4 ms·
(American) I experienced something like this the first time in my life yesterday when buying Skype credit. After entering my info at Skype, I was redirected to
by danneu 14y ago
(American) I experienced something like this the first time in my life yesterday when buying Skype credit. After entering my info at Skype, I was redirected to a "Verified by Visa"[0] page that made me type in my bank credentials.
I wish this sort of thing was universal.
[0]: https://usa.visa.com/personal/security/vbv/index.jsp https://usa.visa.com/personal/security/vbv/index.jsp
- chrisbolt 14y agoVerified by Visa has a pretty bad design flaw: the recommended implementation uses an iframe to load the page that prompts for your password, so it's not obvious if that iframe is legitimate or a phishing attack.
- ljoshua 14y agoAlso, VbV unloads a lot of the security burden to the consumer: http://news.ycombinator.com/item?id=1909862 http://news.ycombinator.com/item?id=1909862
- CaptainZapp 14y agoHere's a scenario: I'm in a dodgy internet cafe with a key logger somewhere in Thailand. I need to book a flight and the airline insists on my "Verified By Visa" credentials. Who do you think my bank blames (even though they state that they won't) when somebody goes on a shopping spree with not only my CC # and my security code, but also my VbV password? As another poster mentioned: It's offloading the risk to the card holder. Something like a token, or two factor authentication would be a lot better.
- semanticist 14y agoVerified by Visa (AKA '3D Secure') is a huge pain, and in all bank implementations that I've used in the UK it's trivial to reset the password. My current account is with LloydsTSB and they now don't bother asking for your 3D Secure credentials and just go straight to the 'accepted' callback, because it pissed off so many of their customers.