4 ms·
A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
by 0x0 10y ago
A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
- rconti 10y agoI don't think I've EVER had a VBV or Mastercard Securecode transaction actually work. I avoided buying stuff from NewEgg for a couple of years because of this.
- brazzledazzle 10y agoThat's ridiculous. Why not just use redirects/posts the way SAML and OAuth does?
- innocenat 10y agoMy bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.
- 0x0 10y agoI've seen that phrase thing, but what would prevent a fake page from fetching your phrase from the real VbV website?