4 ms·

> UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions. Ahh, 3D Secure/Verifi

> UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions. Ahh, 3D Secure/Verified By Visa/MasterCard SecureCode. It really needs to die right now. Basically it teachers consumers to fill in random iframes on merchant sites. And the fact that the card industry thinks 3D Secure is secure or in any way a good idea is why they'll never make standardised forms.

pjc50 11y ago
"Please type in a whole load of other personal information" Nope! I get a good feeling of petty bureaucratic victory every time I see a site bounce in and out of Verified by Visa since I persuaded my bank to opt me out.
junto 11y ago
The worst thing about these programs is the liability shift. Normally the merchant is left on the hook for fraudulent transactions. With VbV and 3DS that liability passes back to the credit card company. Since the credit card company doesn't want that liability, and obviously there are no security holes in their system, then only one person can be responsible for not taking adequate care of their card and security details. Yep, you the consumer (read your small print). Hence, by signing up for any of these programs as a consumer, you are shooting yourself in the foot. Added to which, the program has been shown to be insecure, since if you hold the card in your hand (i.e. you skimmed the card), you can/could simply choose to reset your password: http://www.alphr.com/realworld/373768/the-security-hole-in-verified-by-visa http://www.alphr.com/realworld/373768/the-security-hole-in-v...
- tommorris 11y ago
  Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.
  - david-given 11y ago
    I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it. If you know how to opt out of it, I'd love to know.
    - itsybitsycoder 11y ago
      It does seem to work that way, I'm sure I've signed up for Verified by Visa but I've only had to use it once or twice. Which makes me happy, because I hate it.
    - tommorris 11y ago
      A friend of mine told me his bank let him opt out. He just pestered them a lot.
- kalleboo 11y ago
  The implementation is up to the bank. My banks use 2-factor authentication solutions for 3DSecure (one has you put the chip in a special reader, the other uses a mobile app) https://www.flickr.com/photos/kalleboo/2486214902 https://www.flickr.com/photos/kalleboo/2486214902
joosters 11y ago
Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!
- david-given 11y ago
  Worse than that, it's all bounced through a site called securesuite.co.uk. Take a look: https://securesuite.co.uk/ https://securesuite.co.uk/ Impressed?
fidz 11y ago
It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty much have freedom in it. You can choose 2D / 3DS. Yes, the different is pretty clear: who will responsible for the fraud. For 2D, merchant is responsible for fraudulent transaction -- and merchant can be charged back; while in 3DS the merchant will free from chargeback (hey you have been notified via two-factor authentication, so it is your fault, customer!) Meanwhile, in Malaysia, all credit card transaction must be in 3DS.

pjc50 11y ago

"Please type in a whole load of other personal information" Nope! I get a good feeling of petty bureaucratic victory every time I see a site bounce in and out of Verified by Visa since I persuaded my bank to opt me out.

junto 11y ago

The worst thing about these programs is the liability shift. Normally the merchant is left on the hook for fraudulent transactions. With VbV and 3DS that liability passes back to the credit card company. Since the credit card company doesn't want that liability, and obviously there are no security holes in their system, then only one person can be responsible for not taking adequate care of their card and security details. Yep, you the consumer (read your small print). Hence, by signing up for any of these programs as a consumer, you are shooting yourself in the foot. Added to which, the program has been shown to be insecure, since if you hold the card in your hand (i.e. you skimmed the card), you can/could simply choose to reset your password: http://www.alphr.com/realworld/373768/the-security-hole-in-verified-by-visa http://www.alphr.com/realworld/373768/the-security-hole-in-v...

tommorris 11y ago
Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.
- david-given 11y ago
  I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it. If you know how to opt out of it, I'd love to know.
  - itsybitsycoder 11y ago
    It does seem to work that way, I'm sure I've signed up for Verified by Visa but I've only had to use it once or twice. Which makes me happy, because I hate it.
  - tommorris 11y ago
    A friend of mine told me his bank let him opt out. He just pestered them a lot.
kalleboo 11y ago
The implementation is up to the bank. My banks use 2-factor authentication solutions for 3DSecure (one has you put the chip in a special reader, the other uses a mobile app) https://www.flickr.com/photos/kalleboo/2486214902 https://www.flickr.com/photos/kalleboo/2486214902

joosters 11y ago

Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!

david-given 11y ago
Worse than that, it's all bounced through a site called securesuite.co.uk. Take a look: https://securesuite.co.uk/ https://securesuite.co.uk/ Impressed?

fidz 11y ago

It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty much have freedom in it. You can choose 2D / 3DS. Yes, the different is pretty clear: who will responsible for the fraud. For 2D, merchant is responsible for fraudulent transaction -- and merchant can be charged back; while in 3DS the merchant will free from chargeback (hey you have been notified via two-factor authentication, so it is your fault, customer!) Meanwhile, in Malaysia, all credit card transaction must be in 3DS.