3 ms·

OP here, I am also convinced this is legitimate. This is the new system that they enforce some times since last November for some websites (foreign but not excl

OP here, I am also convinced this is legitimate. This is the new system that they enforce some times since last November for some websites (foreign but not exclusively). Their system is called 3dSecure https://www.labanquepostale.fr/particulier/comptes-et-cartes/services-de-cartes/3d-secure.html https://www.labanquepostale.fr/particulier/comptes-et-cartes... . Sometimes when you are using a phone app they can send you a notification there, something they call Certicode Plus, but for everyone that has not activated it, they request the secret bank password. I've tried to activate it yesterday, but maybe it takes additional time to switch to the new system even though they tell me it has been activated, and I'm still stuck and can't process payments without giving my secret code. And it has made me miss some aliexpress promotion. From a security perspective it exposes them if any of the payment processor is compromised. In my case the payment processor was wlp-acs.com but sometimes it is adyen.com.

seszett 5y ago
3DSecure is asked by the merchant, and if you haven't activated Certicode, then your bank doesn't have a dedicated authentication factor to use, so they can either refuse payment or allow you to authenticate using your account password, they actually don't really have another choice. In normal usage, you don't give any information anymore to the payment processor yourself (now that SMS authentication has been deprecated by law).
- Nextgrid 5y ago
  I believe that asking for 3DS offloads liability regardless of whether the bank actually supports it.
  - sirn 5y ago
    IIRC, this depends on the card brand. Attempting to do 3-D Secure with non-enrolled JCB/Visa cards should result in a liability shift, AMEX/Diners only records the attempt, and MasterCard does not offload liability in such cases. (Though this may also vary by country.)
Nextgrid 5y ago
3D-Secure is a common system, in fact it's now mandatory in the EU as per PSD2. The original implementation of it is flawed - the merchant is supposed to iframe the authorization page, which means as a user you have no way to tell whether the displayed page is legitimate. Somehow this insanity actually went ahead and is now part of the spec, so it's too late to change it. The redeeming factor is that the authorization pages (controlled by the banks) usually only ever ask for an OTP or some relatively benign piece of information that by itself can't be used to break into the account (modern banks doesn't ask for anything at all and just polls the backend for an out-of-band response via a push notification), so as long as the user doesn't expect this page to ask for their actual online banking password it is safe as a fake page requesting such info will raise alarm bells (of course, that relies on the user being somewhat aware of the problem and the risks - not sure how much of this actually applies to the general population). La Banque Postale here clearly didn't understand the problem, and decided to legitimize asking for their actual banking password on an untrusted website - this now opens them up for attacks where websites make a fake iframe to steal that password. The fact that it's a static secret also means it can be reused forever once captured, where as typical 3D-Secure implementations use time-limited secrets.

seszett 5y ago

3DSecure is asked by the merchant, and if you haven't activated Certicode, then your bank doesn't have a dedicated authentication factor to use, so they can either refuse payment or allow you to authenticate using your account password, they actually don't really have another choice. In normal usage, you don't give any information anymore to the payment processor yourself (now that SMS authentication has been deprecated by law).

Nextgrid 5y ago
I believe that asking for 3DS offloads liability regardless of whether the bank actually supports it.
- sirn 5y ago
  IIRC, this depends on the card brand. Attempting to do 3-D Secure with non-enrolled JCB/Visa cards should result in a liability shift, AMEX/Diners only records the attempt, and MasterCard does not offload liability in such cases. (Though this may also vary by country.)

Nextgrid 5y ago

3D-Secure is a common system, in fact it's now mandatory in the EU as per PSD2. The original implementation of it is flawed - the merchant is supposed to iframe the authorization page, which means as a user you have no way to tell whether the displayed page is legitimate. Somehow this insanity actually went ahead and is now part of the spec, so it's too late to change it. The redeeming factor is that the authorization pages (controlled by the banks) usually only ever ask for an OTP or some relatively benign piece of information that by itself can't be used to break into the account (modern banks doesn't ask for anything at all and just polls the backend for an out-of-band response via a push notification), so as long as the user doesn't expect this page to ask for their actual online banking password it is safe as a fake page requesting such info will raise alarm bells (of course, that relies on the user being somewhat aware of the problem and the risks - not sure how much of this actually applies to the general population). La Banque Postale here clearly didn't understand the problem, and decided to legitimize asking for their actual banking password on an untrusted website - this now opens them up for attacks where websites make a fake iframe to steal that password. The fact that it's a static secret also means it can be reused forever once captured, where as typical 3D-Secure implementations use time-limited secrets.