191–200 of 208 posts
Earlier quoted context omitted.
Just for the record, as a Dutch person, Holland refers to the two provinces North and South Holland and there is more to the country than just that. The Netherlands would be more accurate.
Sorry about that. In future I'll be more careful to write The Netherlands.
We ran an online store selling merchandise for a very large mobile-game vendor, so naturally we experienced these types of fraud attempts. For us, there's one killer technique. Detect fraud however you want to / can (this can be a mix of heuristic data from your stats, third party, or whatever you want) - but when you detect it - don't decline the user. Send them to a fake purchase confirmation page. Suddenly they'll…
Earlier quoted context omitted.
Living in Holland, where everyone does online transactions with iDeal, I find it hard to understand why the rest of the world is using credit card payments at all, for anything. It is massively insecure, it's expensive for the merchant, and theft is ignored (when millions of stored creditcard records are stolen, those cards are not invalidated and replaced?). This is all at the cost of customers and other merchants.…
Having visited NL, my card was practically useless. Any other country no problem, but Netherlands? So I don't understand you really. That being said, direct payment gateways are common, but they require cooperation with banks. There's probably hundreds of them and only make sense on local market where you can have on or two implemented to satisfy 80%+ of customers (and others will just use regular card).
Earlier quoted context omitted.
How can they not be willing to pay a transaction fee from even PayPal for donations? Seems their options right now is to take donations via a service like Paypal with a transaction fee, or just take no donation.
They may actually not have a choice. My wife is a lawyer who does a lot of work with non-profits, and maintaining non-profit status can require jumping through a lot of legal hoops. A quick google suggests GBCA is a 501(c)3 non-profit, so it's very possible that adding a gateway in front of a donation that is tax deductible may create some legal risk (real or perceived), or be outright not allowed by current laws.
Earlier quoted context omitted.
I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")
> is there a way to require someone to enter the pin that they use when they buy something in person A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay o…
Earlier quoted context omitted.
3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…
Re: Conversion rates, as a consumer I have got used to it and it does not affect conversion for me at all. Everyone uses it now in the UK and you always get redirected to the exact same page. I expect it, it doesn't put me off buying. So it's a bad objection to the system, because once everyone's using it, it becomes the norm. Yes, there will be a dip in conversions to begin with as consumers are scared by the new pa…
https://econsultancy.com/blog/3887-verified-by-visa-a-conver...
Visa's own documents now recommend only using Verified By Visa on transactions that look suspicious after running risk analysis, and cite that using it on all transactions was resulting in a 3 - 5% Abandonment rate in the UK.
"Higher conversion rates – following the implementation, abandonment dropped from over 4% to under 1%"
http://www.visaeurope.com/media/images/44933_visa_vbv_case_s...
Earlier quoted context omitted.
> My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc. How can the bank know what any of the letters in your password are unless they are storing it insecurely?
They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose. It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 charac…
Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.
Earlier quoted context omitted.
The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it. My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
> My bank asks for three random characters from my online banking password... That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.
Couldn't you do a preauth on the cards and then completion when you are ready to ship? At least then you don't get hit with chargebacks.
Last time I talked with a credit card company, they wouldn't even let me file a chargeback until 30 days after the transaction. How would this stop chargebacks?
You can complete the transaction by sending a 'completion' request, at which point the credit is gone.
The preauth also has an expiry. If the preauth expires, the funds are released with no transaction taking place.
So when a user signs up, take a preauth. If you have any reporting on your sales, like this guy, you can check for any anomalies before fulfilling orders. Anything that looks odd, don't complete the order.
Earlier quoted context omitted.
They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose. It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 charac…
It's not consecutive characters, it's a random set of three. One time it might ask me for the 1st, 6th, and 8th characters. The next time for the 6th, 7th, and 9th. Passwords are required to be at least 8 characters and contain a mix of letters and numbers. Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface…
The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.