It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
You can now store your card for later use.

When making any purchase with a credit or debit card, you can now select the option to save your card for later use.



If your payment is successful, that card will be remembered for later use. You'll be able to select it during your next checkout without retyping the info every time. Simple, straightforward, and probably very familiar.


We're taking advantage of tried and tested industry-standard solutions used across the world today. Among other things, this means your entered payment data isn't actually kept anywhere on GOG.com. Once your bank approves the purchase, your entered card number is replaced with a unique, encrypted token that can be used only by us to process your future payments, and which cannot be reverse engineered to resolve your card number and data. From time to time, we'll also ask you to verify your information based on a number of security factors, like if you haven't used that card in a long time.

While it's not required, we also strongly recommend enabling Two-Step Login before saving your payment details.

Keep in mind that you can easily remove your saved payment method through the My Account / Orders section. We'll also automatically invalidate all payment tokens for any account that hasn't been used in a long time.


We hope the feature turns out to be particularly useful soon, when you may just feel compelled to click really, really fast.
Do people not read the OP? Maybe GOG should write in huge bold letters from now on :P
avatar
dfcressw: Some of the posts here are unbelievable. It's an optional feature, and they are NOT storing your card info, even in encrypted format, just a token. Having been through this myself, it doesn't even open up GOG to a higher level of PCI compliance than what they were doing previously (pass-through).

There is still a danger of a hack getting your card info - a hack on the bank or service issuing the token, not a hack on GOG. I will not be using the feature myself because of this, but in no way does that have anything to do with GOG, and is a global issue for ANY site or bank offering this kind of feature.

And for the conspiracy theorists talking about putting in 2-factor authentication, site-wide HTTPS, and now remote card storage.. being in software and web development myself, I can understand a push to "modernize" security and payment options without it being fueled by a desire to siphon away your money.

Thank you GOG developers for your hard work. Now as others have mentioned, please bring on the OLD games :)
My god, someone reasonable.
"We hope the feature turns out to be particularly useful soon, when you may just feel compelled to click really, really fast."
Guys, the blue's are hinting at something really nice that everybody is talking about, wallets shiver,and usually at this time of the year ;) soooo.... Cheers.
high rated
I approve. It's more secure than typing the card number every time, considering I often buy games at work.
high rated
I agree that it is actually more secure for the people who enter their credit card number each time. Every time you do that, you could have malware on your system logging your keystrokes. I'm not sure if I'll use this feature, but it's arrival doesn't frighten me.
Edit: Nevermind. :)
Post edited March 17, 2016 by Cyraxpt
avatar
Vestin: What the fuck do you people actually want?
avatar
omega64: A pony.
That... Can be done. Would you settle for cute woodland creatures BEATING THE CRAP OUT OF EACH OTHER?
I think a pony will the among them at some point...
Post edited March 17, 2016 by Vestin
low rated
avatar
hedwards: Plus, they promised they'd never do this (...)
avatar
Vestin: They promised never to generate tokens ;)?
Seriously, I can't believe the degree of illiteracy in the comment section. Between people who are convinced that they will now store credit cards and those who believe straight-up hashes are the solution, there seems to be little hope for reading comprehension.
Entering the number can be a risk. Tokens mean that it can be done once. The credit-card number cannot be retrieved from the token, so it's just a GOG-limited option to pay using the same method as initially. It's optional, can be revoken, the website supports two-step verification to weed out suspicious activity... What the fuck do you people actually want?
I take it you don't know what the term "semantics" means.

As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
avatar
Vestin:
avatar
hedwards: As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
When did that happen?
avatar
omega64: A pony.
avatar
Vestin: That... Can be done. Would you settle for cute woodland creatures BEATING THE CRAP OUT OF EACH OTHER?
I think a pony will the among them at some point...
No I won't settle, give me my pony.
Post edited March 17, 2016 by omega64
low rated
avatar
Tonnemaker: I agree that it is actually more secure for the people who enter their credit card number each time. Every time you do that, you could have malware on your system logging your keystrokes. I'm not sure if I'll use this feature, but it's arrival doesn't frighten me.
If you already have malware on your system then you're fucked as the thieves can just steal the log in information for the bank website.

It also means that anybody that breaks into your account can use your CC token to gift themselves games. Yes, that's rather far-fetched, but it's definitely possible.
avatar
hedwards: As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
avatar
omega64: When did that happen?
I'm not sure exactly, but by the time of that first insomnia sale they were already doing it. Basically, you have to be here logged in at all times if you want to get the deals, so no work and no sleep either if you don't want to miss the deals. The time machine sale was pretty bad for that as well, the only game I would have bought was in the first hour, and there were periods where I'd be at work or a sleep and wouldn't even have the option of buying those games.

All in all, it's pretty clear that GOG doesn't respect us at all anymore. Certainly not to the extent they did early on.
Post edited March 17, 2016 by hedwards
high rated
avatar
Vestin: They promised never to generate tokens ;)?
Seriously, I can't believe the degree of illiteracy in the comment section. Between people who are convinced that they will now store credit cards and those who believe straight-up hashes are the solution, there seems to be little hope for reading comprehension.
Entering the number can be a risk. Tokens mean that it can be done once. The credit-card number cannot be retrieved from the token, so it's just a GOG-limited option to pay using the same method as initially. It's optional, can be revoken, the website supports two-step verification to weed out suspicious activity... What the fuck do you people actually want?
avatar
hedwards: I take it you don't know what the term "semantics" means.

As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
What was 'the way it was'? When they only sold old games, had a fraction of the sales they do now and probably a fraction of the user base? GoG was never this white knight in shining armor you make them out to be. They are a store and a business, trying to stay alive and relevant in an industry that eats up the small guys. Offering something of convenience isn't 'selling' out, it's offering things that make them stay competitive. It's also things that most buyers prefer.
high rated
avatar
dfcressw: Some of the posts here are unbelievable. It's an optional feature, and they are NOT storing your card info, even in encrypted format, just a token. Having been through this myself, it doesn't even open up GOG to a higher level of PCI compliance than what they were doing previously (pass-through).

There is still a danger of a hack getting your card info - a hack on the bank or service issuing the token, not a hack on GOG. I will not be using the feature myself because of this, but in no way does that have anything to do with GOG, and is a global issue for ANY site or bank offering this kind of feature.
Have a +1 for one of the informed posts from fellow jack-of-all-trades dev (mainly web for last year or two). While I won't be using it, it's not for a fear of gog being hacked from outside. Security theory behind this is sound, it's widely used in other authentication scenarios ("log in with google account", or Facebook come to mind). Only issue I see is trusting GOG to have good security practices to eliminate risk of bad employee abusing this. Even then, it would be more of an annoyance than a threat if someone did abuse it - it's only good for purchases on gog, which gog could easily refund, after sacking the ones responsible. It's much more secure than anything I have ever encountered in e-commerce so far, certainly better than entering the number manually every time. And since it is optional, I don't see what the fuss is about.
low rated
avatar
hedwards: I take it you don't know what the term "semantics" means.

As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
avatar
synfresh: What was 'the way it was'? When they only sold old games, had a fraction of the sales they do now and probably a fraction of the user base? GoG was never this white knight in shining armor you make them out to be. They are a store and a business, trying to stay alive and relevant in an industry that eats up the small guys. Offering something of convenience isn't 'selling' out, it's offering things that make them stay competitive. It's also things that most buyers prefer.
Their whole marketing strategy for the first few years was that they were this white knight that was different and it's not just that they've changed it's that they continue to lie about it. They insist that their core values aren't the core values that they claimed to have previously.

Changes for the worse are bad enough, but lying about it is rather pathetic. And it greatly reduces my interest in buying games from them.

And yes, it is selling out. They aren't offering it because it's convenient, they're offering it for predatory reasons. The insomnia sale is probably coming up. A time when people are going to be tired and likely to buy something in order to justify having stayed up late to see if there was something they'd want to buy. Adding that kind of a convenience is pretty much designed as a way of taking advantage of people.

All in all, I'm really disgusted and disappointed with the way they've sold out. They're barely any better than Valve at this point and getting worse.
Post edited March 17, 2016 by hedwards
high rated
avatar
hedwards: I take it you don't know what the term "semantics" means.
I have a Philosophy degree, Hedwards. I'm not cringing because I fail to understand; I'm cringing because I see through.
The spirit and the letter are served here. Even if you disagree with the solution, it remains optional, so you're not forced to use it. All I see are attempts at making everything more secure AND more free.
You've been here almost as long as I have. I see that you are angry, but I know that you are also reasonable. Be honest with yourself - are you blaming them for what they truly have done here, or were you already angry with them, and this just gave you another reason to vent your frustration?
There are issues to be dealt with, and having every announcement met with grumbling of disapproval will just make eventual legitimate worries all the less impactful. People will just get (partially) dismissed as the unpleasable crowd of permanent whiners.
If you take issue with the current solution and would like to point people towards a better or more secure one, I'm sure everyone would gladly hear you out. Otherwise, you have the option to ignore this new feature or make use of it and utilize whatever security it provides.

avatar
hedwards: As for "us people" we want GOG back the way it was before they sold out. Back when they actually respected us and didn't treat us like walking wallets.
That's vague as hell, and you know it. I might as well tell you that I have seen them, and that they are good people.
No, literally, I went there a few years ago.
I disagree with the whole concept of "selling out" anyway. They got a little more popular; they are expanding their business bit by bit, and things are going quite well. There are certain objections I have, and I'd prefer to see improvement in certain areas, but the doom-and-gloom approach is just not justified.
It's not selected by default, that is good, however I would like an option to disable this feature altogether.