4 ms·
A few years back, when "Verified by Visa" first came out, I was taken aback the first time I saw it. It's not at all hard to imagine that you're being phished b
by CWuestefeld 15y ago
A few years back, when "Verified by Visa" first came out, I was taken aback the first time I saw it. It's not at all hard to imagine that you're being phished by this strange page.
I called the customer service number for my Visa card and asked if this was a real Visa card "feature". After spending a couple of minutes asking around, nobody knew what the heck it was.
If Visa has a division that takes security seriously, they certainly need to work hard on the customer-facing aspects of it.
- shabble 15y agoVbV has to be some of the worst security engineering I've ever seen. iframe content, arbitrary domain (securesuite?!), trivially guessable or resettable details.
- mattmanser 15y agoAnd to add on top it looks like a con, the design is horrific.
- DanBC 15y agoVerified by visa is hideous security theatre. I have no idea why banks fail so hard at security. They're actively targeted by criminal gangs; they stand to lose money if they get it wrong; they have money and expertise to get it right. Yet they all suck.
- SoftwareMaven 15y agoThey fail so hard because Visa and the banks aren't the ones liable for losses. Liability falls to you (if you don't report) or the merchant (through charge backs). Visa and the bank make their money either way. Merchants have no choice but to "bend over and take it up the tailpipe".