Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verified by Visa and Mastercard SecureCode are broken and need to be fixed

cxpartners.co.uk

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#31

Post by limmeau »

Nitramp wrote: post #6

He's only complaining about UX, but the bigger problem is that this doesn't actually make things much more secure. It is already really hard to teach casual computer users about security online. The one thing that used to work so far was "never enter your password on a website you've been redirected to" and "always check the site's identity in the address bar". Verified by Visa redirects you to some website on some r…

There's eFaktura in Norway[1]. Merchants send their bills to you electronically, and you pay them through your homebanking interface. As I never used it when I lived there, I don't know if the mechanism is fast enough for immediate purchases.

1. http://en.wikipedia.org/wiki/EFaktura

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#32

Post by Vivtek »

mechanical_fish wrote: post #15
patio11 wrote: post #14

Earlier quoted context omitted.

That is, in fact, the exact opposite of how the banks operate. You are limited to $50 in liability for any fraudulent transaction in your account that you report in a timely fashion, guaranteed by law (in the US at least), and every bank I am aware of waives the $50 for marketing purposes. Essentially all financial risk for credit card transactions is borne by the merchants. (Which is one reason why the banks don't s…

While we are in public-service-announcement mode: I believe that the above protections are still a lot smaller for debit cards than credit cards. You still have $50 limit on liability with debit cards, but you must report the theft very quickly indeed and the thief is emptying your personal account in the meantime: http://banking.about.com/od/checkingaccounts/a/stolendebitca... This is why I never use a debit card fo…

In defense of debit cards, in the event you do lose it and someone's emptying your account, your bank should still restore your funds after the theft. I say this because it happened to my wife; Chase's fraud prevention kicked in after about $300, all of which was refunded as soon as she figured out what had happened.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#33

Post by swombat »

patio11 wrote: post #14
CaptainZapp wrote: post #2

Even though there's no choice (here at least, when you want to use your Visa over the internet) I HATE, HATE, HATE the concept and here's why: For starters I thought it's a phishing attack, when the frame popped up for the first time. But the worst is that I don't feel it protects me, despite the marketing crap dished out by CC companies. The only reason is to protect Visa. What happens if I book a flight at a badly…

That is, in fact, the exact opposite of how the banks operate. You are limited to $50 in liability for any fraudulent transaction in your account that you report in a timely fashion, guaranteed by law (in the US at least), and every bank I am aware of waives the $50 for marketing purposes. Essentially all financial risk for credit card transactions is borne by the merchants. (Which is one reason why the banks don't s…

This is not quite true in the context of 3D Secure.

You are correct in that this is how banks operated before 3D Secure. They shift all the fraud liability onto the hapless merchant and then charge them through the nose (with both the amount and the chargeback $35, as well as a potential disabling of the merchant account if it has more than 1% of fraud - which is easier to achieve that you'd think, especially if you're low-volume, e.g. if you're a small business or startup).

The purpose of 3DSecure is to "fix" this situation in favour of the merchants. Do the card companies (VISA & Mastercard, basically) now take on liability for fraud? OF COURSE NOT. With 3D Secure, they have shifted the liability from the merchant straight to the issuing bank, which can choose whether to pass it on to the cardholder, and sometimes does. It's really entirely up to them. Also, it's worth pointing out that a lot of credit card fraud is only detected months later, so "in a timely fashion" may be excessively difficult to achieve.

Now, the question to ask is, who actually benefits from 3DSecure?

- The merchants

That's it. Who bears the burden of getting everyone to sign up to 3DSecure?

- The issuing banks

Who stands to lose money if the merchants are protected?

- The issuing banks

In view of this, it's no surprise that implementations are shoddy and many people are not signed up. Why would the issuing banks want to push a scheme that makes them lose money?

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#34

Post by cobralibre »

omh wrote: post #12

VbV is badly broken, but the suggestions here miss one of the most important points. The use of an iframe means that users can't tell where VbV is coming from and can't be sure either that it is secured or that it's really coming from the bank. This is just begging for copycat phising and MITM attacks.

This is an important point. 3DS actually trains cardholders to trust web content whose identity/authenticity they cannot verify. At the very least, the third parties that host 3DS content should be serving their content from the Visa and Mastercard domain names. (Requesting the 3DS authentication inline with the merchant's checkout flow is a no-go, though, because the merchant site could be compromised.)

I'm reminded of how my credit card issuer contracts out transaction verification to a third party, so whenever I make a large purchase, I get a phone call originating from a 1-800 number that doesn't match the one on my card, and the first thing they ask from me is sensitive information.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#35

Post by thisisblurry »

jasonlotito wrote: post #22
thisisblurry wrote: post #7

Every now and then when I purchase something from a Verified by Visa-"friendly" site (Newegg comes to mind), I often find that I'm able to complete the purchase without entering my password. It's disturbing to say the least.

3DS doesn't work that way. It's not mandatory. Newegg isn't using it to fight friendly fraud. They are using it to fight actual fraud. You've done it once, why should they force it on you again? You are who you say you are, and if their is a problem with your purchase, they're confident that they can resolve it without a chargeback.

But then why bother using it at all? Do they assume that no one malicious could ever get into my account (for argument's sake)? If you're going to make me set a password, make me enter it each time I "use" your service. My gripe isn't with the vendors per sé, but with how Verified by Visa and SecureCode operate.

I'd much rather type an extra password during the checkout process instead of being charged $700 for hardware and Windows Vista DVDs (thieves aren't always the brightest).

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#36

Post by Tibbes »

jessriedel wrote: post #27

Could someone tell me why this idea wouldn't work?: Your credit card comes with a simple communication port (usb, bluetooth, whatever) and a two line B&W text LCD display (like on cryptocards or cheap electronic watches). Every time you want to buy something, you connect the card with the merchant. (This works in person and over the internet.) The merchants sends the card an official merchant name ("Delta Airlines"),…

A very similar system is already in use in the UK and other parts of Europe. It's called "chip & pin". You plug your card in to a card reader and check the LCD display and type in your PIN to authorise a transaction.

In a shop, the card reader is owned by the shop and is similar to point-of-sale card readers used in the USA. However, most banks now provide customers with a small reader (that looks like a calculator) for logging on to online banking, or authorising payments made via internet banking.

For example, to authorise a payment you: put your card into the reader, type in the account number you want to pay, type in the amount, and type in your pin. You then get an cryptographic authorisation code to type into online banking.

Crucially, the scheme works using cryptography, and the cryptography is performed within the chip on the bank card - it is not possible to read the PIN off the card.

(edit: and, in contrast to the scheme described in the parent post, stealing a card doesn't help much if you don't know the PIN, and the card will disable itself if the wrong PIN is used too many times)

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#37

Post by mechanical_fish »

Vivtek wrote: post #32
mechanical_fish wrote: post #15

Earlier quoted context omitted.

While we are in public-service-announcement mode: I believe that the above protections are still a lot smaller for debit cards than credit cards. You still have $50 limit on liability with debit cards, but you must report the theft very quickly indeed and the thief is emptying your personal account in the meantime: http://banking.about.com/od/checkingaccounts/a/stolendebitca... This is why I never use a debit card fo…

In defense of debit cards, in the event you do lose it and someone's emptying your account, your bank should still restore your funds after the theft. I say this because it happened to my wife; Chase's fraud prevention kicked in after about $300, all of which was refunded as soon as she figured out what had happened.

Thanks, good to know. I've been waiting for these policies to kick in as debit cards become more popular.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#38

Post by Splines »

jessriedel wrote: post #27

Could someone tell me why this idea wouldn't work?: Your credit card comes with a simple communication port (usb, bluetooth, whatever) and a two line B&W text LCD display (like on cryptocards or cheap electronic watches). Every time you want to buy something, you connect the card with the merchant. (This works in person and over the internet.) The merchants sends the card an official merchant name ("Delta Airlines"),…

> slightly less durable

That might be the deal-breaker here. People with wallets sit on their credit cards daily. I've split the plastic on mine a few times, even though I've gotten into the habit of taking my wallet out when I sit down.

Credit card purchase authorization over SMS might be more sturdy, although that has its own security considerations (I think this exists somewhere already though).

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#39

Post by RickHull »

omh wrote: post #12

VbV is badly broken, but the suggestions here miss one of the most important points. The use of an iframe means that users can't tell where VbV is coming from and can't be sure either that it is secured or that it's really coming from the bank. This is just begging for copycat phising and MITM attacks.

Yes, this article is long on alarmism and short on serious critique:

> The design of the form does not match the design of either the merchant or the issuing bank. The design looks ‘cheap’. It doesn’t look trustworthy.

> No telephone number. When a user sees a telephone number it gives them a feeling legitimacy. They may not phone, they just want to see the number just in case.

> The calls to action at the bottom of the page really don’t work. ‘Submit’ is rather generic and does not give an indication of the next step. ‘Cancel’ gives no indication what will happen next and really should be removed.

> There is still very little recognition by users. Visa and Mastercard have done a poor job of marketing and raising awareness.

> The text is American "Expiration date" should be "Expiry date"

> Once the customer has overcome all 11 of those issues they can purchase. 11 issues. 11 serious issues.

Serious issues? Let's tally: cheap design, no phone number, button names, lack of marketing, bad copy. These are not serious issues that make a technology "broken" -- at least, not in the sense that, say, MD5 is broken. The points about the phone number, cheap design, and lack of marketing should not even be in this list.

And then there is this gem, from the guy who is going to fix our "broken" security technology:

> Firstly, the URL, well that’s an easy one, embed the page within an iframe. It does of course mean one can’t check the security certificate but hey, who ever does this?

> About the author: Joe specialises in designing every aspect of the user experience from initial research to developing a robust, measurable online strategy to producing beautiful, easy to use wireframes and website information architectures.

Oh, I see.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#40

Post by T-hawk »

mechanical_fish wrote: post #15
patio11 wrote: post #14

Earlier quoted context omitted.

That is, in fact, the exact opposite of how the banks operate. You are limited to $50 in liability for any fraudulent transaction in your account that you report in a timely fashion, guaranteed by law (in the US at least), and every bank I am aware of waives the $50 for marketing purposes. Essentially all financial risk for credit card transactions is borne by the merchants. (Which is one reason why the banks don't s…

While we are in public-service-announcement mode: I believe that the above protections are still a lot smaller for debit cards than credit cards. You still have $50 limit on liability with debit cards, but you must report the theft very quickly indeed and the thief is emptying your personal account in the meantime: http://banking.about.com/od/checkingaccounts/a/stolendebitca... This is why I never use a debit card fo…

It's worth noting that the mere _existence_ of a debit card on a checking account still opens a fraud vector, even if you never use it. If the physical card is stolen, or the bank has a security breach where the number is obtained, those are both enough information to make fraudulent transactions. Of course, using a debit card will greatly enlarge the attack surface, but not using it does not make you immune.
Post reply on HN