6 ms·
> Is this form safe and secure? We just add a lock icon, sure it's secure. Lock means secure, right? Joke aside sure, it's not the designer's fault. Every time
by leni536 11y ago
> Is this form safe and secure?
We just add a lock icon, sure it's secure. Lock means secure, right?
Joke aside sure, it's not the designer's fault. Every time I fill out a credit card form without even pulling out my card I cringe. Why do I need a physical credit card for this, I just authenticated myself with only something I know and not something I own and I know. And my authentication credentials are just written down on a piece of plastic. Why don't banks just host openid servers so I could authenticate myself and pay using that? It would be even more secure and convenient. Credit card security (for most card types) is a joke.
- kuschku 11y agoWell, they actually do that – you could just pay per wire transfer (Überweisung) if you live in the SEPA, especially in DACH it’s more common. Bank-Authenticated direct-debit (like giropay.de) is also useful for this.
- pjc50 11y agoInteresting. I was going to say "there's no web UI for driving the SEPA system from a merchant's site", but is that what Giropay is? Bank authentication systems themselves aren't great here in the UK. I'd be much happier with a USB/Bluetooth gizmo that behaved like a chip+pin terminal+card combo: display the value on the device, confirm payment with a pin/password on the device, bypass the PC's possibly-compromised keyboard and display entirely.
- kuschku 11y agoThat’s exactly what GiroPay is. The merchant can use it as simple as they can use PayPal, but GiroPay then redirects you to the online banking backend of your bank. Depending on bank, this can use 2-Factor authentication, SmartCards, etc. Most banks use Smart Cards and 2-Factor authentication.
- taejo 11y agoBTW, DACH here is presumably the trilingual abbreviation "Deutschland, Austria, Confoederatio Helvetica", i.e., Germany, Austria and Switzerland.
- kuschku 11y agoWell, D, A and CH are the international symbols for these countries, so the abbreviation makes sense.
- nothrabannosir 11y agoMastercard SecureCode does this. I'm seeing it more and more. My bank implements it using hardware 2fa; a separate dongle that reads my CC, asks for my PIN and a transaction salt (or QR scan) and computes some hash (?) from it. It's actually very frustrating when I don't have the 2fa device on me.
- leni536 11y agoYeah, I know MasterCard SecureCode. I have two bank accounts, one bank implements it using 2fa and uses SMS as the second factor, still no need for the card. The other bank doesn't implement it at all. And you still have to enter your credit card info, while the actual authentication actually has little to do with it.
- tommorris 11y agoSmartphones may fix this. With Apple Pay, I now get iOS notifications for all the purchases on my Amex card. Barclays now let me use their iPhone app as a software 2FA (bank-specific hardware 2FA needs to die—not being able to check your online banking at the office or whatever is a major PITA). Both Barclays and NatWest have TouchID in their iOS apps. I'm hopeful that mobile might lead the banks and card issuers to turn this ship around and make things less crap.