Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verified by Visa and Mastercard SecureCode are broken and need to be fixed

cxpartners.co.uk

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#51

Post by m_eiman »

limmeau wrote: post #31
Nitramp wrote: post #6

He's only complaining about UX, but the bigger problem is that this doesn't actually make things much more secure. It is already really hard to teach casual computer users about security online. The one thing that used to work so far was "never enter your password on a website you've been redirected to" and "always check the site's identity in the address bar". Verified by Visa redirects you to some website on some r…

There's eFaktura in Norway[1]. Merchants send their bills to you electronically, and you pay them through your homebanking interface. As I never used it when I lived there, I don't know if the mechanism is fast enough for immediate purchases. 1. http://en.wikipedia.org/wiki/EFaktura

It's not fast enough. Money arrives next day, at best.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#52

Post by omh »

calloc wrote: post #46
omh wrote: post #13

Earlier quoted context omitted.

What happens if I book a flight at a badly infected internet cafe computer in Chiang Mai and a key logger reads my password Does VbV make this any worse? It's very difficult to protect against (other than "never use untrusted computers").

This is why two-factor authentication should be required.

When making a payment? I love the idea of forcing two-factor auth for online banking, but if it was required every time I wanted to spend £5 at a bookstore I think it could get pretty irritating.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#53

Post by mixu »

So, how common is the 3D Secure code on websites? I thought it was a local/European annoyance, since I haven't run into it outside EU webshops?

For instance, I've never had to put in my 3D Secure code on Amazon, BackBlaze, Syncplicity or ZumoDrive. The problem is that at least here in Finland, the only company (representing all the local banks) offering credit card processing practically requires 3D Secure unless you implement everything yourself (e.g. can't use their CC vault) - and no, unfortunately the US subscription API services don't work here, unless you somehow manage to get a merchant account in a UK bank.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#54

Post by Tibbes »

jessriedel wrote: post #48
Tibbes wrote: post #36

Earlier quoted context omitted.

A very similar system is already in use in the UK and other parts of Europe. It's called "chip & pin". You plug your card in to a card reader and check the LCD display and type in your PIN to authorise a transaction. In a shop, the card reader is owned by the shop and is similar to point-of-sale card readers used in the USA. However, most banks now provide customers with a small reader (that looks like a calculator)…

I see three problems. > most banks now provide customers with a small reader (that looks like a calculator) for logging on to online banking, or authorising payments made via internet banking. This means you can only make online purchases easily and securely at home. If I want to be able to make purchases at someone else's computer, an insecure back door must necessarily be left open even when you're not away . > To…

> This means you can only make online purchases easily and securely at home.

Fair point - I had this problem when wanting to use Internet banking at work, but these pin readers are compact (smaller than an iPhone, marginally thicker) so I just keep mine in my bag now.

> This doesn't solve the problem (which people may not care about) that the merchant could now have your pin.

Only if the reader itself is compromised (very unlikely with the small ones provided by banks for online banking, and pretty unlikely in a shop too). However, note that the PIN is useless without the card, because the crypto chip is on the card, and it can't be cloned by a reader.

> This seems like a huge burden. Physically typing in long cryptographic codes?

They are only 8 digits long. And yes, I don't want fraudulent use of my account so I don't mind.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#55

Post by Lewisham »

RickHull wrote: post #39
omh wrote: post #12

VbV is badly broken, but the suggestions here miss one of the most important points. The use of an iframe means that users can't tell where VbV is coming from and can't be sure either that it is secured or that it's really coming from the bank. This is just begging for copycat phising and MITM attacks.

Yes, this article is long on alarmism and short on serious critique: > The design of the form does not match the design of either the merchant or the issuing bank. The design looks ‘cheap’. It doesn’t look trustworthy. > No telephone number. When a user sees a telephone number it gives them a feeling legitimacy. They may not phone, they just want to see the number just in case. > The calls to action at the bottom of…

You've taken a very specific definition of "broken", then decided that the article doesn't meet your definition, so the article is worthless?

If you're losing customers for a bit of security theater, I think "broken" is a pretty good term from the perspective of the retailer.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#56

Post by jessriedel »

Splines wrote: post #49
jessriedel wrote: post #47

Earlier quoted context omitted.

> That might be the deal-breaker here. I would think it's surmountable, but point taken. >Credit card purchase authorization over SMS might be more sturdy How is this supposed to work? They send you a text, and you reply to confirm? The inability to make purchases without a signal seems fatal. Thanks for the feedback.

> How is this supposed to work? They send you a text, and you reply to confirm? The inability to make purchases without a signal seems fatal. Yes, that sounds about right. You have a mobile number associated with your account, and your bank texts you when you make a purchase. I don't think it would be required that you confirm every purchase - it would be more of a notification system. You could require it, but there…

> As for not being able to purchase without a signal, I posit that in the case where you need to authorize purchases, it has the same limitations as your credit-card-communication concept :)

No, see that's the thing. With the right cryptography, the credit card itself can compute an authorization code. There's no need for the credit card to contact the credit card company. It's authorization from the consumer (by way of a button they press on the card), not from the card company, that is imporant.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#57

Post by jessriedel »

Tibbes wrote: post #54
jessriedel wrote: post #48

Earlier quoted context omitted.

I see three problems. > most banks now provide customers with a small reader (that looks like a calculator) for logging on to online banking, or authorising payments made via internet banking. This means you can only make online purchases easily and securely at home. If I want to be able to make purchases at someone else's computer, an insecure back door must necessarily be left open even when you're not away . > To…

> This means you can only make online purchases easily and securely at home. Fair point - I had this problem when wanting to use Internet banking at work, but these pin readers are compact (smaller than an iPhone, marginally thicker) so I just keep mine in my bag now. > This doesn't solve the problem (which people may not care about) that the merchant could now have your pin. Only if the reader itself is compromised…

> However, note that the PIN is useless without the card, because the crypto chip is on the card, and it can't be cloned by a reader.

Ahh. So then the merchant could only really make use of a pin (which it would have to do by compromising the pin reader--a tall order for small time crooks) if he also stole your physical credit card. I agree that this isn't much of a risk, and retract that criticism.

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#59

Post by sankara »

Wow. This is entirely different here in India. First of all, it has been made mandatory (it's slightly inconvenient). This is not implemented as a popup. It redirects to the Issuing Bank's website for verification. Signup should be done in the bank's site as well (e.g.: https://www.3dsecure.icicibank.com/ACSWeb/EnrollWeb/ICICIBan...).

Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed

#60

Post by lutorm »

Tibbes wrote: post #36
jessriedel wrote: post #27

Could someone tell me why this idea wouldn't work?: Your credit card comes with a simple communication port (usb, bluetooth, whatever) and a two line B&W text LCD display (like on cryptocards or cheap electronic watches). Every time you want to buy something, you connect the card with the merchant. (This works in person and over the internet.) The merchants sends the card an official merchant name ("Delta Airlines"),…

A very similar system is already in use in the UK and other parts of Europe. It's called "chip & pin". You plug your card in to a card reader and check the LCD display and type in your PIN to authorise a transaction. In a shop, the card reader is owned by the shop and is similar to point-of-sale card readers used in the USA. However, most banks now provide customers with a small reader (that looks like a calculator)…

Someone wrote a criticism of the chip&pin system a while ago. I don't remember the link, but they were arguing that this system also had serious security flaws. The most memorable one was that while before people who held you up for your ATM card and PIN had to physically go to an actual ATM to see if the PIN you gave them worked, now they can get to work on you with a pair of pliers and a blowtorch until the card reader says "Pin OK" without risk of revealing themselves to an ATM camera. They claimed that this has already happened.
Post reply on HN