3 ms·
What pisses me off to no end in Europe is that some banking systems require, in order to do a credit card payment, to provide the online bank account password a
by ant6n 5y ago
What pisses me off to no end in Europe is that some banking systems require, in order to do a credit card payment, to provide the online bank account password and online bank account 2fa generated transaction code — requiring that both be entered as part of the payment process on any merchants website. It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account. Plus it teaches ppl that it’s okay to enter one’s online banking credentials one-time generated transaction codes into random websites selling u random crap for 3€…
I don’t understand security researchers. Is it all just a bunch of hooey they sell or what?
- eythian 5y ago> It’s so goddamn stupid I can’t believe this exists. It’s so easy to fake this and use some sort of man in the middle attack to transfer all money away from an account An MitM attack is significantly harder than "I have your CC number and I'll use it with no authentication", therefore it does increase the difficulty for fraud. Though I haven't seen a requirement to enter the bank's password, my one requires me to confirm the transaction by opening the credit card provider's app on my phone which isn't vulnerable in the way you're describing.
- sofixa 5y agoBanks are supposed to do MFA. Some, apparently, are crap and require you to login while doing a payment, but most ask for a confirmation with an SMS code or the banks app, both of which contain who the payment is towards, and the amount.