3 ms·

You could do all that, or just require PINs for credit purchases. They're not near as good as passwords, but PINs are still much, much better than nothing.

wmf 2y ago
This isn't really a thing in the US. (Technically 3D Secure exists but customers will just bounce.)
- kevincox 2y ago
  Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random websites. (Actually your password manager might fill in the password as it knows the domain of the iframe, but this is more luck than skill on behalf of the financial industry)
  - derefr 2y ago
    No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.
    - kevincox 2y ago
      My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.
      - derefr 2y ago
        > My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.
      - jonathanlydall 2y ago
        It’s not necessarily an OTP, it’s any form of additional verification that the bank decides to implement. My bank allows me to switch between SMS or USSD. When in France in late 2000s the bank did a stupid “virtual PIN pad”, which I suppose was better than nothing, but only barely. But the point is that the system could allow any kind of verification including new and modern Passkeys.
  - maest 2y ago
    This is widely used in Europe and it's secure. Nobody gets confused by it and they understand they are interacting with their bank
    - kevincox 2y ago
      You are missing the point. You expect that you are interacting with the bank but the average person has no way to verify this. They are just conditioned to type their bank password into a random site after their credit card number. A malicious site could just put up a box that looks like the bank's regular authentication page and skim the extra authentication. Either replaying OTPs or capturing other credentials. Unless you used the developer functions of your browser to check the iframe URL there is no way to tell the difference between a real 3D Secure page and a phishing clone.
      - maest 2y ago
        Okay. Doesn't change the fact that it is widely used in Europe and it's secure.
- publicola1990 2y ago
  But why is that so? Can't the credit card regulator simply mandate the use of PINs for credit card transactions.
  - wmf 2y ago
    Practically no. Customers would hate it and it would also take 10-15 years to roll out.
    - publicola1990 2y ago
      Customers in many other countries have no problem with it. Other large countries have rolled it out fairly quickly.
- jonathanlydall 2y ago
  It boggles my mind that the whole US has this outrageous amount of fraud because they’re complete laggards with what is pretty much standard additional security measures everywhere else. Look at how long it took them to move to chips on their cards. And I heard they initially required signatures instead of safer PINs, I hope they’re on PINs by now, but I don’t know. If stores are worried that if they implement things like 3D Secure their customers will go to their competitor which do not, then the solution is simple, make it a regulatory requirement that EVERYONE must do it by a particular date. Merchants will still try claim that it will confuse customers, but the truth is they would prefer to avoid the hassle of implementing it. The problem is these merchants already build the cost of fraud into their prices, in essence they’re passing on the cost of fraud to all their honest customers. Also, how much time is collectively wasted by people having to deal with the admin of fraud on their credit card which is also largely due to apathetic merchants. It would be a NETT benefit to US society if 3D secure was mandated. And not just in the US, the rest of the world would no longer have to suffer with fraud on their credit card where it was used on a US website which doesn’t have 3D Secure.
Muromec 2y ago
Or do the sensible thing, which is a proper active confirmation from customer's device. It's more convenient too -- you just scan the payment qr code with your bank's app and click confirm instead of entering any numbers.

wmf 2y ago

This isn't really a thing in the US. (Technically 3D Secure exists but customers will just bounce.)

kevincox 2y ago
Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random websites. (Actually your password manager might fill in the password as it knows the domain of the iframe, but this is more luck than skill on behalf of the financial industry)
- derefr 2y ago
  No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.
  - kevincox 2y ago
    My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.
    - derefr 2y ago
      > My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.
    - jonathanlydall 2y ago
      It’s not necessarily an OTP, it’s any form of additional verification that the bank decides to implement. My bank allows me to switch between SMS or USSD. When in France in late 2000s the bank did a stupid “virtual PIN pad”, which I suppose was better than nothing, but only barely. But the point is that the system could allow any kind of verification including new and modern Passkeys.
- maest 2y ago
  This is widely used in Europe and it's secure. Nobody gets confused by it and they understand they are interacting with their bank
  - kevincox 2y ago
    You are missing the point. You expect that you are interacting with the bank but the average person has no way to verify this. They are just conditioned to type their bank password into a random site after their credit card number. A malicious site could just put up a box that looks like the bank's regular authentication page and skim the extra authentication. Either replaying OTPs or capturing other credentials. Unless you used the developer functions of your browser to check the iframe URL there is no way to tell the difference between a real 3D Secure page and a phishing clone.
    - maest 2y ago
      Okay. Doesn't change the fact that it is widely used in Europe and it's secure.
publicola1990 2y ago
But why is that so? Can't the credit card regulator simply mandate the use of PINs for credit card transactions.
- wmf 2y ago
  Practically no. Customers would hate it and it would also take 10-15 years to roll out.
  - publicola1990 2y ago
    Customers in many other countries have no problem with it. Other large countries have rolled it out fairly quickly.
jonathanlydall 2y ago
It boggles my mind that the whole US has this outrageous amount of fraud because they’re complete laggards with what is pretty much standard additional security measures everywhere else. Look at how long it took them to move to chips on their cards. And I heard they initially required signatures instead of safer PINs, I hope they’re on PINs by now, but I don’t know. If stores are worried that if they implement things like 3D Secure their customers will go to their competitor which do not, then the solution is simple, make it a regulatory requirement that EVERYONE must do it by a particular date. Merchants will still try claim that it will confuse customers, but the truth is they would prefer to avoid the hassle of implementing it. The problem is these merchants already build the cost of fraud into their prices, in essence they’re passing on the cost of fraud to all their honest customers. Also, how much time is collectively wasted by people having to deal with the admin of fraud on their credit card which is also largely due to apathetic merchants. It would be a NETT benefit to US society if 3D secure was mandated. And not just in the US, the rest of the world would no longer have to suffer with fraud on their credit card where it was used on a US website which doesn’t have 3D Secure.

Muromec 2y ago

Or do the sensible thing, which is a proper active confirmation from customer's device. It's more convenient too -- you just scan the payment qr code with your bank's app and click confirm instead of entering any numbers.