3 ms·
Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada. It's nearly impossible for normal user
by scoates 11y ago
Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada.
It's nearly impossible for normal users to verify that they're sending their password to their bank, and not to the merchant.
Training users to send merchants sensitive bank passwords is a step backwards.
- 5h 11y agoTrue, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.