4 ms·

I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simpl

by anondon 10y ago

I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction. Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.

kalleboo 10y ago
There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps or hardware card readers for the verification. One of my banks enforces 3DSecure for their debit cards (but not credit cards) since all domestic stores support it.
- anondon 10y ago
  3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA. To make a transaction: -add items to cart -enter card details -you are redirected to 3DSecure if it's enabled -you are redirected to a page of your bank where you enter a One time Password(OTP). It's a simple 6 digit number sent to your mobile phone and is unique for every transaction.Enter OTP. -transaction is confirmed. So even if someone has my card details they can't make any transaction (unless they also managed to steal my phone). Sorry if my original comment was not clear.
  - bluesign 10y ago
    Almost all banks i am working with implementing 3Dsecure like this
    - anondon 10y ago
      Thank you far clarifying, I was not sure if it was the same in the USA. Follow up question, how widespread is the adoption of 3DSecure in the USA and if it's not available, is it easy to get 3DSecure activated?
  - davb 10y ago
    Two of my banks do it a little differently. With Visa's process (Verified by Visa), I had to register a password for each card. A separate password from my internet banking password. When I try to use my card on a VbV site (maybe one in ten sites), I have to enter three random characters. So few sites require it that I don't remember the password and entering random characters from KeepassX is always a pain. I hate it when I see that VbV prompt. That's frustrating security and results in passwords that you use so infrequently they never get changed. I'd much prefer OATH TOTP or even an SMS based code (with a "I don't have my phone" option).
  - codedokode 10y ago
    3DScure is usually optional. Some merchants might opt out of using it (but then they take the liability for fraud) so criminals can still use your credentials.
- david-given 10y ago
  Would you like another 3DSecure horror story? All 3DSecure iframe content is bounced through a third-party site, securesuite.co.uk. I invite you to visit one of the following URLs: http://securesuite.co.uk http://securesuite.co.uk https://securesuite.co.uk https://securesuite.co.uk Do you feel reassured about entering your credit card details into anything hosted there? At least the domain's whois information doesn't claim it's registered to "yaron shohat" (sic) any more... Here's a full writeup: https://web.archive.org/web/20160603034835/http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf https://web.archive.org/web/20160603034835/http://www.cl.cam...
  - kalleboo 10y ago
    This just reinforces what I tried to say - US and U.K. banks and stores suck. I've never seen 3DSecure in an iframe in Sweden
Silhouette 10y ago
The entire card payment system is fundamentally undermined from a security point of view, simply because it relies on merchants pulling funds instead of customers pushing them. We would probably be much better off if we'd evolved a system where the payment authorisation step was always hosted by the customer's bank, and everyone expected that instead of putting card details or the like into some merchant's site, they would only ever deal with their own bank. In the absence of such a system, modern 2FA schemes are trying to plug the gap, but they almost always introduce more friction in the process and consequently affect conversion rates. When not everyone is using them, that makes adopting 2FA potentially a worse option commercially than accepting the losses due to a certain level of fraud in return for better conversion rates across the board.
aianus 10y ago
> I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. A few reasons: 1) Card issuers don't care because it's merchants who are on the hook for card-not-present fraud. 2) Cardholders don't care because they're never on the hook for fraud. 3) If a specific merchant enforced 3DSecure (to move fraud liability back to the issuer/network) they'd lose more money on lost sales from people that hate 3DSecure (everyone?) than they would save on fraud. That said, I have seen 3DSecure enforced at ultra-high-fraud merchants like Bitcoin resellers.

by anondon 10y ago

kalleboo 10y ago

There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps or hardware card readers for the verification. One of my banks enforces 3DSecure for their debit cards (but not credit cards) since all domestic stores support it.

anondon 10y ago
3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA. To make a transaction: -add items to cart -enter card details -you are redirected to 3DSecure if it's enabled -you are redirected to a page of your bank where you enter a One time Password(OTP). It's a simple 6 digit number sent to your mobile phone and is unique for every transaction.Enter OTP. -transaction is confirmed. So even if someone has my card details they can't make any transaction (unless they also managed to steal my phone). Sorry if my original comment was not clear.
- bluesign 10y ago
  Almost all banks i am working with implementing 3Dsecure like this
  - anondon 10y ago
    Thank you far clarifying, I was not sure if it was the same in the USA. Follow up question, how widespread is the adoption of 3DSecure in the USA and if it's not available, is it easy to get 3DSecure activated?
- davb 10y ago
  Two of my banks do it a little differently. With Visa's process (Verified by Visa), I had to register a password for each card. A separate password from my internet banking password. When I try to use my card on a VbV site (maybe one in ten sites), I have to enter three random characters. So few sites require it that I don't remember the password and entering random characters from KeepassX is always a pain. I hate it when I see that VbV prompt. That's frustrating security and results in passwords that you use so infrequently they never get changed. I'd much prefer OATH TOTP or even an SMS based code (with a "I don't have my phone" option).
- codedokode 10y ago
  3DScure is usually optional. Some merchants might opt out of using it (but then they take the liability for fraud) so criminals can still use your credentials.
david-given 10y ago
Would you like another 3DSecure horror story? All 3DSecure iframe content is bounced through a third-party site, securesuite.co.uk. I invite you to visit one of the following URLs: http://securesuite.co.uk http://securesuite.co.uk https://securesuite.co.uk https://securesuite.co.uk Do you feel reassured about entering your credit card details into anything hosted there? At least the domain's whois information doesn't claim it's registered to "yaron shohat" (sic) any more... Here's a full writeup: https://web.archive.org/web/20160603034835/http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf https://web.archive.org/web/20160603034835/http://www.cl.cam...
- kalleboo 10y ago
  This just reinforces what I tried to say - US and U.K. banks and stores suck. I've never seen 3DSecure in an iframe in Sweden

Silhouette 10y ago

The entire card payment system is fundamentally undermined from a security point of view, simply because it relies on merchants pulling funds instead of customers pushing them. We would probably be much better off if we'd evolved a system where the payment authorisation step was always hosted by the customer's bank, and everyone expected that instead of putting card details or the like into some merchant's site, they would only ever deal with their own bank. In the absence of such a system, modern 2FA schemes are trying to plug the gap, but they almost always introduce more friction in the process and consequently affect conversion rates. When not everyone is using them, that makes adopting 2FA potentially a worse option commercially than accepting the losses due to a certain level of fraud in return for better conversion rates across the board.

aianus 10y ago

> I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. A few reasons: 1) Card issuers don't care because it's merchants who are on the hook for card-not-present fraud. 2) Cardholders don't care because they're never on the hook for fraud. 3) If a specific merchant enforced 3DSecure (to move fraud liability back to the issuer/network) they'd lose more money on lost sales from people that hate 3DSecure (everyone?) than they would save on fraud. That said, I have seen 3DSecure enforced at ultra-high-fraud merchants like Bitcoin resellers.