Strange. I've never seen a VbV open a new frame or pop-up - it's always a series of redirects for me. May be it depends on what bank and/payment gateway is been used.
Verified by Visa and Mastercard SecureCode are broken and need to be fixed
21–30 of 64 posts
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#22Every now and then when I purchase something from a Verified by Visa-"friendly" site (Newegg comes to mind), I often find that I'm able to complete the purchase without entering my password. It's disturbing to say the least.
3DS doesn't work that way. It's not mandatory. Newegg isn't using it to fight friendly fraud. They are using it to fight actual fraud. You've done it once, why should they force it on you again? You are who you say you are, and if their is a problem with your purchase, they're confident that they can resolve it without a chargeback.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#23Strange. I've never seen a VbV open a new frame or pop-up - it's always a series of redirects for me. May be it depends on what bank and/payment gateway is been used.
Not really. It's usually the merchant implementation that decides how it's displayed. All the 3DS I've implemented have also recommended using iframes in their API.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#24Even though there's no choice (here at least, when you want to use your Visa over the internet) I HATE, HATE, HATE the concept and here's why: For starters I thought it's a phishing attack, when the frame popped up for the first time. But the worst is that I don't feel it protects me, despite the marketing crap dished out by CC companies. The only reason is to protect Visa. What happens if I book a flight at a badly…
The first time I saw VbV I checked the frame URI. When it came up as securesite.net I phoned up the merchant to tell them their site had been hacked. It’s unbelievable that they thought that was a good idea.
Having the word 'secure' as part of the domain name is the same type of nonsense as putting a GIF image of a padlock in the page content. Guarantees nothing and promotes ignorance about how things actually work.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#25For 3DS enabled site in France (don't know if it's the same elsewhere) it sends you a code by SMS that you have to enter in the popup. I think this is a much better way. But I have to agree, the process is really not well thought out and as bad as it can be UX wide.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#26Nothing in the article is actually a technical flaw - it's mostly UX. That's not to say the system is good, but I think the title is misleading. If you look at the paper "Chip and PIN is Broken" by Murdoch et al (http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5504...) they actually point out a MITM attack which is a technical vulnerability.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#27Could someone tell me why this idea wouldn't work?:
Your credit card comes with a simple communication port (usb, bluetooth, whatever) and a two line B&W text LCD display (like on cryptocards or cheap electronic watches). Every time you want to buy something, you connect the card with the merchant. (This works in person and over the internet.) The merchants sends the card an official merchant name ("Delta Airlines"), which is registered with the credit card company, and a price ("$234"). These appear on the first and second lines of the card readout. If you approve the charge, you hit a single button on your credit card. Your credit card then sends an authorization code to the merchant which is good only one time, on that date, for that price, and with that merchants (using some sort of RSA hash).
If a wireless connection is used, there is little risk of criminals trying to secretly communicate with your card sitting in your wallet; you simply won't approve the transaction (unless they have physical control of your card, at which point you're no more vulnerable than you are now).
Further, you'd know exactly how the name of the merchant would appear on your bank statement.
The only downside I can think of is that the card would by slightly thicker (like a crypto card), slightly less durable, and need a battery (which would last for the life of the card). But we already replace the physical card every few years, so is this a problem? Is the technology particularly expensive?
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#28Nothing in the article is actually a technical flaw - it's mostly UX. That's not to say the system is good, but I think the title is misleading. If you look at the paper "Chip and PIN is Broken" by Murdoch et al ( http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5504... ) they actually point out a MITM attack which is a technical vulnerability.
User experience flaws are technical flaws.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#29I have credit cards at a bunch of banks here in Russia and what they do is they send you a one-time password in a text message every time you make a purchase online. It's the same VbV/SecureCode window and everything but you don't get to create your own password.
Re: Verified by Visa and Mastercard SecureCode are broken and need to be fixed
#30Even though there's no choice (here at least, when you want to use your Visa over the internet) I HATE, HATE, HATE the concept and here's why: For starters I thought it's a phishing attack, when the frame popped up for the first time. But the worst is that I don't feel it protects me, despite the marketing crap dished out by CC companies. The only reason is to protect Visa. What happens if I book a flight at a badly…
That is, in fact, the exact opposite of how the banks operate. You are limited to $50 in liability for any fraudulent transaction in your account that you report in a timely fashion, guaranteed by law (in the US at least), and every bank I am aware of waives the $50 for marketing purposes. Essentially all financial risk for credit card transactions is borne by the merchants. (Which is one reason why the banks don't s…
This. The main driver of 3DS, as I understand it, is to sell a service to merchants which promises to lower their costs related to fraud liability. Additional security for cardholders would have been a side effect, had 3DS actually been a good security scheme.
In defense of Visa, et al, this is hard to get right. Take, for example, SET, which uses PKI and is probably much more secure, but is impractical to implement: