It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
You can now store your card for later use.

When making any purchase with a credit or debit card, you can now select the option to save your card for later use.



If your payment is successful, that card will be remembered for later use. You'll be able to select it during your next checkout without retyping the info every time. Simple, straightforward, and probably very familiar.


We're taking advantage of tried and tested industry-standard solutions used across the world today. Among other things, this means your entered payment data isn't actually kept anywhere on GOG.com. Once your bank approves the purchase, your entered card number is replaced with a unique, encrypted token that can be used only by us to process your future payments, and which cannot be reverse engineered to resolve your card number and data. From time to time, we'll also ask you to verify your information based on a number of security factors, like if you haven't used that card in a long time.

While it's not required, we also strongly recommend enabling Two-Step Login before saving your payment details.

Keep in mind that you can easily remove your saved payment method through the My Account / Orders section. We'll also automatically invalidate all payment tokens for any account that hasn't been used in a long time.


We hope the feature turns out to be particularly useful soon, when you may just feel compelled to click really, really fast.
avatar
Johny.: How would you store info about 2-step then, if not in cookies? Based on IP? Then, if you would log in at - let's say internet coffee - in private mode, other person in that place (or local network) wouldn't be asked for the second step of verification. Did you encounter better solutions?
The super cookie, meaning the tracking technology that some advertising networks use: browser fingerprint -
https://panopticlick.eff.org/ -> test and see fingerprint results. Mine are always unique....

No! Don't do it! It's scary enough as it is...
avatar
Johny.: How would you store info about 2-step then, if not in cookies? Based on IP? Then, if you would log in at - let's say internet coffee - in private mode, other person in that place (or local network) wouldn't be asked for the second step of verification. Did you encounter better solutions?
Ideally there should be options in your account to configure the behavior. A persistent cookie could be one of the options, IP address (or range) another one, also the browser version or some kind of simple browser fingerprint (although that would require the possibility to store and authorize multiple browser fingerprints, like for the desktop computer and for mobile devices). But none of the options should be mandatory. Of course, changing these options should require an email confirmation (as changing the password of an account should do, which actually is my main security concern with GOG at the moment).

For me personally the IP address would be the best option as my home IP changes only very seldom. And regardless of where I am I also route the traffic of my mobile devices through my home IP (which I may have to disable when I once travel to Russia to make use of their discounts :P).

For other people the IP address may change daily, for them it wouldn't be a good option. They would want to chose the cookie option instead.

I never would use an Internet coffee for anything that's money related. With two step login activated you would have to access your GOG account and your mail account from the Internet coffee to authenticate yourself, not really a good idea. But even when I would do it I would be more concerned about keyloggers than by the absence of the two step login for someone else (he still would need my account password, and when he has snooped the account password he probably also has snooped the email password so the two step login doesn't help either).
avatar
toxicTom: Actually I don't get the cookie paranoia. Clearing everything on exit?
It's indeed about clearing everything, not only cookies. Browsers are too complex and there are just too many places where things are stored (cookies, LSOs, local storage, history, cache, ...) and can be requested remotely later.
avatar
toxicTom: Hacked accounts are probably the biggest weakness in this concept. But the current two-step auth should make this a lot harder.
No, it does not. When you hijack a users session you can change the email address of his account and request a new password for the account, which, when I understand it correctly, will be sent to that new email address. And then the account is yours, no matter if the two step login has been enabled or not.

Or did I miss anything?
Nice feature. I may use it.