5900 online stores found skimming

Post by anondon » Sat, Oct 15, 2016, 10:40 AM UTC

kalleboo wrote: post #9

anondon wrote: post #8

I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction. Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.

There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps…

Post by bluesign » Sat, Oct 15, 2016, 11:09 AM UTC

anondon wrote: post #11

kalleboo wrote: post #9

Earlier quoted context omitted.

There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it. Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps…

3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA. To make a transaction: -add items to cart -enter card details -you are redirected to 3DSecure if it's enabled -you are redirected to a page of your bank where you enter a One time Password(OTP). It's a simple 6 digit number sent to your mobile phone and is unique for every transaction.Enter OTP. -transaction is confirmed. S…

Post by Silhouette » Sat, Oct 15, 2016, 11:23 AM UTC

notmything wrote: post #5

mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

Post by Silhouette » Sat, Oct 15, 2016, 11:28 AM UTC

technion wrote: post #12

mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

You know it. I know it. Most of HN knows it. We are, in general, not the customer. On sites I've been involved with, in 2016, I still have to fight tooth and nail to get SSL on the payment page at all, let alone redirect users somewhere else.

Post by phereford » Sat, Oct 15, 2016, 11:34 AM UTC

Silhouette wrote: post #15

notmything wrote: post #5

Earlier quoted context omitted.

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

Most people don't want to bounce customers to a third party site for payment, it really hurts conversions. That is certainly true in my experience. Also, some of the payment services have a habit of changing the appearance and/or behaviour of their hosted systems, sometimes not for the better, and typically without warning. That is a risk you might not be willing to take for something as important as your payment flo…