8 ms·

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't ha

Most of what he says is obvious stuff and the emphasis he puts on how much he modifies stuff makes me assume he's someone that just runs programs and doesn't have any unique insight, but he does make one interesting point: > Try to use "Verified-By-Visa" and "Mastercard-Securecode" as rarely as possible. If only your CVV2 code is getting sniffed, you are not liable for any damage, because the code is physicly printed and could have been stolen while you payed with your card at a store. Same applies if someone cloned your CC reading the magnetic stripe or sniffing RFID. Only losing your VBV or MCSC password can cause serious trouble. Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct?

njs12345 14y ago
I really wouldn't be surprised. The security group at my university do a lot of stuff on banking security, and from what I've heard, this was one of the main reasons behind the switch to chip-and-PIN in the UK --- the user is now liable when his card gets stolen and used.
- DanBC 14y ago
  Richard Clayton (etc) have lots of interesting stuff about bank security (and the lack of) - they've attacked chip and pin, which means that if someone does manage to defraud the card the owner might have some chance of getting the cash back.
- shabble 14y ago
  See, for example, Tetris on a ('secure hardware' platform) chip & pin machine[1] The same group (security research at cambridge) are also the ones who produced the 'chip and pin is a joke'[2] paper you might be referring to. [1] http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/ http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-termi... [2] http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...
- mibbitier 14y ago
  That's not really true. The user is liable if the card is stolen, and it is used to conduct fraud using the PIN code. If the card is stolen, and the fraudster simply uses it online, or via some place that doesn't ask for a PIN, then you are not liable for that fraud. I'm sure there are rare edge cases, but my experience with Barclays has always been very good in this regard.
  - njs12345 14y ago
    The problem is that there is no way of knowing that the criminal even knows the user's PIN, due to flaws in the chip-and-PIN protocol. See http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...
    - FuzzyDunlop 14y ago
      And, from many years of personal experience, quite a lot of people don't treat their card and PIN securely. This might be in the form of (and these are genuine examples): 1. Writing the PIN on a post-it note and sticking it to the back of the card. 2. Writing the PIN on some paper and keeping it in the same place the card is kept. 3. Giving the card to someone else (partner, kids, relatives, etc.), along with the PIN, to run an errand for them. 4. Saying the PIN out loud as they type it in. 5. Asking the customer assistant/whoever is dealing with the transaction to enter the PIN for them. Chip&Pin, while claiming to be more secure, enabled and made convenient basic forms of fraud, such as that in points 3 and 5. I'd actually argue that the shifting of liability from the card issuer/merchant to the card holder/customer in the UK is a direct consequence of C&P allowing careless people to be more lax with the security of their card.
      - mibbitier 14y ago
        The worst thing is the chip+pin machines that do not have any shield to hide you punching the pin in, and then to just add insult to injury, they're the kind of buttons that you have to forcefully press with all your might to get them to register. So it's blatantly obvious to anyone taking notice which buttons you pressed.
coffeejunk 14y ago
at least for mastercard this is true: as per my banks tos i have to take care that nobody gains access my 'securecode' and i am liable for any unauthorized charges. (because the 'securecode' is supposed to guarantee that it is me who is using the card)
henrikschroder 14y ago
> Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct? Yes. It's the whole point of the system, to remove even more risk from the CC companies and banks, and put it on you.
epoxyhockey 14y ago
My experience with mastercard-securecode is that I can just enter gibberish until it fails the check, then my purchase goes through anyway.
mey 14y ago
As someone in the financial payment industry, let me shed some light on it. 3DSecure (the generic name) when used, generally prevents the user from issuing chargebacks, even in the case of fraud. It's a Terms & Conditions change basically for that purchase. Since your credentials can be hijacked at your web browser level, it is possible to give up your credentials AND give up your ability to re-mediate the issue later. If you are purchasing stuff online, I advise using a credit card and CVV. Federal law (in the US) limits your damages to $50 total in the event of Fraud. (Not true of debit cards, or 3DSecure). http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
- aneth 14y ago
  I'm not familiar with this service. What is the advantage to the consumer in exchange for losing their fraud liability protection?
  - danudey 14y ago
    Nothing. This 'feature' is entirely designed to reduce the banks' liability. It shifts the onus of security onto you (from the banks and the merchants).
    - gregable 14y ago
      It sounds like in principle it might also reduce fraud overall. Thus, maybe 80% of the fraud goes away and 20% remains, but that liability is shifted to the consumer rather than the bank (who otherwise passes it to the merchant anyway). If the merchant has reduced fraud liability, they may be able to offer lower prices. So, in principle there might be a long-term win for the consumer. In practice, who knows.
      - aneth 14y ago
        I think the idea of a pin at checkout is a good one to reduce fraud. However this is more work for the consumer, and reduces the bank's liability. Most consumers would probably prefer this, as it makes their card more secure and reduces the possibility of fraud hassles, which are annoying regardless of liability. Having something that is more work for the consumer and could save the bank money switch the liability to the consumer is just obnoxious.
leif 14y ago
When a website asks me to use one of these, and I don't want to, how do I decline but still make the purchase? It always seems like my options are take-it-and-like-it or don't complete the transaction. Is there a third option?
- czzarr 14y ago
  wondering the same thing
- el_presidente 14y ago
  Paypal.
- pmjordan 14y ago
  I've had certain websites require VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank. The worst part is the information required for the "I forgot my password" process is often not terribly hard to get hold of (date of birth, that kind of thing). The best option at this stage is probably to have a "normal" credit card for everyday use which is specifically NOT VbV enabled, and a special VbV credit card that you keep at home for internet purchases from companies that require it. Or just don't buy from those companies.
  - jacquesm 14y ago
    > I've had certain websites require VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank. Transaction fees are not the problem, putting a stop to consumer fraud and charge-backs are the net win for the merchant.
- alexg0 14y ago
  Use AmEx.
- starwed 14y ago
  I had this pop up today, the wording was pretty misleading. In my case not activating Secure By Visa let me proceed with the transaction normally, but they certainly tried to imply it was necessary.
jacquesm 14y ago
VBV (or 3D secure as it is called today) is part of a move by the credit card companies and the banks to push the risk to the most vulnerable party, the consumer. The idea is that this absolutely crack proof scheme requires you to authenticate yourself to your bank in a fairly complex three way handshake. In the old (read pre-VBV) days the card companies and issuing banks would saddle the merchants with any charges that were disputed using the chargeback mechanmism. Verified-by-Visa removes this safeguard by adding an additional layer of authentication which supposedly has the same strength as you being on-premise and signing on the dotted line to authorize your purchase. This will effectively remove a lot of the excuses that you might have had such as 'it wasn't me', 'I wasn't there' and 'I never meant to buy this', which were the most common excuses consumers would come up with after using a service for anywhere up to 6 months and then yanking back all 6 months worth of payments and saddling the merchants with the loss of income, pay-outs to affiliates already made and additional charge-back fees on top of that. So even if the goal was a fairly noble one it looks as though the whole idea is predicated on one tiny little detail, which is that VBV is supposedly hack-proof, but in fact this is highly dependent on both your bank and the security of their implementation. Neither of those are as ironclad as they should be to remove all doubt. But of course the banks/card companies are not willing to end up holding the bag if there is trouble so it falls to the consumer to prove that they really were not involved in the transaction and that is very hard. On the positive side in this whole debate: Even if a consumer is defrauded there is always someone who benefits and following the money usually leads to the perp. That's why it is hard to order stuff online with credit cards that were not issued in the country that the person using them is from, that's why it is hard to spend your money on three different continents with the same credit card within a single day and so on. Lots and lots of money goes in to early warning fraud detection (before the fraud happens) and this nips a very large percentage of potential fraud in the bud.
- computator 14y ago
  > VBV is supposedly hack-proof Something very strange I noticed with Verified by Visa and with Mastercard Secure Code is that both sometimes forget that you have already enrolled and make you re-enroll (i.e., answer their weak "security questions", like date of birth, and then choose a password). It happened once with Verified by Visa and twice with Mastercard Secure Code so far. (No, my card numbers had not changed.) These systems can't be trusted to even reliably remember my previous password.
chris24 14y ago
I've only used VbV once or twice, years ago. Do they still use iframes? I've never understood why they try to make the site more "secure" by using these services, but then use an iframe so the average user can't easily confirm if the login screen is legit or not.
- jentulman 14y ago
  In the UK I see it occasionally. Oddly enough it's mainly when I order food online. It really peeves me that they are training people to accept entering sensitive information into something it would be so very easy to fake. There's nothing to prove that it is actually what it says it is. On top of that, if you forget your phrase the security question (the usual researchable ones) and answer sequence happens within the iframe without recourse to any external site or emails. As other comments have said, none of this is for the customers benefit.
huhtenberg 14y ago
Verified by Visa is a fucking joke. In Canada it pops up a browser window that prompts for various personal information and its URL points at ... drumroll ... https://secureserver.net https://secureserver.net. If that's not by the book appearance of a phishing site, I don't know what is.
- jodrellblank 14y ago
  Really? Because SecureServer.net is a domain used in GoDaddy's webmail: https://login.secureserver.net/ https://login.secureserver.net/
  - huhtenberg 14y ago
    I typed it from memory, so it might be off. Regardless though - the URL had "secure" and "server" in it, but no "visa".
- computator 14y ago
  It's actually https://www.securesuite.net https://www.securesuite.net. I very suspicious of that the first time I was subjected to Verified by Visa. The other thing that infuriated me about Verified by Visa is that when you are forced to sign up for it, it thanks you for choosing to sign up. The only choice I had was to sign up or not make the transaction!
Zarathust 14y ago
Somewhere in the thread he says that he started coding around operation payback. That is december 2010. I would assume that either he is truely a genius or that his abilities to program properly are limited.

njs12345 14y ago

I really wouldn't be surprised. The security group at my university do a lot of stuff on banking security, and from what I've heard, this was one of the main reasons behind the switch to chip-and-PIN in the UK --- the user is now liable when his card gets stolen and used.

DanBC 14y ago
Richard Clayton (etc) have lots of interesting stuff about bank security (and the lack of) - they've attacked chip and pin, which means that if someone does manage to defraud the card the owner might have some chance of getting the cash back.
shabble 14y ago
See, for example, Tetris on a ('secure hardware' platform) chip & pin machine[1] The same group (security research at cambridge) are also the ones who produced the 'chip and pin is a joke'[2] paper you might be referring to. [1] http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/ http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-termi... [2] http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...
mibbitier 14y ago
That's not really true. The user is liable if the card is stolen, and it is used to conduct fraud using the PIN code. If the card is stolen, and the fraudster simply uses it online, or via some place that doesn't ask for a PIN, then you are not liable for that fraud. I'm sure there are rare edge cases, but my experience with Barclays has always been very good in this regard.
- njs12345 14y ago
  The problem is that there is no way of knowing that the criminal even knows the user's PIN, due to flaws in the chip-and-PIN protocol. See http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...
  - FuzzyDunlop 14y ago
    And, from many years of personal experience, quite a lot of people don't treat their card and PIN securely. This might be in the form of (and these are genuine examples): 1. Writing the PIN on a post-it note and sticking it to the back of the card. 2. Writing the PIN on some paper and keeping it in the same place the card is kept. 3. Giving the card to someone else (partner, kids, relatives, etc.), along with the PIN, to run an errand for them. 4. Saying the PIN out loud as they type it in. 5. Asking the customer assistant/whoever is dealing with the transaction to enter the PIN for them. Chip&Pin, while claiming to be more secure, enabled and made convenient basic forms of fraud, such as that in points 3 and 5. I'd actually argue that the shifting of liability from the card issuer/merchant to the card holder/customer in the UK is a direct consequence of C&P allowing careless people to be more lax with the security of their card.
    - mibbitier 14y ago
      The worst thing is the chip+pin machines that do not have any shield to hide you punching the pin in, and then to just add insult to injury, they're the kind of buttons that you have to forcefully press with all your might to get them to register. So it's blatantly obvious to anyone taking notice which buttons you pressed.

coffeejunk 14y ago

at least for mastercard this is true: as per my banks tos i have to take care that nobody gains access my 'securecode' and i am liable for any unauthorized charges. (because the 'securecode' is supposed to guarantee that it is me who is using the card)

henrikschroder 14y ago

> Does anyone know if this (using verified-by-visa, mastercard-securecode remove any payment protection if you get key-logged etc) is correct? Yes. It's the whole point of the system, to remove even more risk from the CC companies and banks, and put it on you.

epoxyhockey 14y ago

My experience with mastercard-securecode is that I can just enter gibberish until it fails the check, then my purchase goes through anyway.

mey 14y ago

As someone in the financial payment industry, let me shed some light on it. 3DSecure (the generic name) when used, generally prevents the user from issuing chargebacks, even in the case of fraud. It's a Terms & Conditions change basically for that purchase. Since your credentials can be hijacked at your web browser level, it is possible to give up your credentials AND give up your ability to re-mediate the issue later. If you are purchasing stuff online, I advise using a credit card and CVV. Federal law (in the US) limits your damages to $50 total in the event of Fraud. (Not true of debit cards, or 3DSecure). http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure

aneth 14y ago
I'm not familiar with this service. What is the advantage to the consumer in exchange for losing their fraud liability protection?
- danudey 14y ago
  Nothing. This 'feature' is entirely designed to reduce the banks' liability. It shifts the onus of security onto you (from the banks and the merchants).
  - gregable 14y ago
    It sounds like in principle it might also reduce fraud overall. Thus, maybe 80% of the fraud goes away and 20% remains, but that liability is shifted to the consumer rather than the bank (who otherwise passes it to the merchant anyway). If the merchant has reduced fraud liability, they may be able to offer lower prices. So, in principle there might be a long-term win for the consumer. In practice, who knows.
    - aneth 14y ago
      I think the idea of a pin at checkout is a good one to reduce fraud. However this is more work for the consumer, and reduces the bank's liability. Most consumers would probably prefer this, as it makes their card more secure and reduces the possibility of fraud hassles, which are annoying regardless of liability. Having something that is more work for the consumer and could save the bank money switch the liability to the consumer is just obnoxious.

leif 14y ago

When a website asks me to use one of these, and I don't want to, how do I decline but still make the purchase? It always seems like my options are take-it-and-like-it or don't complete the transaction. Is there a third option?

czzarr 14y ago
wondering the same thing
el_presidente 14y ago
Paypal.
pmjordan 14y ago
I've had certain websites require VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank. The worst part is the information required for the "I forgot my password" process is often not terribly hard to get hold of (date of birth, that kind of thing). The best option at this stage is probably to have a "normal" credit card for everyday use which is specifically NOT VbV enabled, and a special VbV credit card that you keep at home for internet purchases from companies that require it. Or just don't buy from those companies.
- jacquesm 14y ago
  > I've had certain websites require VbV for purchases. I can only assume the transaction fees are lower for such transactions, or they got some kind of other deal from their merchant bank. Transaction fees are not the problem, putting a stop to consumer fraud and charge-backs are the net win for the merchant.
alexg0 14y ago
Use AmEx.
starwed 14y ago
I had this pop up today, the wording was pretty misleading. In my case not activating Secure By Visa let me proceed with the transaction normally, but they certainly tried to imply it was necessary.

jacquesm 14y ago

VBV (or 3D secure as it is called today) is part of a move by the credit card companies and the banks to push the risk to the most vulnerable party, the consumer. The idea is that this absolutely crack proof scheme requires you to authenticate yourself to your bank in a fairly complex three way handshake. In the old (read pre-VBV) days the card companies and issuing banks would saddle the merchants with any charges that were disputed using the chargeback mechanmism. Verified-by-Visa removes this safeguard by adding an additional layer of authentication which supposedly has the same strength as you being on-premise and signing on the dotted line to authorize your purchase. This will effectively remove a lot of the excuses that you might have had such as 'it wasn't me', 'I wasn't there' and 'I never meant to buy this', which were the most common excuses consumers would come up with after using a service for anywhere up to 6 months and then yanking back all 6 months worth of payments and saddling the merchants with the loss of income, pay-outs to affiliates already made and additional charge-back fees on top of that. So even if the goal was a fairly noble one it looks as though the whole idea is predicated on one tiny little detail, which is that VBV is supposedly hack-proof, but in fact this is highly dependent on both your bank and the security of their implementation. Neither of those are as ironclad as they should be to remove all doubt. But of course the banks/card companies are not willing to end up holding the bag if there is trouble so it falls to the consumer to prove that they really were not involved in the transaction and that is very hard. On the positive side in this whole debate: Even if a consumer is defrauded there is always someone who benefits and following the money usually leads to the perp. That's why it is hard to order stuff online with credit cards that were not issued in the country that the person using them is from, that's why it is hard to spend your money on three different continents with the same credit card within a single day and so on. Lots and lots of money goes in to early warning fraud detection (before the fraud happens) and this nips a very large percentage of potential fraud in the bud.

computator 14y ago
> VBV is supposedly hack-proof Something very strange I noticed with Verified by Visa and with Mastercard Secure Code is that both sometimes forget that you have already enrolled and make you re-enroll (i.e., answer their weak "security questions", like date of birth, and then choose a password). It happened once with Verified by Visa and twice with Mastercard Secure Code so far. (No, my card numbers had not changed.) These systems can't be trusted to even reliably remember my previous password.

chris24 14y ago

I've only used VbV once or twice, years ago. Do they still use iframes? I've never understood why they try to make the site more "secure" by using these services, but then use an iframe so the average user can't easily confirm if the login screen is legit or not.

jentulman 14y ago
In the UK I see it occasionally. Oddly enough it's mainly when I order food online. It really peeves me that they are training people to accept entering sensitive information into something it would be so very easy to fake. There's nothing to prove that it is actually what it says it is. On top of that, if you forget your phrase the security question (the usual researchable ones) and answer sequence happens within the iframe without recourse to any external site or emails. As other comments have said, none of this is for the customers benefit.

huhtenberg 14y ago

Verified by Visa is a fucking joke. In Canada it pops up a browser window that prompts for various personal information and its URL points at ... drumroll ... https://secureserver.net https://secureserver.net. If that's not by the book appearance of a phishing site, I don't know what is.

jodrellblank 14y ago
Really? Because SecureServer.net is a domain used in GoDaddy's webmail: https://login.secureserver.net/ https://login.secureserver.net/
- huhtenberg 14y ago
  I typed it from memory, so it might be off. Regardless though - the URL had "secure" and "server" in it, but no "visa".
computator 14y ago
It's actually https://www.securesuite.net https://www.securesuite.net. I very suspicious of that the first time I was subjected to Verified by Visa. The other thing that infuriated me about Verified by Visa is that when you are forced to sign up for it, it thanks you for choosing to sign up. The only choice I had was to sign up or not make the transaction!

Zarathust 14y ago

Somewhere in the thread he says that he started coding around operation payback. That is december 2010. I would assume that either he is truely a genius or that his abilities to program properly are limited.