3 ms·

Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random web

Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random websites. (Actually your password manager might fill in the password as it knows the domain of the iframe, but this is more luck than skill on behalf of the financial industry)

derefr 2y ago
No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.
- kevincox 2y ago
  My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.
  - derefr 2y ago
    > My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.
  - jonathanlydall 2y ago
    It’s not necessarily an OTP, it’s any form of additional verification that the bank decides to implement. My bank allows me to switch between SMS or USSD. When in France in late 2000s the bank did a stupid “virtual PIN pad”, which I suppose was better than nothing, but only barely. But the point is that the system could allow any kind of verification including new and modern Passkeys.
maest 2y ago
This is widely used in Europe and it's secure. Nobody gets confused by it and they understand they are interacting with their bank
- kevincox 2y ago
  You are missing the point. You expect that you are interacting with the bank but the average person has no way to verify this. They are just conditioned to type their bank password into a random site after their credit card number. A malicious site could just put up a box that looks like the bank's regular authentication page and skim the extra authentication. Either replaying OTPs or capturing other credentials. Unless you used the developer functions of your browser to check the iframe URL there is no way to tell the difference between a real 3D Secure page and a phishing clone.
  - maest 2y ago
    Okay. Doesn't change the fact that it is widely used in Europe and it's secure.

derefr 2y ago

No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.

kevincox 2y ago
My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.
- derefr 2y ago
  > My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.
- jonathanlydall 2y ago
  It’s not necessarily an OTP, it’s any form of additional verification that the bank decides to implement. My bank allows me to switch between SMS or USSD. When in France in late 2000s the bank did a stupid “virtual PIN pad”, which I suppose was better than nothing, but only barely. But the point is that the system could allow any kind of verification including new and modern Passkeys.

maest 2y ago

This is widely used in Europe and it's secure. Nobody gets confused by it and they understand they are interacting with their bank

kevincox 2y ago
You are missing the point. You expect that you are interacting with the bank but the average person has no way to verify this. They are just conditioned to type their bank password into a random site after their credit card number. A malicious site could just put up a box that looks like the bank's regular authentication page and skim the extra authentication. Either replaying OTPs or capturing other credentials. Unless you used the developer functions of your browser to check the iframe URL there is no way to tell the difference between a real 3D Secure page and a phishing clone.
- maest 2y ago
  Okay. Doesn't change the fact that it is widely used in Europe and it's secure.