5 ms·
Do consumers all have little usb smartcard things so they can use the smartcard to make online purchases? or does this mostly just make 'card present' transact
by lsc 11y ago
Do consumers all have little usb smartcard things so they can use the smartcard to make online purchases? or does this mostly just make 'card present' transactions that much safer?
- hrrsn 11y ago3D Secure basically redirects you to a webpage run by a third party (usually your bank) to enter additional details, like a seperate password. I find it much more annoying. My New Zealand (.co.nz) bank redirects me to a .co.uk domain with their logo (!!), where it doesn't even prompt me for any additional details, just forwards back to the original merchant.
- lsc 11y agohuh. yeah, there's a 'verified by visa' thing that America has that is similar... I think it does some statistical something something. It sure looks a lot weaker than a public key transaction where the key never leaves the card. The 'verified by visa' site itself looks pretty fishy. In theory, a chip and pin solution where the user owns the reader is more secure than a transaction in the store where the vendor owns the reader. but, I guess that's too expensive and inconvenient or something.
- cowsandmilk 11y ago"Verified by Visa" is 3-D Secure. https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
- xyzzy123 11y agoIt is likely that they are processing a risk score for your transaction, based on browser fingerprint, referer, ip, time of day and so on. That is, the "bounce" may not be entirely useless. If the risk score exceeds a certain threshold then they can then require additional security. While this may seem very weak, in practice a lot of fraud has pretty obvious signatures.
- hrrsn 11y agoFair enough. Just having a .nz bank direct me to a .uk domain is a huge red flag for anyone that bothers looking at this sort of thing
- the_mitsuhiko 11y agoWhen 3dsecure just redirects it means the bank decided to trust the transaction based in something. For instance for me it skips it for some known vendors and transactions.
- deleted 11y ago[deleted]
- the_mitsuhiko 11y agoMy Austrian bank embeds a 2FA system on the iframe. I get an authentication code on my phone and enter that. It typically asks that when shipping to a new address or dirst use of a vendor that uses 3dsecure
- gst 11y agoWhile 3DSecure and Verified by Visa is a good idea in theory, the implementation is a mess. For example, my bank requires me to enter my banking username and password into the banking website, which is loaded via an iframe inside the merchants site. How is a regular user supposed to verify that the iframe loaded his banking website and not some phishing website?
- the_mitsuhiko 11y agoSounds like a problem with your bank. Mine prompts me for a token that is sent to my phone where it also shows me what transaction i confirm. In addition the iframe pops up a memorable message I can configure to verify that it's a frame from the bank. Even in the absence of ssl this would be safe.
- Natanael_L 11y ago> In addition the iframe pops up a memorable message I can configure to verify that it's a frame from the bank. Even in the absence of ssl this would be safe. No, they can do a replay attack on this setup when not encrypted
- the_mitsuhiko 11y agoIt's a transaction bound short lived one time token. Nothing you can replay.
- Natanael_L 11y agoThe memorable message isn't.