9 ms·

These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe wil

These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe will have encountered this system before and will be more suspicious if they don't see it! Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenticate a list of CC numbers. Personally, I don't give my real birthdate to any website unless they have a very good reason for knowing it. My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc. But since the actual authentication mechanism is left up to the card issuer, there's nothing to prevent them using more advanced systems - like 2-factor authentication, hardware tokens, etc.

bemmu 11y ago
How do you use the collected birthdate to reduce fraud?
- Reason077 11y ago
  Nobody collects the birthdate. It would be validated by the card issuer against their account records. The merchant doesn't see anything that happens during the 3D-secure part of the transaction.
Amezarak 11y ago
> My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc. How can the bank know what any of the letters in your password are unless they are storing it insecurely?
- pfg 11y ago
  They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose. It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 characters, so you'd have the full password after 3 attempts.
  - Reason077 11y ago
    It's not consecutive characters, it's a random set of three. One time it might ask me for the 1st, 6th, and 8th characters. The next time for the 6th, 7th, and 9th. Passwords are required to be at least 8 characters and contain a mix of letters and numbers. Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.
    - Amezarak 11y ago
      This further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all. The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.

bemmu 11y ago

How do you use the collected birthdate to reduce fraud?

Reason077 11y ago
Nobody collects the birthdate. It would be validated by the card issuer against their account records. The merchant doesn't see anything that happens during the 3D-secure part of the transaction.

Amezarak 11y ago

> My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc. How can the bank know what any of the letters in your password are unless they are storing it insecurely?

pfg 11y ago
They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose. It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 characters, so you'd have the full password after 3 attempts.
- Reason077 11y ago
  It's not consecutive characters, it's a random set of three. One time it might ask me for the 1st, 6th, and 8th characters. The next time for the 6th, 7th, and 9th. Passwords are required to be at least 8 characters and contain a mix of letters and numbers. Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.
  - Amezarak 11y ago
    This further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all. The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.