4 ms·

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" fo

by Nursie 6y ago

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retailer systems. It's not the same level.of assurance as EMV, but it is something, and any transactions that don't go via that system are more likely to be declined or flagged as fraud.

0xffff2 6y ago
How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.
- te_chris 6y ago
  You don’t sign up to anything, it’s with the issuing bank or provider.
- tialaramex 6y ago
  They're kind of half-arsed. So far as it's possible to tell, nobody who knew anything about UX or digital security was anywhere close to these projects. So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago) If an online retailer performs Authorisation the API they talk to will examine your card number and conclude it needs this extra check, so it tells them to forward your browser to an HTTPS site you've never heard of, in the arcot.com domain. I guess if you're a huge bank you've heard of Arcot, but consumers haven't. The site claims to be from your famous bank brand, but the domain name clearly isn't, anybody who has learned anything about phishing ought to run screaming. The arcot.com HTTPS site looks at the transaction and if you've never done this before it (presumably always? but maybe if there's a fraud flag this doesn't happen?) registers you for the "Verified by Visa" service. You can pick "No, I'm busy right now, just let me buy stuff" and it will give you a few passes, but I believe eventually it's mandatory. Signing up requires giving them some details about the card, and also effectively creating yet another secret password. (Because we all know secret passwords are great right?). There might be an option to pick a picture or text greeting so you'll "know it's them" although of course a sophisticated attacker could duplicate that part... On subsequent visits you may be asked for that secret if you've created it. Or, it might give up asking and just say everything is fine before returning you to the original payment flow. My transactions are reassuringly boring so I am never asked for anything these days. The whole thing looks like it was built by people who were impressed by IE6 and are planning to buy a 17" display soon. The cryptography would be impressive for the IE6 era and not so much today, it's TLS 1.2, it has some basic precautions, but it's scarcely Fort Knox, your GMail is better protected.
  - 0xffff2 6y ago
    Ah, actually that sounds pretty much exactly the same, except I've only ever been redirected once or twice. I think the only difference is that I didn't realize that it would eventually force you to sign up.
- AnssiH 6y ago
  Here in Finland Verified By VISA and Mastercard 3D Secure will just present the same 2-factor bank authentication you already use for your non-card online payments and bank transfers. There are no separate credentials or sign-up steps. Practically all domestic online retailers here have used those over 10 years now, and AFAIK there is no opt-out (at least for regular bank-issued consumer VISA/MC cards).
thewebcount 6y ago
Yeah, whenever I hit one of those, I immediately back out of the transaction. I'm like, "Wait, I'm supposed to be paying business X, why am I at a different web site? Something's fishy here. Fuck this."
- hasa 6y ago
  Actually 3DS is much more reliable than giving credit card numbers to random online merchant that will face data breach sooner or later.
fomine3 6y ago
Maybe it's not two "Factor" auth because ID/pass and card number is both knowledge of secret.

by Nursie 6y ago

0xffff2 6y ago

How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.

te_chris 6y ago
You don’t sign up to anything, it’s with the issuing bank or provider.
tialaramex 6y ago
They're kind of half-arsed. So far as it's possible to tell, nobody who knew anything about UX or digital security was anywhere close to these projects. So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago) If an online retailer performs Authorisation the API they talk to will examine your card number and conclude it needs this extra check, so it tells them to forward your browser to an HTTPS site you've never heard of, in the arcot.com domain. I guess if you're a huge bank you've heard of Arcot, but consumers haven't. The site claims to be from your famous bank brand, but the domain name clearly isn't, anybody who has learned anything about phishing ought to run screaming. The arcot.com HTTPS site looks at the transaction and if you've never done this before it (presumably always? but maybe if there's a fraud flag this doesn't happen?) registers you for the "Verified by Visa" service. You can pick "No, I'm busy right now, just let me buy stuff" and it will give you a few passes, but I believe eventually it's mandatory. Signing up requires giving them some details about the card, and also effectively creating yet another secret password. (Because we all know secret passwords are great right?). There might be an option to pick a picture or text greeting so you'll "know it's them" although of course a sophisticated attacker could duplicate that part... On subsequent visits you may be asked for that secret if you've created it. Or, it might give up asking and just say everything is fine before returning you to the original payment flow. My transactions are reassuringly boring so I am never asked for anything these days. The whole thing looks like it was built by people who were impressed by IE6 and are planning to buy a 17" display soon. The cryptography would be impressive for the IE6 era and not so much today, it's TLS 1.2, it has some basic precautions, but it's scarcely Fort Knox, your GMail is better protected.
- 0xffff2 6y ago
  Ah, actually that sounds pretty much exactly the same, except I've only ever been redirected once or twice. I think the only difference is that I didn't realize that it would eventually force you to sign up.
AnssiH 6y ago
Here in Finland Verified By VISA and Mastercard 3D Secure will just present the same 2-factor bank authentication you already use for your non-card online payments and bank transfers. There are no separate credentials or sign-up steps. Practically all domestic online retailers here have used those over 10 years now, and AFAIK there is no opt-out (at least for regular bank-issued consumer VISA/MC cards).

thewebcount 6y ago

Yeah, whenever I hit one of those, I immediately back out of the transaction. I'm like, "Wait, I'm supposed to be paying business X, why am I at a different web site? Something's fishy here. Fuck this."

hasa 6y ago
Actually 3DS is much more reliable than giving credit card numbers to random online merchant that will face data breach sooner or later.

fomine3 6y ago

Maybe it's not two "Factor" auth because ID/pass and card number is both knowledge of secret.