9 ms·

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to l

• mrits 3y ago
  In a couple decades I had to verify my bank once with PayPal
  • michaelt 3y ago
    In their defence, I'm sure the parties involved would blame EU Strong Customer Authentication rules and claim that they "don't have a choice"
• cogogo 3y ago
  Apple pay when available is about as low friction as you can get. I know it isnt available to everyone but there should be some similar standard that is. Near seamless.
  • makeitdouble 3y ago
    Amazon is probably the lowest and will stay so for a while I guess. They didn't cling to their one click patent for nothing.
    • ComputerGuru 3y ago
      The idiots removed the 1-click checkout feature and replaced it with a Dropbox to choose which address to deliver to, but it no longer ties that address to a payment method.
    • sjfjsjdjwvwvc 3y ago
      Dominos has the best checkout experience I ever experienced online. Nothing can beat it IMO, at least nothing I came across. Now they only sell (arguable mid) pizza, but when I order there it’s delightful (to use an overused 2023 marketing buzzword)
      • alias_neo 3y ago
        That's because they need you to hurry up and pay for the terrible pizza before you change your mind. (I too eat Domino's on the odd occasion the app doesn't take long enough for me to change my mind).
      • chrisBob 3y ago
        Their regular round pizzas are ok, but now that PizzaHut is gone, the Dominoes pan pizza is my go-to.
        • rusticpenn 3y ago
          Pizza Hut is gone?
          • at-fates-hands 3y ago
            Nope. I worked in a Pizza Hut delivery place when I was in college. I just took my son back for a campus visit and yeah, 30 years later, its still there - same location and save a few minor changes, the building still has the exact layout. A testament to whoever laid out the original floor plan.
      • wharvle 3y ago
        They do a lot of interrupting the buyer with up-sell attempts. I'd have singled them out as notably bad, among fast food pizza chains, actually.
  • matthewfcarlson 3y ago
    I’m not even embarrassed to say last night I went to check out, saw there wasn’t an Apple Pay option, waited through about 2 minutes of waiting for the credit card details panel to open before bailing.
    • FireBeyond 3y ago
      If it took two minutes for a credit card form to open up that's clearly a site problem, and would likely have been just as broken even with an Apple Pay option.
  • deleted 3y ago
    [deleted]
  • winphone1974 3y ago
    Only because you've standardized on their ecosystem and pre-given them all your data. This is not the future we were promised
    • riversflow 3y ago
      You don’t have to give Apple your data. It uses information stored on device.
      • jonathanlydall 3y ago
        I’m a happy ApplePay user, but you absolutely do have to give them your (card) information upfront through the whole adding your card in the Wallet app. That being said, I feel the parent’s viewpoint is naively idealistic, the payment industry is huge with many players and most attempts at new standards or interoperability are by people trying to get a cut of the action, no one is going to adopt a new standard unless they feel they absolutely have to. ApplePay is pragmatic in that it largely hooks into the existing CC systems and thanks to Apple’s market size they have enough clout to convince people it’s worth the effort. A whole new standard just for the “general good of the public” will never get any traction without regulation, and in places like the U.S. where bribery is essentially legal (so long as you call it lobbying), any new regulation like this faces an extreme uphill battle to being introduced except where someone standing to make lots of money is behind it.
        • vladvasiliu 3y ago
          > I’m a happy ApplePay user, but you absolutely do have to give them your (card) information upfront through the whole adding your card in the Wallet app. Do you actually have to give them the card? Or is it only stored somehow on the phone? I wonder how this works exactly. When I replaced my old iphone with a new one, I did the whole "transfer everything" dance. Waited around for two hours (didn't restore from icloud, but transferred from old to new), and still had to manually add my CCs to Apple Pay again.
          • 3y ago
• jjoonathan 3y ago
  Good job passing the dice roll to stay out of the special hell where the SMS code never arrives.
  • bloomingeek 3y ago
    Not sure if this is your experience, but when I broke a chunk out of my Samsung screen and then went to AT&T to trade for another Samsung, keeping the same phone number, I can't receive a two factor security code by text. Even after calling AT&T and being told that the traded in phone is "dead". So now I have to receive a call for security codes.
• ThePowerOfFuet 3y ago
  Why would you submit yourself to using PayPal when you don't have to? Serious question.
  • IshKebab 3y ago
    It's quicker than entering your credit card details and address again and again.
    • pertique 3y ago
      If you use a password manager (which they say they do) it's much quicker to just save that info and automatically populate it. Doubly so considering the MFA hell they went through.
      • zamadatix 3y ago
        Too many sites have broken forms. Sure, you can have the card autofilled but maybe it doesn't trigger the autofill for the address or maybe that wasn't even loaded yet. Maybe you can just click there and have it auto-fill but they can be so broken it doesn't autofill completely or fills wrong. Some sites are smart enough to have a checkbox for "shipping address is the same as billing" and others aren't. When you use a 3rd party payment provider like PayPal it does a really good job of forcing all of this to be automatic compared to things trying to autofill custom forms just because it's integrated by the site instead of the user. MFA hell is starting to erode that actually being easier though and now there is more and more often no simple approach left.
        • hot_gril 3y ago
          Yeah, CC autofill is nice but fails about 1/4 of the time. It doesn't include the security code either. A few sites will also have finicky inputs, like accepting spaces but rejecting the payment if you use them. Still, PayPal is an absolute last resort for me.
    • inhumantsar 3y ago
• stronglikedan 3y ago
  That's weird. I just log in with my fingerprint only, and my paypal is linked to my ebay. I don't even thing I enter a second password or fingerprint to pay. Also, what the what is this? "I'll just key in my 12 character, randomly generated password..." Key in? Seems like you're making your own life hard! ;-)
• ubermonkey 3y ago
  Sounds like you've got some unusual configuration options turned on or something. The most glaring odd thing here is that you apparently don't have your password vault available on the same machine you're shopping from, which seems odd to me. Even so, if I went that route it'd still be easy b/c with the Apple ecosystem, the clipboard is shared between devices. One can copy a password from the phone and paste it on the Mac. The tl;dr here is that I really don't understand why you had to retype your password. I never type my strong passwords. Why would you put yourself in a position where that's required? Finally, when I pay via Paypal using my Amex, I never have to re-auth to Amex. It just flows through. So it sounds like that's something you've chosen to set up, not something inherent to the process.
  • pc86 3y ago
    Opening your password manage and displaying the strong password openly on the screen while manually retyping it on a different machine - rather than just installing the password manager on that machine - definitely sounds like a "why are you doing that?" kind of thing. Likewise I've used a half dozen different cards and multiple bank accounts through PayPal for the last couple decades and can't remember the last time I've had to reauth on any of them during a checkout.
    • michaelt 3y ago
      > Opening your password manage and displaying the strong password openly on the screen while manually retyping it on a different machine - rather than just installing the password manager on that machine - definitely sounds like a "why are you doing that?" kind of thing. That one's on me, yes. The Yubikey I needed to unlock the password manager on the PC was upstairs and I couldn't be bothered to get it, so I used my phone instead. (Why was the yubikey upstairs? Well you see, that's where the fireproof safe is. But I can't blame ebay for that, so I didn't mention it)
    • g-b-r 3y ago
      > Opening your password manage and displaying the strong password openly on the screen while manually retyping it on a different machine - rather than just installing the password manager on that machine - definitely sounds like a "why are you doing that?" kind of thing. If the machine with the passwords is less exposed it's on average a lot safer (but now you have the problem of keyloggers of course)
• EnragedParrot 3y ago
  Apple makes this experience as seamless as I think it possibly can be. (As long as you use Safari...). All my passwords synced across all devices all the time, instantly available with faceID or or my fingerprint. Apply pay makes checking out of most online retailers as fast as using my fingerprint or double-clicking the side button on my phone. Passkeys generally starting to replace passwords on many major sites, making the process even faster.
  • wharvle 3y ago
    That whole process in the top level comment is much faster, in practice, on my phone. Everything auto-fills (unless a site manages to fuck up their forms). I don’t typically have to type or manually copy anything, including 2fa tokens. Wait for the notification to ping, “fill from message” option, done. I can often go through an entire sign-up, entering shipping, and payment, at a new site, without typing a single thing.
    • hcurtiss 3y ago
      How are you populating non-SMS 2FA codes automatically?
      • InitialBP 3y ago
        1Password can do this for you, and I assume many other password managers as well. https://support.1password.com/one-time-passwords/ https://support.1password.com/one-time-passwords/
        • sgarman 3y ago
          I use 1password but opt out of this feature. Just as described in the article masterpassword creates a single source of failure so I don't personally want to put more eggs in that basket.
          • jorvi 3y ago
• eddd-ddde 3y ago
  I've never had to authenticate with a bank for using a card? Is this common for you?
  • camhart 3y ago
    If the bank fears the charge is fraudulent sometimes I've had to do it. But normally I don't.
    • psyclobe 3y ago
      If its the 'verified by visa' thing, it is in fact optional and you can cancel out of the wizard
  • drxzcl 3y ago
    I have a Mastercard branded card issued by the Dutch quasi-monopolist (ICS). Every time I have a transaction with a merchant with ties to NL, they force me to do 2FA using their crappy app. I have no words to express how much I hate this.
  • sgjohnson 3y ago
    Pretty common in Europe these days, due to PSD2 regulation.
  • JimDabell 3y ago
    MFA is required in the EU: https://en.wikipedia.org/wiki/Strong_customer_authentication https://en.wikipedia.org/wiki/Strong_customer_authentication
    • eddd-ddde 3y ago
      Really interesting, here in Mexico I think that's unheard of, what I have to use is a digital card with a dynamic 3 digit cvv that's generated on my app.
      • Aerbil313 3y ago
• wegfawefgawefg 3y ago
  Ever since I started using brave browser I have to do all of this shit. On firefox i dont. Chrome, i definitely don't.
• wmsmith 3y ago
  Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Vendors (I'm looking at you, Audible!) constantly hide their account termination under layers of dark patterns. For awhile, I had several ghost subscriptions that I a.) didn't want and b.) couldn't cancel. My credit card card [1] has fundamentally changed my online purchasing experience as it bridges what I feel is a gap between new payment methods (Apple, Google, et al) and classic payment methods (CC). An ounce of prevention is worth a pound of cure. When I purchase something line, I create a new one-time card (three taps on my phone) and use that new, valid CC for purchasing. Everybody takes a CC. The card is instantly deleted after purchase, and I don't have to worry about my paypal account, apple pay account, google wallet account, ghost subs, account hacks, identity theft -- the works. [1] https://x1creditcard.com/ https://x1creditcard.com/
  • the_snooze 3y ago
    >Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Paypal absolutely lets you stop recurring payments unilaterally on their side. I use Paypal for subscriptions wherever it's offered precisely for this reason. https://www.paypal.com/us/cshelp/article/what-is-an-automatic-payment-and-how-do-i-update-or-cancel-one-help240 https://www.paypal.com/us/cshelp/article/what-is-an-automati...
    • wmsmith 3y ago
      That's news to me! Thank you for sharing!
    • llbeansandrice 3y ago
      Apple also lets you do this.
    • Brybry 3y ago
      Sort of? I don't think everything always shows up on https://www.paypal.com/myaccount/autopay/ https://www.paypal.com/myaccount/autopay/ I think it maybe only shows companies you had recent transactions with. In 2023, I had a fraudulent $0.99 Paypal Automatic Payment for "Domain Name Forwarding - Renewal" from a company (DomainsPricedRight/OwnMyDomain aka GoDaddy) that I last did business with in 2005. Yes, 18 years prior. I was able to 'deactivate' the 'subscription' on the Paypal site after I noticed the charge but I don't think automatic payments existed on Paypal in 2005 and I'd certainly never signed up for it. The original 2005 business I did was a one time domain purchase that was transferred to another registrar within a year. It was real fun to also see on Paypal that I could have been fraudulently charged up to $10,000. It's kind of scary to think that any company I've done a Paypal transaction with could maybe do the same thing (or any of the companies that eventually acquire their merchant accounts...)
• BeetleB 3y ago
  I pretty much never have to do a 2FA with Paypal. And it never redirects me to the bank (credit card). I also don't do this on my phone, but on a regular PC.
  • Symbiote 3y ago
    I believe the redirect to the bank's website is an EU and UK regulation, "Strong Customer Authentication": https://www.theguardian.com/money/2022/mar/14/uk-shoppers-face-more-identity-checks-when-buying-online https://www.theguardian.com/money/2022/mar/14/uk-shoppers-fa... https://www.visa.co.uk/pay-with-visa/changes-in-payment-security.html https://www.visa.co.uk/pay-with-visa/changes-in-payment-secu... I don't know the details of when it is and isn't required. I am asked pretty much all the time for transactions using my Danish cards, and only some of the time for the British cards.
  • at-fates-hands 3y ago
    >> I also don't do this on my phone, but on a regular PC. I do the same. Too many times I've had major issues trying to buy stuff on mobile so I just stopped doing it like 8 years ago. Literally the only thing I pay for with my phone is my hockey sessions via Venmo.
• graemep 3y ago
  There are things you can do to make it easier. My phone sends all notifications to my desktop, and I have an app on the phone that creates a notification when it recognises a code in the SMS, so all I need do is double click on the notification (to select the entire "word" that is the code) then paste into the site I am verifying to. There are also authenticator browser extensions so you do not have to use a phone app for those either. The software I use for the SMS codes is KDE Connect and SMS code.
  • cryptonym 3y ago
    We shouldn't have to work installing & maintaining an awkward flow with random software to make buying experience less miserable. This should be fixed by the seller in the first place, where it makes sense and can be fixed easily and reliably.
    • squigz 3y ago
      In this case, how is eBay responsible for how PayPal and a bank handles things when they hand it off?
      • jodrellblank 3y ago
        eBay owns PayPal https://www.cnet.com/tech/tech-industry/ebay-picks-up-paypal-for-1-5-billion/ https://www.cnet.com/tech/tech-industry/ebay-picks-up-paypal... - August 2002
        • Operyl 3y ago
          No, eBay no longer owns PayPal. https://techcrunch.com/2014/09/30/ebay-paypal-split/ https://techcrunch.com/2014/09/30/ebay-paypal-split/
          • jodrellblank 3y ago
            Oh, ok.
• InitialBP 3y ago
  Business don't want online shopping to be high-friction, but Thankfully consumer opinion is pushing more for security and less for making it as easy as possible to buy stuff online. I'll happily take this shit-show cacophony of various 2fa methods and authentication types if nobody is stealing money from my bank account or ordering stuff on ebay on my behalf. The flip side of this - is that if companies properly setup auth and allow you to use username+password (or passkeys) and a TOTP method then this is all basically copy/paste from your password manager or verify on your phone and the process is super easy.
  • ryandrake 3y ago
    > I'll happily take this shit-show cacophony of various 2fa methods and authentication types if nobody is stealing money from my bank account or ordering stuff on ebay on my behalf. Even better: I wouldn't care about people stealing money from my bank account if cleaning it up and making whole was my bank's responsibility and not mine or some hapless vendor. Neither I, nor store vendors should have to put up with the "shit-show cacophony." The bank's entire reason for existence is to secure access to my money--it should be entirely their problem.
• a_imho 3y ago
  Order pizza, pay with virtual card. Payment provider needs 3FA+Captcha, one of the factors is email which is another 2FA challenge. Disclosing the card details once logged in prompts for another 2FA, finally VISA also challenges you with a recent payment question. Insanity.
  • hot_gril 3y ago
    Well pizza in particular often has a cash payment option, which I always use for that.
  • zeekaran 3y ago
    Then they store your credit card info in a database and leak it some time next year.
    • ryandrake 3y ago
      It's pretty annoying that they load all this pain and suffering onto the user who's just trying to make a purchase, when the company's database is often the weakest link.
      • illiac786 3y ago
        This is fascinating to me. Why do we have to go through all these hoops with the bank and somehow, when the credit card # is eventually and ineluctably leaked, the thieves have no problem using it to make purchases, whiteout going through all these 3FA etc. How is that possible?
    • a_imho 3y ago
      Hence the virtual card. I can just discard it after a few purchases. Isn't this enough?
  • efitz 3y ago
    Captcha IMO is way worse in terms of user experience than 2FA. And the only 2FA that I don't detest are app push and TOTP.
• ajmurmann 3y ago
  Why is your password manager only on your phone and not synced between your devices?
• at-fates-hands 3y ago
  Now imagine someone who has cognitive issues or is visually impaired trying to repeat this same process.
• orthoxerox 3y ago
  > Clearly, the days when businesses thought online shopping ought to be low-friction are long gone. I bought some lottery tickets online for a present to myself and the experience was smooooth. No cart, no checkout steps, no need to create an account, there was a QR code right next to the tickets that I had to scan with my banking app to buy them right here, right now.
• kulahan 3y ago
  The goal is to cover their asses for when data is stolen. It’s not a matter of “if”, it’s “when”, and they want to be able to point to every obnoxious POS practice they made standard to show they did their best. I’m not making any comments on whether this is good or bad, just that it, to me, explains a ton of the n behavior.
• kkfx 3y ago
  They want mandatory macrobugs (aka smartphones, the bug not payed and carefully placed by those who want to spy, but the one payed and babysitted by the spy target) for anyone, so if you use a desktop you are a threat and you need to be not in comfort...
• araes 3y ago
  The involuntary signup for two factor you didn't want is incredibly annoying. Especially when initiated by a bank or similar financial institution with no warning. "BTW, for your own safety, we implemented two factor on your account, and tied it to your old phone. Wait, you don't have that phone anymore, cause it was something like a 10 yr old retirement that you never obsessively check? And we didn't give you the option for an email? Or even warn you? Too bad. We now no longer accept logins for your own money."