4 ms·

As a US customer, I'm hesitant to use 3D Secure because: 1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look li

As a US customer, I'm hesitant to use 3D Secure because: 1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look like phishing: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf 2) My understanding is that my bank shifts liability to me for 3D Secure transactions. Why would I want extra liability?

TheSmoke 11y ago
in turkey, banks automatically enroll your debit or credit cards to 3d secure networks so you don't have to do it yourself. all you have to do is to enter a one time password sent to your mobile phone during payment. with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp. p.s. i am yet to read that link.
PhantomGremlin 11y ago
Yeah, "Verified by Visa" is exactly like phishing. Good paper. Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved. Do people encounter this on a daily basis?
- Symbiote 11y ago
  It's ages since I've seen it used in the UK, although not 10 years. More like three or four. (The redirect sometimes happens, but it's automatically approved.)
  - justincormack 11y ago
    I used it the other day. It did say 3d secure will change soon.
  - jtheory 11y ago
    I'm in France -- I still see it for almost 100% of the purchases I make online if the merchant is here in France, and a decent number of them when the merchant is in the UK. The last purchase I made with my bank card that got the interstitial page was about half an hour ago. It sends a text to my mobile for me to plug into the form to approve the txn -- thus, not like phishing in this case. But for a while this was a real nightmare because my mobile number changed, and I couldn't figure out how to convince my bank to store the new number (it turned out after many months and phone calls I was sending the requisite paper form to the wrong address for my type of account...).
    - TheSmoke 11y ago
      in turkey, any purchase online over 300 turkish liras must be 3D-secure. all debit and credit cards issued in turkey are automatically enrolled in the 3D-secure system. all 3D-secure transaction pages are hosted by issuer banks. they send us an SMS including a OTP and we enter it on the page and that's all.
- tormeh 11y ago
  Norwegian here. It's very common. It doesn't say "3D-secure" or "verified by visa", but logging in with your bank credentials (Bank-ID) sometimes feels like it's more common than not.
- derefr 11y ago
  Visa and co. are big—really big—so I've never understood why they've not just leaned on the OS manufacturers and browser makers to provide them some form of unique, unforgeable signal to users that they're interacting with a real bank. There could be, say, an HTML5-exposed API capable of triggering "super-modal" forms (like OS UAC does) if-and-only-if the page is being served from a secure origin cross-signed by some "Web Banking Working Group Certificate Authority" that all the banks and OS makers are members of.
  - danneu 11y ago
    Well, the more you rely on a strong signal like that, the easier it is to get phished by sufficient approximations.
  - MichaelGG 11y ago
    Eh they don't even bother with a real-looking domain name or a non-phishy form. Seems like they are too out of touch or simply not paying attention.
  - acdha 11y ago
    The better way to do this would be some sort of two-factor thing – e.g. imagine if the physical card had the equivalent of an embedded RSA-style one-time code generator or, better, a U2F USB/NFC device – which would be resistant to UI spoofing or, in the U2F case, phishing. Unfortunately the banks have less motivation to invest in this as long as the costs of fraud are pushed onto merchants and all of the major players charge similar fees. If something like Apple Pay starts to catch on, perhaps we'll see that change once the banks’ main concern is avoiding a single vendor getting too much market share.
    - Symbiote 11y ago
      Something similar was used in the UK for online banking, using a small reader [1]. It's a feature of EMV (chip) cards. [1] https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.jpg https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.j...
    - 11y ago
Vexs 11y ago
"with one (UK-government-owned) bank, two wrong password attempts simply lead to an invitation to set a new password." Good lord! Reading through this document is like reading a primer in how not to make a secure form.
- spb 11y ago
  Wait, what? Like, [Microsoft Bob][1] style? [1]: https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstrong-Running-Virtual-PC-and-Virtual-Machines https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstron...

TheSmoke 11y ago

in turkey, banks automatically enroll your debit or credit cards to 3d secure networks so you don't have to do it yourself. all you have to do is to enter a one time password sent to your mobile phone during payment. with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp. p.s. i am yet to read that link.

PhantomGremlin 11y ago

Yeah, "Verified by Visa" is exactly like phishing. Good paper. Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved. Do people encounter this on a daily basis?

Symbiote 11y ago
It's ages since I've seen it used in the UK, although not 10 years. More like three or four. (The redirect sometimes happens, but it's automatically approved.)
- justincormack 11y ago
  I used it the other day. It did say 3d secure will change soon.
- jtheory 11y ago
  I'm in France -- I still see it for almost 100% of the purchases I make online if the merchant is here in France, and a decent number of them when the merchant is in the UK. The last purchase I made with my bank card that got the interstitial page was about half an hour ago. It sends a text to my mobile for me to plug into the form to approve the txn -- thus, not like phishing in this case. But for a while this was a real nightmare because my mobile number changed, and I couldn't figure out how to convince my bank to store the new number (it turned out after many months and phone calls I was sending the requisite paper form to the wrong address for my type of account...).
  - TheSmoke 11y ago
    in turkey, any purchase online over 300 turkish liras must be 3D-secure. all debit and credit cards issued in turkey are automatically enrolled in the 3D-secure system. all 3D-secure transaction pages are hosted by issuer banks. they send us an SMS including a OTP and we enter it on the page and that's all.
tormeh 11y ago
Norwegian here. It's very common. It doesn't say "3D-secure" or "verified by visa", but logging in with your bank credentials (Bank-ID) sometimes feels like it's more common than not.
derefr 11y ago
Visa and co. are big—really big—so I've never understood why they've not just leaned on the OS manufacturers and browser makers to provide them some form of unique, unforgeable signal to users that they're interacting with a real bank. There could be, say, an HTML5-exposed API capable of triggering "super-modal" forms (like OS UAC does) if-and-only-if the page is being served from a secure origin cross-signed by some "Web Banking Working Group Certificate Authority" that all the banks and OS makers are members of.
- danneu 11y ago
  Well, the more you rely on a strong signal like that, the easier it is to get phished by sufficient approximations.
- MichaelGG 11y ago
  Eh they don't even bother with a real-looking domain name or a non-phishy form. Seems like they are too out of touch or simply not paying attention.
- acdha 11y ago
  The better way to do this would be some sort of two-factor thing – e.g. imagine if the physical card had the equivalent of an embedded RSA-style one-time code generator or, better, a U2F USB/NFC device – which would be resistant to UI spoofing or, in the U2F case, phishing. Unfortunately the banks have less motivation to invest in this as long as the costs of fraud are pushed onto merchants and all of the major players charge similar fees. If something like Apple Pay starts to catch on, perhaps we'll see that change once the banks’ main concern is avoiding a single vendor getting too much market share.
  - Symbiote 11y ago
    Something similar was used in the UK for online banking, using a small reader [1]. It's a feature of EMV (chip) cards. [1] https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.jpg https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.j...
  - 11y ago

Vexs 11y ago

"with one (UK-government-owned) bank, two wrong password attempts simply lead to an invitation to set a new password." Good lord! Reading through this document is like reading a primer in how not to make a secure form.

spb 11y ago
Wait, what? Like, [Microsoft Bob][1] style? [1]: https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstrong-Running-Virtual-PC-and-Virtual-Machines https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstron...