3 ms·

Is this the verified by visa thing? https://usa.visa.com/pay-with-visa/featured-technologies/verified-by-visa.html https://usa.visa.com/pay-with-visa/featured-t

Is this the verified by visa thing? https://usa.visa.com/pay-with-visa/featured-technologies/verified-by-visa.html https://usa.visa.com/pay-with-visa/featured-technologies/ver... Bank passwords alone wouldn't work on any of my accounts because it would detect a different computer and request secondary authorization. It does this by looking at the information the browser sent...and...oh...oh. Geez I hate security theater. Is there anything less secure than the information sent by your browser?

464192002d7fe1c 10y ago
It looks like their own ghetto implementation of Verified by Visa. Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"
- 0x0 10y ago
  A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
  - rconti 10y ago
    I don't think I've EVER had a VBV or Mastercard Securecode transaction actually work. I avoided buying stuff from NewEgg for a couple of years because of this.
  - brazzledazzle 10y ago
    That's ridiculous. Why not just use redirects/posts the way SAML and OAuth does?
  - innocenat 10y ago
    My bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.
    - 0x0 10y ago
      I've seen that phrase thing, but what would prevent a fake page from fetching your phrase from the real VbV website?
vertex-four 10y ago
Verified By Visa happens immediately after you hit "pay", not a number of days later. Also, there's a number of implementations of it - some banks in the UK ask for a password you've set up previously, some don't, some ask for random other info. It is consistent between sites, though - it's bank-dependent, not site-dependent.

464192002d7fe1c 10y ago

It looks like their own ghetto implementation of Verified by Visa. Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"

0x0 10y ago
A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
- rconti 10y ago
  I don't think I've EVER had a VBV or Mastercard Securecode transaction actually work. I avoided buying stuff from NewEgg for a couple of years because of this.
- brazzledazzle 10y ago
  That's ridiculous. Why not just use redirects/posts the way SAML and OAuth does?
- innocenat 10y ago
  My bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.
  - 0x0 10y ago
    I've seen that phrase thing, but what would prevent a fake page from fetching your phrase from the real VbV website?

vertex-four 10y ago

Verified By Visa happens immediately after you hit "pay", not a number of days later. Also, there's a number of implementations of it - some banks in the UK ask for a password you've set up previously, some don't, some ask for random other info. It is consistent between sites, though - it's bank-dependent, not site-dependent.