5900 online stores found skimming • Hacker News Board

Re: 5900 online stores found skimming

#51

Post by codedokode » Sat, Oct 15, 2016, 2:08 PM UTC

anondon wrote: post #11

kalleboo wrote: post #9

Earlier quoted context omitted.

There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps…

3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA. To make a transaction: -add items to cart -enter card details -you are redirected to 3DSecure if it's enabled -you are redirected to a page of your bank where you enter a One time Password(OTP). It's a simple 6 digit number sent to your mobile phone and is unique for every transaction.Enter OTP. -transaction is confirmed. S…

3DScure is usually optional. Some merchants might opt out of using it (but then they take the liability for fraud) so criminals can still use your credentials.

Re: 5900 online stores found skimming

#52

Post by bemmu » Sat, Oct 15, 2016, 2:13 PM UTC

kalleboo wrote: post #10

notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

> it really hurts conversions This. We saw about 50% would prefer on-site transactions, 50% would prefer off-site transactions (PayPal or Amazon payments). Remove one of the options and half your customers just disappear.

Was about preference, or maybe most people just shrug and choose one at random?

Re: 5900 online stores found skimming

#53

Post by the_mitsuhiko » Sat, Oct 15, 2016, 2:20 PM UTC

And this is exactly why I do not understand why there is such a huge opposition against 3D Secure. It prevents this exact issue. Card fraud on 3D Secure pages that are well implemented (2nd factor with SMS or hardware device token) is non existent.

Re: 5900 online stores found skimming

#54

Post by Cyph0n » Sat, Oct 15, 2016, 2:20 PM UTC

4ad wrote: post #35

enraged_camel wrote: post #34

Earlier quoted context omitted.

>>If your site sacrifices user experience, I will hate your site. Simple as that. Even if said sacrifice keeps your credit card safe? I mean, if you are staying on the same site, you have no guarantees that the site isn't storing your credit card info in an unsecure manner.

I don't care about keeping my credit card safer that it already is. I am not liable for credit card fraud. In this insecure world we live in, I have not lost a single dime, nor any time, nor was I inconvenienced in any way by card theft. It's not my problem to worry about. My debit card was skimmed once, a few weeks ago. The bank detected fraud, notified me that they sent me a new card, and I didn't lost any money. I…

I'm assuming you ended up with no debit card for a few days at least. That's a huge inconvenience in my opinion.

Re: 5900 online stores found skimming

#55

Post by the_mitsuhiko » Sat, Oct 15, 2016, 2:21 PM UTC

3pt14159 wrote: post #40

gingerlime wrote: post #26

Earlier quoted context omitted.

> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it. Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?

The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.

Stripe does not use an iframe/redirect for protection.

Re: 5900 online stores found skimming

#56

Post by the_mitsuhiko » Sat, Oct 15, 2016, 2:22 PM UTC

codedokode wrote: post #47

The only reason this is possible is because card payment systems still are using transistor era technologies with zero cryptography. You get someone's card number and you can pay with it. All VISA security is based on trust. With Internet it doesn't work anymore because you never know who your customer is, you don't know what merchant does with card numbers and the laws are different in different countries. They also…

> The only reason this is possible is because card payment systems still are using transistor era technologies with zero cryptography.

Cryptography does not help here. The problem is that better transaction types (3d secure) are badly implemented by banks and as such not deployed because it's seen as an unnecessary second step.

Re: 5900 online stores found skimming

#57

Post by andybak » Sat, Oct 15, 2016, 2:24 PM UTC

3pt14159 wrote: post #40

gingerlime wrote: post #26

Earlier quoted context omitted.

> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it. Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?

The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.

That's not usually how Stripe integration works, is it?

Re: 5900 online stores found skimming

#58

Post by ek750 » Sat, Oct 15, 2016, 2:25 PM UTC

jjnoakes wrote: post #48

4ad wrote: post #33

Earlier quoted context omitted.

I am not liable for credit card fraud. The last thing in the world I want is inconvenience for me , when it's other people's money at risk (bank, merchant, CC company, whoever), not mine. On the other hand, Paypal itself is a liability. Blocking your account (and your money!) for months without recourse, randomly reducing expense limits to nothing (50 EUR) are not just some Internet stories, but things that have happ…

You aren't liable for credit card fraud, but that money comes from somewhere. Today it is a small percentage charged to the vendor; do they pass it on? And tomorrow, when the problem gets worse and the fees start to climb, will you still not care? Why be content with a system that may indirectly charge you for other people's lack of security? Why not look for ways to focus the cost on the vendors who lack security?

Yes, you're right, they pass it on. But as costs start to get noticible to the involved parties (direct and indirect), hopefully that would prod the ones that don't care now, to start.

Re: 5900 online stores found skimming

#59

Post by mrb » Sat, Oct 15, 2016, 2:27 PM UTC

phil21 wrote: post #36

cillian64 wrote: post #29

Earlier quoted context omitted.

I don't understand this at all. I really, really don't want to give my credit card details to some random webshop who are exceedingly unlikely to have solid security. If I can use PayPal or another well known payment provider, great, I don't even have to type in my details. But even a less well known PSP is more likely to get it right than a small business webshop. A slightly jarring user interface seems a small pric…

> Is this a minority view? I don't know, maybe. I have zero liability on credit card purchases, and while it's certainly an inconvenience I never don't buy something because my details might be leaked. Who cares, why put yourself through the constant mental effort for an event that happens maybe once or twice a decade if you are exceedingly careless? I absolutely despise being sent to a third party site - usually a b…

"I have zero liability on credit card purchases"

Not quite right. Many banks make you liable for the first $50, for each occurrence of fraud. Also they typically require you to notice and report a fraudulent charge within 30-90 days or else you are liable for 100% of the amount.

Re: 5900 online stores found skimming

#60

Post by zrail » Sat, Oct 15, 2016, 2:32 PM UTC

the_mitsuhiko wrote: post #55

3pt14159 wrote: post #40

Earlier quoted context omitted.

The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.

Stripe does not use an iframe/redirect for protection.

Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.