Accepting payments is getting harder • Hacker News Board

Re: Accepting payments is getting harder

#71

Post by mseebach » Fri, May 08, 2015, 12:14 PM UTC

BlackFly wrote: post #53

Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

There is a major use case around "card not present" transactions.

Anything recurring, such as AWS, hotel/car rental express check-out/return, Amazon 1-click and Uber and similar mobile payment use cases will get significantly higher friction if you have to complete a chip-and-pin for each of these.

A quite simple fix to these would be to allow storage of a token linked to the PAN which is locked to a specific merchant - so, they're worthless if stolen, but can be used like the PAN is today to perform "card not present" transactions for that merchant.

Re: Accepting payments is getting harder

#72

Post by jasonisalive » Fri, May 08, 2015, 12:21 PM UTC

The problem of credit cards is that when you make a payment, you have to give away your private key. No amount of securitisation will take away this fundamental flaw.

This is one of Bitcoin's evolutionary advantages in this space. To send money with Bitcoin, there is no need to expose one's private key. A massive corporation could take millions of annual payments and their paying customers needn't be concerned about their money being at risk. If the entity has poor security, the only people they endanger are themselves.

Re: Accepting payments is getting harder

#73

Post by discreditable » Fri, May 08, 2015, 12:22 PM UTC

andreyf wrote: post #32

eps wrote: post #30

Earlier quoted context omitted.

Do elaborate ... And what is old/new stripe.js ?

> they are changing Stripe.js to now serve up the data in an iFrame so you can keep using their product more or less like before but without heightened requirements I imagine they're changing things to be like Google Wallet, where you use a pop-out window to type your credit card number into (just the first time, it's save on their side after). That way you know you're giving your CC just to google.com by looking at…

I've seen non-https sites serve up HTTPS iframes. The whole iframe thing just seems like a bad idea for processing credit information. Ignoring HTTP interception, it's difficult for customers to verify that the iframe is indeed coming from an HTTPS site.

Re: Accepting payments is getting harder

#74

Post by jtdowney » Fri, May 08, 2015, 12:30 PM UTC

reviseddamage wrote: post #28

Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

Braintree too, Feb28, 2015 edit: actually I'm seeing Google there Jan 31, 2015 , so I wouldn't pay too much attention to this. Likely they fix up before anyways.

Visa is slow at updating their site. MasterCard is much faster, you can find their list at http://www.mastercard.com/us/company/en/docs/SP_Post_List.pd....

Re: Accepting payments is getting harder

#75

Post by BlackFly » Fri, May 08, 2015, 12:37 PM UTC

nothrabannosir wrote: post #68

BlackFly wrote: post #53

Earlier quoted context omitted.

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

This solution is already implemented in large parts of the world and good to go! But the incentives are sometimes not right. Ultimately, I want IC payments to be cheaper, as a merchant. I want my incoming IC payments to be in a separate bookkeeping from the non-IC: increase in fees on the latter, I'd like to keep my rates for the former. Ultimately, I can then pass these savings on to the customers. But as long as th…

I'm a bit confused as to what you mean.

Physical merchants eliminate liability for fraud and get reduced interchange fees by accepting chip.

Web merchants get reduced fees by using 3D secure (and the other scheme's versions). It is the issuing banks decision whether the 3D secure uses a chip or not, not the decision of the merchant. Many banks use sms push, RSA tokens, OTP sent in an envelope, or just passwords.

Re: Accepting payments is getting harder

#76

Post by gkoz » Fri, May 08, 2015, 12:38 PM UTC

BlackFly wrote: post #53

Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

What has 3D Secure got to do with EMV? How is it supposed to use the chip and the PIN?

Re: Accepting payments is getting harder

#77

Post by netcan » Fri, May 08, 2015, 12:44 PM UTC

This whole area is a big ole platform problem.

Credit cards are a bad platform to build on. The duopoly structure is a bad platform for gradual improvement and the regulatory environment is a bad platform for innovation.

We have deeply entrenched kick-it-forward allocation of responsibility and fixes to serious problems are characterized by firefighting, designed-by-committee compliance, cover-your-assness and such. All the hallmarks of a poorly functioning market, poorly functioning organization and general pathologies that occur whenever the way we organize is wrong.

Leaving bitcoin aside,^ I think the fundamental problem is having CCs play the role they do. Instead of customers sending merchants money, merchants request money from CC companies. That is a bad system.

^The reason bitcoin is difficult to insert into the conversation is because it has so many big hairy goals. Government power over money. Macroeconomic theories of monetary policies baked in… Its a big interesting project, but the problem discussed here is only really a subset of what bitcoin is about so it's kind of a tangent.

Re: Accepting payments is getting harder

#78

Post by BlackFly » Fri, May 08, 2015, 12:47 PM UTC

mseebach wrote: post #71

BlackFly wrote: post #53

Earlier quoted context omitted.

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

There is a major use case around "card not present" transactions. Anything recurring, such as AWS, hotel/car rental express check-out/return, Amazon 1-click and Uber and similar mobile payment use cases will get significantly higher friction if you have to complete a chip-and-pin for each of these. A quite simple fix to these would be to allow storage of a token linked to the PAN which is locked to a specific merchan…

This problem has already been solved.

Most interchange protocols contain flags for recurring payments and standing authorizations. Only the first such transaction contains chip data to prove that the cardholder actually wants to authorize a standing auth/recurring auth.

In these cases, the standing authorization is already tied to the merchant + PAN + address details. Using chip in the first place is what allows a database compromise which leaks the PAN to not enable a criminal to authorize at another merchant: they won't be able to generate the ARQC needed to authorize.

All subsequent standing auths are card not present anyways.

Re: Accepting payments is getting harder

#79

Post by BlackFly » Fri, May 08, 2015, 12:52 PM UTC

cm2187 wrote: post #52

We should have moved a long time ago to vendor specific credit card numbers (ecommerce isn't exactly a new activity). Say I get from my bank a token which I provide to this vendor, and the first time the vendor uses it to accept a payment, the token locks in to that vendor, i.e. my bank will not allow any payment with this token to another vendor (i.e. to another bank account). Then it doesn't matter if it's stolen,…

This is already the case for instance in Portugal, for quite some time. In fact, a card holder in Portugal can generally just issue a new credit card number for personal use, tied to their account with whatever expiry they wish.

The big problem arises when you booked your hotel on one of these temporary numbers and show up to try to check in to the hotel. The card was not actually issued and some hotels have weird policies in that regard.

Of course, chip card based solutions that devalue the PAN are superior.

Re: Accepting payments is getting harder

#80

Post by falcolas » Fri, May 08, 2015, 1:04 PM UTC

BlackFly wrote: post #53

Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

Verified by Visa is bad for the consumer: it shifts all the risk of fraud onto them. If the PIN is intercepted, and subsequent purchases are made with that PIN, the owner of the card is liable for all of those purchases; they are considered to have made them because their pin was present at the time of purchase.