3 ms·

How would that help in this case, where customers are entering their own CCs into the phishing page?

isaacfung 3y ago
Dont send the cc info. Use private key to authenticate yourself. Digitally sign the transaction id and the date so people cant record the info and reuse it. I guess the issue is that people may lose or forget their keys or people can gain access to the signing device. It is harder to understand than using password for verification so people like my parents do not trust it.
- thehappypm 3y ago
  This is exactly how it works when you tap to pay. It would be really cool if computers let you to tap to pay.
0xDEAFBEAD 3y ago
If we were using digital signatures, you wouldn't need to give the number you use for authentication to every party you transact with.
- mindslight 3y ago
  ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. Digital signatures are a red herring. The only way to "solve" this on the consumer side is to change the semantics and make electronic payments like cash. If a customer paid a hotel in cash, and a person in the lobby said "hey there was a problem with your cash, give it to us 'again'", the customer would rightly balk. But why would a customer ever want that? Especially for something like hotel bookings where one isn't able to sit down at a fully-fledged computer and spend time picking over the request details and account transactions with a fine tooth comb? Reversibility means any fraud can be detected after you're done traveling.
  - 0xDEAFBEAD 3y ago
    > ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.) I don't think digital signatures are mutually exclusive with reversible transactions.

Dont send the cc info. Use private key to authenticate yourself. Digitally sign the transaction id and the date so people cant record the info and reuse it. I guess the issue is that people may lose or forget their keys or people can gain access to the signing device. It is harder to understand than using password for verification so people like my parents do not trust it.

thehappypm 3y ago
This is exactly how it works when you tap to pay. It would be really cool if computers let you to tap to pay.

0xDEAFBEAD 3y ago

If we were using digital signatures, you wouldn't need to give the number you use for authentication to every party you transact with.

mindslight 3y ago
... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. Digital signatures are a red herring. The only way to "solve" this on the consumer side is to change the semantics and make electronic payments like cash. If a customer paid a hotel in cash, and a person in the lobby said "hey there was a problem with your cash, give it to us 'again'", the customer would rightly balk. But why would a customer ever want that? Especially for something like hotel bookings where one isn't able to sit down at a fully-fledged computer and spend time picking over the request details and account transactions with a fine tooth comb? Reversibility means any fraud can be detected after you're done traveling.
- 0xDEAFBEAD 3y ago
  > ... so the fraudulent link has the same exact message, but prompting you to "redo" the digital signature - eg stick your credit card into the reader again. This caps the fraud amount at the money transacted. Also, maybe you could educate users to look for a confirmation message, and never duplicate a transaction if they already received a confirmation message. (And force a fraudster to generate a quick confirmation message if they want to get any money.) I don't think digital signatures are mutually exclusive with reversible transactions.