4 ms·

My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If

• derefr 2y ago
  > My banks as for a password in that iframe. Not done type of one-time-code. Maybe there's an option for this that a bank can choose when "enabling" 3D Secure? Seems stupid, though. Never experienced it personally. > If it was just an OTP why would yhe iframe even be necessary? 90% of 3D Secure isn't the user interaction, it's browser integrity checking and permacookie-based submission deduplication. Essentially the iframe delivers a payload similar to the one used by Cloudflare Turnstile. That kind of thing could run in the context of a website (like Cloudflare Turnstile does), but it's a lot easier to manage when it's on its own secure origin without other scripts able to mess with it.
• jonathanlydall 2y ago
  It’s not necessarily an OTP, it’s any form of additional verification that the bank decides to implement. My bank allows me to switch between SMS or USSD. When in France in late 2000s the bank did a stupid “virtual PIN pad”, which I suppose was better than nothing, but only barely. But the point is that the system could allow any kind of verification including new and modern Passkeys.