In the latest release of Norton Security Suite 22.5.2.15 CVV field was removed from the credit card page. The reason for this change was given as:
The Credit Card Verification Value (CVV) field has been removed from your Wallet and the 3 or 4-digit number that is stored in the field has also been removed. We wanted to offer a more flexible Credit Card Comments field, that lets you choose the kind of useful credit card information that you want to store.
This is absolutely ridiculous reasoning for the change. It does not make sense whatsoever. It looks like a bug or some dumb design decision.
I have several problems with the motivation behind it.
1. If this is a security issue, it is very troubling, because Norton Identity Safe is marketed as a very safe and secure way of storing information. Now, if for some reason CVV data is not safe, how come all other data is safe? Makes no sense.
2. The suggestion that generic Comments field is improvement over dedicated CVV field holds no water. This way, why not to use the Comment field for everything including credit card number, expiration date, etc. Sounds stupid? That is what I mean. CVV field is as critical and as integral as credit card number and the expiration date. Without it, the payment page prefill does not work.
3. Before the change, the CVV field for security reasons was hidden. In fact, Symantec deemed it as the only field, which by default should be hidden. Now, the proposed alternative is to put CVV in the Comment field, which is not hidden.
4. The idea of the Comment field may be useful. But it should not be introduced instead of CVV or any other critical field. If it has to be a choice between CVV and Comment field the common sense should unequivocally choose CVV.
To conclude, the whole thing with CVV looks like a product defect and should be treated as such.