turns out though, please post it here if you find anything about it!

I tried searching on their old google group about it too but apparently it's closed to the public or something. Too bad, there was a LOT of good info there...

Found this security report here from 2011:

http://arxiv.org/ftp/arxiv/papers/1112/1112.5760.pdf

Which tells what that file is for chrome:

[quote:2572s6z3]Web Data:

SQLite file that contains Autocomplete form data in the autofill table; each

record contains the form field name and its value

Credit card data for e-payment Web forms in the credit_cards table

SQL is a way to access a database file somewhere on your pc.

So it's just for auto-complete, so unless you've used your game to get a credit card number before, the info isn't logged in that database.

https://support.google.com/chrome/answer/142893?hl=en

http://www.tomsguide.com/faq/id-1847774 ... hrome.html

andreyin

Alright, thank you again!

R0J0hound

Awesome, this explains it. I can sleep much better now although the file did actually appear kinda "template-ish".

Thanks a lot, man!