6 ms·
The thing about 3-D Secure is that it uses your phone number to verify it's 'you' making the purchase, but if your phone is lost/stolen and you get a new SIM, y
by sysadm1n 4y ago
The thing about 3-D Secure is that it uses your phone number to verify it's 'you' making the purchase, but if your phone is lost/stolen and you get a new SIM, you're locked out of making any purchases with any cards tied to your old number. You can always update your details on the card provider's site so there is that. Another thing: SMS is not secure and a SIM-swap away from someone being able to make purchases in your name. I wish SMS just got deprecated as a form of verification. It's 2022, come on, we can do this!
- xaduha 4y ago> SMS is not secure and a SIM-swap away from someone being able to make purchases in your name. as in physically getting hold of a SIM card and putting it into another phone? That's what SIM PIN codes are supposed to protect against, but nobody uses them anymore because they are disabled by default now and set to 0000. But you can still do it, every SIM has a PIN and PUK codes. But SMS isn't 100% secure for different reasons though.
- kube-system 4y ago"SIM swap" attacks are typically when an attacker cajoles a carrier to swap a number to a new SIM.
- xaduha 4y agoAh I've heard of those, but that seems like another "first world problem" similar to 3-D Secure not being widespread. That's why identity theft is such an issue in USA, just by having enough information you can make customer support do all kinds of things over the phone.
- kklimonda 4y agoIt depends on your bank - mine has an application for phones that is used to interact with 3D Secure, confirm money transfers etc.
- hocuspocus 4y agoPure SMS based 2FA is already being deprecated in the EU, as on its own, it isn't compliant with the PSD 2 requirements.
- xvello 4y ago3DS delegates the second factor authentication to the card emitter (your bank): the 3DS interface is really just an iframe provided by the bank. One of my banks embeds their login form, which asks for a portion of your login credentials (probably secure enough in recent browsers, but still a bit yucky). My other bank requires transactions to be approved in the account management interface (either via their mobile app or by logging into their website in another tab). Other banks use one-time-password generators for their website, and reuse that system as their second factor.