Slashdot Mirror
Why "Verified By Visa" System Is Insecure
angry tapir writes "A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers. The system is called 3-D Secure (3DS) but is better known under the names Verified by Visa and MasterCard SecureCode. Steven J. Murdoch, a security researcher at the University of Cambridge, and security engineering professor Ross Anderson contend there are several flaws with 3DS. One of their main points is how 3DS is integrated into Web sites during a transaction — e-Commerce Web sites display 3DS in an iframe."
I'm in the high risk card not present industry and if it wasn't so painful it'd be funny how bad it is.
3DS solves problems for Visa and nobody else. It transfers the liability from the merchant to the customer. No more 'it wasn't me'.
Only problem is, it's crap.
Bit like the chip and pin problem in the UK which is a similar joke. If I can get your card and your pin I can go shopping as you and good luck trying to explain that to the bank.
If I can fool you into giving me your 3DS password somehow, I can shop online as you with great false trust, and the merchants don't care because they're protected. Kind of.
Most merchants refuse to deploy it anyhow unless forced. It causes a 5-8% immediate drop in throughput. I wouldn't use a site that used it either.
That's probably what people will fail to realize as they start commenting on this article.
It's not. I tried making a purchase on newegg, got the the Verified by Visa page, but the frame didn't show anything. Assuming that the purchase wouldn't go through, I tried making the same purchase on my other computer. Frame loaded, entered password, purchase went through. However, the first purchase went through, even though I never entered the password for that one. So yeah, I'm guessing it doesn't really do anything to protect you.
for all sites that I visited that tried to make me jump through the dumb VbV hoops, I switched to American Express..
I thought and still think that it is dumb to encourage consumers to type confidential information into a random pop-up page from a different web site than the one they are visiting.
A.
...bringing you cynical quips since 1998
Single-use CC numbers. But my Visa (issued by my Credit Union) doesn't have one, and AMEX doesn't do them any more.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
I first read this a verified by Vista and I wasn't surprised. Just thought they were beating a dead horse.
They verified my Visa a long time ago - and its easier to remember my email address and a password than it is to try and find my card to enter the numbers online.
I used my Visa instead of my usual MC on Newegg for a Christmas gift and it came up for the first time ever. I closed the widow intending to buy it on my MC instead, but the payment still went through. 2 days later I got a call from the Visa fraud department...haha. I told the lady the verified thing was a bullshit pain in the ass and she let me on my way. Haven't used my Visa since.
As our way of thanking you for your positive contributions to Slashdot, you are eligible to disable Slashdot 2.0.
The "verified by visa" password is just another password that can be stolen. If you accidentally reveal information to the wrong person, your account is completely compromised. That's how it was before "verified by visa", and that's how it is now. The correct solution would be to use public key cryptography, where the credit card has an associated secret key, known only to the user (not even the credit card company). That way, the credit card user never has to reveal any secret information to anyone. The entire transaction can take place unencrypted, because any listening attacker (or malicious employee of the merchant) can't get the private key. They can only get the public key, and the digital signature of the transaction. There's no way to use that information to make fraudulent transactions.
No, because it's in an iFrame it's less secure than having nothing at all. When you're pulling data from two different sites on the same page, it's much easier for a third party to insert their own fields without you knowing.
My Chase MC and Visa required this to be setup and crazy passwords too, which I can't recall. I rarely use my Chase cards anymore as a result.
similar thing happened to me, in my case I couldn't remember the password for that card, so canceled the verified by visa thingy, and used a different card. when I was done with the order using the second card, I saw that the first one went through regardless of a successful verified by visa thing.
Glad I'm not the only one that read vista.
Thankfully, NoScript blocks Verified by Visa, for which I have always been thankful.
I placed an order at Newegg, got the verified by visa screen and noticed the amount had changed because newegg had adjusted the quantities in the previous screen and I didn't notice.
I hit cancel at the verified by visa but the order still went through and got charged for it. Bizarre.
There are security engineering professors now? How long have I been asleep?
You have to sign up for it.
The merchant has to offer the option to use it.
And even if you don't put in your password it still goes through.
It's all a bunch of bullshit.
I go to the Mastercard website and request a virtual number. I can specify amount and expiration time (in months). It is linked to my credit card and once I use it at a merchant, that number can only be used at that merchant for up to the amount I specified. I love it.
Meanwhile, a few years back I had to implement Verified by Visa, Mastercom, and Paypal solutions for the checkout process for the company I worked for. Paypal was the easiest and the other two were crappy. I'm not sure how they've worked out in the years since, but you don't see me using them currently. Virtual Numbers all the way.
Ya, VbV is bullshit, but it would be nice if TFA could link to it's sources it lists as citations instead of financial%20cryptography%20and%20data%20security/
"I use a Mac because I'm just better than you are."
just as users are acquiring a healthy skepticism to web generated dialogs, VISA undoes it !
My credit card (Visa issued by my bank) doesn't have it either. I've been thinking about getting a second card that does have it solely for online use, but have been turned-off by the issuers I've seen with that feature. Is there anyone here that can recommend a credit card issuer that supports single-use numbers?
My requirements:
* No monthly/yearly fees
* Standard grace period
* Sane fraud protection (call me if you see something suspicion, but don't freeze my card)
* Can be paid using standard electronic transfers (ie I can use my bank's website to pay bill not the CC's)
* Visa or MasterCard are preferred.
* I don't care about earning airline miles, bonus points, whatever.
I no longer shop at websites that use it. Too much hassle and is not secure anyway.
I switched from VISA to MASTERCARD because the system sucked, it pissed me off having to jump through hoops to buy something. Then MASTERCARD came out with the same system, just not used as much so I'm still staying with them. Actually pretty funny story... I made a purchase last Fall on a website that had the MASTERCARD security thingy, I hit cancel cause my account got locked out, and the purchase STILL WENT THROUGH.... ya... nice security there.
I got fed up with all the security issues with online Visa transactions. Now I use PayPal for everything, and I'm fully protected. Lessee, I've made around... hmmm, frozen, what does that mean? Well, I'm having some problems with my account at the moment, but I've made a lot of transactions.
Let's say you're on a "secured" web page entering your credit card information.
You see that iframe that's "verified by visa". The code on the page you're looking at says where to get the content from, and IT is secure... The content that is loaded is via "https://..." https (TLS) is secure, it can not be spoofed.
This means that if the content in the iframe has been tampered with your web browser will not display the content. The secure iframe is sent the "Referrer"(sic) header containing the URL of the page that contains the iframe, which the iframe verifies is https and will contain a secure token in the URL (that's what the gibberish after the ? mark is). Therefore "verified by visa" is secure. Annoying as hell, but it is secure.
The issue is: if you're on "secured" web page that you don't fully trust (say from "https://theives.com") entering your credit card information and you see the "verified by visa" iframe, without any address bar for that iframe you can't trust that the content within the iframe isn't spoofed. The iframe could contain content that looked like the "verified by visa" iframe, but was actually from "thieves.com".
Therefore, the "verifed by visa" iframe content should not reassure you that the page you are on is "verified by visa"... instead you should realize that "verified by visa" means that YOU are being verified by visa.
Check the address bar of the page you are on. Check the page's certificate chain. If you don't trust the web site you're on don't enter financial information. If you don't know how to verify that you can trust the site, you should educate yourself or stop using e-commerce.
Can we get this right, once and for all? Something that is unsecured is vulnerable to a security breach. However, something that is insecure is in an emotionally anxious state.
I chuckle every time I read about an "insecure document." I imagine a document harbouring feelings of self-doubt and a lack of confidence. "Am I really a document? Will people like to read me? Does this file format make me look fat?"
Here's a little tip that I discovered by accident. On a NewEgg order, if you hit "cancel" on the Verified-by-Visa page, the order still goes through.
We had it forced on us by our payment provider and it killed sales, we had so many customers asking what their password was and where do they find it. We opted out of it.
The researchers, and the article writers, completely fail to understand that 3-D Secure simply defines the interfaces between the three domains in the security model. The actual authentication model used is chosen and implemented by the card issuer. If the card issuer would decide it wants to use passphrase+OTP in a separate window (for URL validation), it could do so. In fact, outside of the US, many do. In Norway, for instance, online payments are usually verified through something akin to a "national electronic ID", which despite its flaws goes way above and beyond simple passwords.
The article is so full of factual mistakes and displays such a complete lack of knowledge and understanding it's not even funny.
Love over Gold.
Well, VbV's security issues are a problem for Visa to solve. It's great for merchants who sell high-priced items (like NewEgg, camera stores, etc). Many smaller merchants who had to go through a whole back-and-forth thing with the customer and credit card company before (for large, expensive orders) can now just use VbV for the same high-priced purchase instead. Higher volume merchants like NewEgg can streamline their credit checks with VbV and even allow shipments to addresses other than the billing address.
I'm not sure why people are saying that it transfers liability to the customer, it doesn't. The liability is transfered from the merchant to the Visa (well, actually the issuing bank I think). Customers are not liable for fraudulent use of a credit card by VbV or anything else.
-Matt
I've done hundreds of newegg purchases using opera. After the order I get a redirect to the verified page with a couple of dancing eggs. Then my order completes. No popup. No iframe. No prompts for passwords ever.
I don't know if this behavior is opera related or related to the fact that my visa is issued by a credit union that I belong to. But vbv has never asked me for anything ever.
Newegg is the only store I've seen Verified by Visa used (and I buy a lot of stuff online). Having had my share of problems with it, I never even browse Newegg anymore. I guess they must have such a high incidence of fraud though that it's worth losing the occasional regular customer like me.
Entrepreneur : (noun), French for "unemployed"
Thats incorrect, though its easy to see how the researchers could fall into the trap of believing this.
Anyway, if you read their terms of service, it becomes obvious that the main purpose of the Verified by Visa system is to shift liability for fraud onto the card-holders. Its the main reason I've stopped using my Visa for any purchases over the Internet.
TFA mentions one of the securities holes being that users "can't see the URL of the verified by visa website because it's in an iframe." Reminds me of the first time a website asked me to enter a password on verified by visa, I stopped the transaction and purchased the item somewhere else for that very reason, since I never had any notification that verified by visa was something I was going to have to do.
Q.E.D.
I've used the service 3 times...guess how many times I've set/reset my "Verified by Visa" password. Rather than allow for a secure password(8+ characters, alpha-numeric-symbol) I am limited to 6 digits and remember yet another non-standard password? Might as well throw a captcha AND a question to doubly verify I am not a bot, too.
Imagination drew in bold strokes, instantly serving hopes and fears, while knowledge advanced by slow increments...
The back and forth thing is just a phone call. Takes less than a minute. My wife runs several hundred dollar Visa/MC purchases all the time in her business. We just call a toll free number, type in the card # and amount and if it needs verified by a person they come on and ask a question or two then give you the Verification number. The liability for fraud still lies with the merchant, they got your item, you got nada. The CC just charges the bad purchase it back to the merchant, they are not out a dime. VbV is nothing but marketing.
If somebody puts a keylogger on your Windows box, they'll get what they need no matter how many passwords you are required to type. Adding another password to the stack adds zero security; it just makes it easier for the credit card company to claim you are truly responsible for the transaction. "It can't possibly be fraudulent--it was Verified by Visa(TM)!"
I try to avoid doing business with anyone who requires me to go through VbV. I know it's not there to protect me.
I recently forgot my verified by visa password - the only security question it asked me that wasn't printed on the card was my date of birth - it's not the first time I've had to reset my password, and each time the question is the same. That means if somebody has my card, all they need to know is my date of birth, and they can reset my 3DS password easily.
Here's a little tip that I discovered by accident. On a NewEgg order, if you hit "cancel" on the Verified-by-Visa page, the order still goes through.
I have recently build an ecommerce site for someone and noticed that our account on a payment gateway allows us to disable this crap. When disabled, it still displays but the user can skip it or whatever and the purchase still goes through. We have had the account for years. When the client switched it to their account on the same payment processing company the option to disable it was greyed out. It seems it is mandatory for some (maybe newer?) setups but not existing ones.
As a customer it makes no difference to me anyway. It might be an extra step I have to go through but since the password is set to a generic password I can always remember it does not inconvenience me much. Typing one word into a silly box only takes a second or two.
I dont read
My info always seems to change on me for VbV, so I don't bother with it. I've found hitting Cancel will, more often than not, proceed with the order as usual.
can't believe this..the people simply start commenting having just half knowledge.. 3DS protocol is secure and helps banks to chose the method that it uses to verify its customer. Its left to banks how they want to authenticate its card holder. Few banks have chosen to keep static password while others use OTPs. In future banks would use IVR calls or Voice authentication or some other technology to identify its customer but the protocol does not change.
Few merchants may have implemented the flow wrongly.. merchants are supposed to re-direct the customer to his bank site and not show in frame or i-frame; that is just a bad implementation and is a invitation for phishing attack. In India at least as for as I have seen none of the merchant use i-frame thing.. all most all the merchants re-direct the customer to his bank for verification and customer can clearly see the url of bank server (or provider) that is authenticating him.
Its like telling.. if one drunk driver crashes a car and kills himself cars are unsafe.. :P
I had a credit card which could do that once (a Wachovia card administered through some "FIA Card Services"). Then Wachovia decided to end that and administer it themselves (which was mostly just annoying). What other card providers provide this capability?
On a related note: online bank security. WTF?
The World Wide Web is dying. Soon, we shall have only the Internet.
When you make a purchase with Newegg, just cancel the VbV box and the charge will go thru. Yes, that's right. You can completly bypass the security check by canceling it. I have VbV set up and went to make a purchase a few months ago on Newegg. Didn't remember the password and canceled the password check to go and reset the password. The order was charged and went thru. I called Newegg and ask them what happened. I was told "Newegg passed the Visa charge request off to Visa and it returned a thumbs up. The VbV check is optional."
...my account is still secure. Not all 3DS systems are the same between banks, and some of them actually do it reasonably well (though no security is ever foolproof, of course). On my account, 3DS asks me for one of the five security questions on my account, which involve various different inputs (dates, names, places, etc.). To actually log into my online acccount I need both the answer to the security questions above, a secret code (not the same as my PIN), plus the standard account details. If I want to actually do anything useful online, I have to use my bank's little security device, which takes my card in and spits out a random code so long as I enter my PIN right (think Blizzard dongle, but with Chip and PIN). And of course, if someone manages to steal my 3DS answer in order to use my card elsewhere, they still need to find out all my other card details. Even if they found out them, they've only got a 1 in 5 chance of getting the right question they know the answer to. The system allows 3 attempts. Good luck, guys.
I mis-guessed my verified-by-visa password multiple times on a newegg order and then gave up. The payment went through.
It reminds me of [insider knowledge, that's why I'm posting AC] something my state's unemployment system is about to implement. They're going to have a voice system where people can call in, change what bank account their claims will go into, etc. Of course, to do this, the claimant needs to know their PIN. If they don't know their PIN, though, they can reset their PIN to anything they want, without verifying their identity in any way. If you know someone's SSN, you can have their payments go to you, without knowing anything else. So what's the PIN for?
I would like to see my credit card display a time sync'd rolling number instead of the lame 3 digit code on the back of the card. As I see it, the problem with credit card fraud is not stolen cards, but stolen numbers. If I lose my card, I will know fairly soon and can have the card canceled. However, it may take quite a while to determine my number has been compromised. When shopping online I would like to enter my card number and a second number generated by the card. Cards expire after 2 years, so this should be doable from a battery life point of view. It could even be introduced as an extra fee initially to those who want the extra online shopping security.
I'm in my right mind and I have the answer to everything!
My GF's great-grandmother passed away in November. She was very close.
Weepy GF gets onto the web site of a regional Canadian carrier that prides itself on its customer service, selects her flight, and begins to fill out the VISA information. After filling out most of the information she clicks "continue" and *bam* up comes VISA's activation during shopping page (ADS) with a giant "I agree" button under inscrutable masses of legal fine print. She is in a fine state of mind for clicking her life away.
This happens right in the middle of the transaction, with no advance warning. Not on the page before she began filling out the details: to complete this transaction with your VISA card, you will be obligated to click "I agree" to the ADS terms of service, which shifts VISA's liability onto your shoulders and plays havoc with established web security practices and altogether makes the world a shittier place.
All of this under the commercial maxim that instant gratification == learned helplessness. Your average user will blindly click anything during gratification interruptus.
As it happens, my red-eyed GF muttered out loud "WTF is this?". It took me about 30s to get past "HF those sleezy MFs". Then I told her to slam down the virtual circuit on her half-completed web page transaction and start the transaction over again using an aging circuit-switched technology far less suited to rights erosion, and also more expensive for the airline to provide. Real human at the other end. What a PITA.
Brilliant lose-lose for everyone involved.
Two of the links I recorded checked this out:
Links More Banking Stupidity: Phished by Visa
Verified by Visa: British banks phish their own customers - Boing Boing
Redacted portions of an online TOS from a large Canadian bank which has since gone 404.
You agree not to: modify, adapt, sub-license, translate, sell, reverse engineer, decompile or disassemble any portion of the Verified by Visa Website or service or the software used in connection with Verified by Visa.
You agree to immediately notify us by contacting us, as we require in our cardholder agreement with you for a lost or stolen card of any unauthorized use of your password or other verification information, or any other breach of security. You will be liable for any unauthorized activity involving use of your password or Activation Data, until we receive such notice.
Answer me this, Batman:
How is one supposed to notify the bank that you've lost control over the password, when you lose control to a phishing widget embedded in a concealed iFrame?
I wrote that riddle back in November, and I'm no closer now to coming up with the solution. FWIW, this agreement is probably less egregious than the one that came up under ADS, from a different major Canadian bank. Bonus marks for completing this task without first discovering how the service works which violates your TOS.
This whole thing makes me seriously limbic.
Larry Lessig on laws that choke creativity
And on the other side, among our kids, there's a growing copyright abolitionism, a generation that rejects the very notion of what copyright is supposed to do, rejects copyright and believes that the law is nothing more than an ass to be ignored and to be fought at every opportunity possible. The extremism on one side begets extremism on the other, a fact we should have learned many, many times over, and both extremes in this debate are just wrong.
For the good of society, the law ought not to be an ass, and the VISA company ought to not be pushing the matter like a used car salesman at the helm of an invincible glass castle.
Security is about tradeoffs. So, let's be clear. iFrame = bad, I agree with you. But let's take it further, let's look at what you're getting. I've hit verified by visa a couple times, I always forget my password. In part, my standard repetoire of passwords don't work because it only accepts letters and numbers, my passwords often contain various symbols. In other words, the limitations on the password characters limit the number of possible passwords. Not great, though not as bad as the iframe thing. So I use the "forgot your password" flow everytime. The genius thing about that is that it asks me stuff I'd already entered on the retailer's purchase form. There's no additional info required, it's all fairly standard "accessible" user profile info, but for the re-entering of the card details. So, to be clear, from a quantitative aspect we have 1 bad and 1 "not so hot". But what have we gained? Nothing!!! It's online security theatre. It's about as effective as a Dutch Airport security officer.
That's odd. My Verified by Visa password is 8+ characters and alpha-numeric, I've also only had to reset it after reporting a card stolen and having it replaced. Maybe it differs from different card issuers.
This is why I use a virtual card online (paypal offers them, and some banks do too) - generate a card, use it and then close it. It's also handy for sites that force you to subscribe when you only want a brief access (e.g. I'm only an occasional wow player, so I pay for a month, close the card, don't have to pay for the rest of the time when I don't have time to play).
The entire financial industry is about 2 things. First, skimming a few cents off of the top of any financial activity they can get their claws into and second, pushing any and all risks and costs onto the public.
Get wiped out by high risk loans? Get a bailout. Credit reporting systems so flimsy they can't even tell two people in the same apartment building apart? Spawn an entire industry for people to fix it at their own expense. Can't be bothered to implement a secure credit card system? Either make it the merchant's problem or the consumer's. Someone defrauds you out of some money? Demand it from the person they impersonated and tell them it's their problem (cost and obligation) to fix it (even though they're not the ones sending credit offers to dogs and toddlers).
In a just system, credit agencies munging data together based on practically nothing would be guilty of libel if they wrongly claim you're a deadbeat. Creditors would be obligated to show that you personally are the actual person they extended credit to before they could try to collect. There would be no such thing as "identity theft", only the usual run of the mill fraud.
In such a system, the banks would make sure credit card transactions were as secure as they could practically be because THEY would lose out when it fails.
The Verified by Visa thing comes up after I try to place an order on NewEgg. Thing is, if I don't bother with it and browse to another page when the VbV window comes up the transaction goes through anyway. This means Visa is trying to verify a transaction that has already taken place.
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
My Chase MC and Visa required this to be setup and crazy passwords too, which I can't recall. I rarely use my Chase cards anymore as a result.
See that! You're more secure already!
And you doubted the value of this valuable security feature...
To: ive_seen_a_scam@smile.co.uk 23/02/2009
Please forward this to someone with the ability to assess the risk of such security breach. (Preferably with basic knowledge of SSL and cross site scripting.)
A web site (not smiles) is asking for my accounts memorable name. I shouldn't be entering this information anywhere other than into a secure smile web site.
[Other sites that take payment using pay-pal I can trust as I see they redirect to a pay-pal server for me to enter my account details.] Perhaps you should take a look at how pay-pal processes such orders.
As the site I was ordering from should probably be trusted I choose to enter it this time and to then change the memorable name as soon as the order had complete.
Specifically;
http://www.smile.co.uk/servlet/Satellite?cid=1076315830501&pagename=Smile%2FPage%
2FsmView&rendermode=preview&c=Page
Suggests I don't enter details into "computers that aren't your own" which I also assume applies to supplying to sites that aren't smiles.
http://www.smile.co.uk/servlet/Satellite?cid=1124867052028&pagename=Smile%2FPage%2FsmView&c=Page&loc=l
"all secure messages between us travel in a closed environment, so they can’t be read by anyone else" but this is a 3rd party asking for my memorable name and not smile.
Order was from;
http://wck2.companieshouse.gov.uk
Appears to use
https://www.netbanx.com
to make the payment then it either takes the memorable name in this site or uses an embedded site from;
https://secure5.arcot.com
Please contact me if you require more information.
----
Reply: 23/02/2009
Thanks for your message.
I can understand your security concerns with the verified by visa scheme.
For more information with all aspects of this please visit our site
(www.smile.co.uk) then click the security link at the top. Once there
select the verified by visa link on the left and this will then be able to
give you all the information you need.
----
My responce: 23/02/2009
Q: Is Verified by Visa (VbV) easy to use?
A: Yes. When you make an online purchase, a window from the Bank will be displayed and prompt you for your memorable name/VbV password. Simply enter your memorable name/VbV password and complete your purchase.
My problem is no apparent window from the bank is shown so it appears like (don't know if this is true or not) I am giving my security details directly to a third party. (It is very easy to create a malicious secure web site that looks just like the one I saw.)
----
Reply: 24/02/2009
I'm sorry you have concerns about your online security.
When you sign in to a Verified by Visa site using your smile card, you'll
automatically be asked for your memorable name. This will confirm that
you've been connected to smile behind the scenes. Other banks will ask
different questions, however being asked memorable names will confirm it is
us.
The original brief from Visa stated banks could introduce individual
questions for each customer, that's not been fully introduced yet, however
we'll be reviewing this in the near future. At the moment we're reviewing
and looking to implement other security procedures.
Please make sure the website you're using to make the online transaction is
a website that you trust, this is important as using a trusted website will
greatly reduce the likelihood of there being a scam.
Please also check that your PC is fully protected with antivirus, firewall
and anti-spyware software plus the relevant phishing filters available with
your chosen web browser. Please let me know if you need any more advice on
this.
Thanks for taking the time to contact us, I appreciate your concerns and
comments and have raised it internally for further consideration.
In some of the accountancy newsgroups I frequent, we sometimes get merchants wondering why so many people abandon their purchases when they put 3D Secure on their websites. Anecdotally it seems that about 2/3 of customers will abandon their transaction if they hit the verified by visa page. I certainly do, because it asks me to enter password details into a site called "securesite.co.uk", owned by some very small company called Redstation Limited I've never heard of.
Except you can be reasonably sure that the Dutch Airport security officer won't surreptitiously plant a bomb in your bag while giving you an inspection.
The link in TFA is broken.
Here is the original paper:
http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf
3. Make sure your PINs don't contain any 1's or 0's (some countries disallow those numbers).
Seriously?!?
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
I've often wondered about that. When presented with the 'Verified by Visa' screen, how do I know it's the real thing?
What's to stop a dysfunctional e-store using a mocked-up version of that screen to collect my online PIN?
"We live in a global world" - Harvey Pitt, former Securities and Exchange Commission Chairman
SecuCode annoys me. Half the time the page doesn't even load. When all the hot deals were coming out around Christmas, I had to use Paypal to buy everything, because SecuCode was indefinitely down.
Oh yeah - know what password does fit their limitations? bullsh1t
I agree. The chip and PIN has its limits. The magnetic strip is useless and outdated. Here's my view
Most people use a single PIN for everything. Hence it is part of a solution. Multi-part authentication is key to increasing security. Add in an RSA keyfob, and a personal public/private key certificate on the chip. Here's how it works.
Waiter brings the payment device to the customer. This device uses a network not part of the restaurant network. A VPN tunnel will suffice, so long as it is encrypted.
The customer inserts the card, and unlocks the PPK certificate with the PIN. The PIN is comprised of letters and numbers, say 6-14 characters, eliminating the debit card PIN re-use.
Finally, the transaction is authorized using the RSA keyfob's constantly changing number.
The system isn't foolproof. The customer is always the weakest link, and businesses prefer to make spending easier, not harder. It will eliminate the card swipe and make lifting the PIN harder.
Finally, require a voice print authorization from the card holder for purchases over $500 and/or purchases per day over a pre-set limit. This will make stealing a card a lot less attractive.
Only the dead have seen the end of War. - Plato
No, they aren't the same company at all. They're two separate associations run by their member banks. Some banks may be a member of both, but probably not all.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
I am a UI designer with an interest in security-related human factors.
3DS as deployed by MasterCard is also fundamentally insecure because its based on an anti-pattern: trust by proxy without offering any easy way to verify that trust. Visa's implementation is marginally better becuase it echoes a "secret phrase" to you on the screen before you input your pin, thereby allowing you to verify that it's them, and not some random phisher.
The trouble is most people just trust in the application of the anti-pattern. How then can anyone make sense of the fact that on the one hand, their bank exhorts them to be on the lookout for fraudulent emails and websites pretending to be their bank, while on the other hand their bank does EXACTLY that with 3DS.
Not only that, but there are apparently exploits in the wild that deploy browser-based man-in-the-middle attacks by throwing up fake 3DS forms on checkout pages. I recently received a mail from Zopa (a financial services website) that said the following:
"Thanks to one of our members who reported that during the process of paying funds into his lender account, he was presented with a ‘verified by Visa’ screen that requested his ATM pin code.
Suffice it to say that Zopa does not use this kind of verification so you should never submit any passwords or codes should you be prompted to do so via such a screen when using the Zopa site.
We have investigated the issue and can confirm that the problem is an issue entirely localized to this member’s local environment and does not affect the Zopa site or its servers. Nevertheless, we wanted to make you aware so that you can avoid filling in your details should you be presented with a similar screen. "
Words fail me.
"And the meaning of words; when they cease to function; when will it start worrying you?"
While some of the problems exist for me, some others don't. For example it is shown in an iframe, but I don't enter a simple password. Instead my bank have a challenge-reply system, where I need physical access to my card, know it's pin-code, know my personal number (Swedens version of social security number) and use a special device given out by the bank. Yes, the iframe can still be hijacked, but all the hijacker will know is my personal number, and a one time code (which is generated differently from the one used to log into the bank, which is different from the one used to sign bills and transfers).
/ The Arrow
"How lovely you are. So lovely in my straightjacket..." - Nny
thats sounds awesome, what bank is that with?
I recently made a purchase through newegg.com. Used my trusty VISA, was redirected to the VbyV site, realized I didn't know my password, clicked cancel and figured the transaction was done when I canceled out of the VbyV. Got my Discover and completed the transaction. Low and behold, what shows up in my email, but two tracking numbers for identical shipments with both my Visa and Discover getting charged!
After some investigating with both newegg and my bank, turns out that the merchant can choose what to do when they get a failed VbyV transaction.
Talk about a perfect "no it's their fault" situation
Next on "security theater"...
Just checking...
Omne ignotum pro magnifico.
In India, it is mandatory to use 3DS - no Indian CC will work without this extra step...
Online shopping sites here reported a 30-50% drop in orders when 3DS became mandatory.
Yea, different companies that have the same owner. Just because they play some corporate legal sheltering doesn't make them any less of the same company for all practical purposes.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Citibank.
I like Newegg. They have a technical audience, but they say "Hey, we're redirecting you... you'll come back when you're done", and the certificate and everything is right in the address bar like it should be. I've only had one merchant where the VbV page was in an iframe... I checked out the frame to verify it, but as soon as I get my shipment from them I'm going to complain about that experience.
My blog. Good stuff (when I remember to update it). Read it.
That's odd. My Verified by Visa password is 8+ characters and alpha-numeric, I've also only had to reset it after reporting a card stolen and having it replaced. Maybe it differs from different card issuers.
VbV password is the password you use in your card issuers online banking service, and it indeed differs among issuers.
My sig will be released in 2015 third quarter. Rating pending.
That's the whole reason I got an Amex card.
Of course now I do well over 90% of my offline card transactions with Amex too.
Shame.
Insane Discussion .... None of the discussion is proving a point here... It is something Like Venus Project from Zeitgeist like discussing Democracy is Bad... Think thru the Other way around................
The big issue I have with "Verified by VISA" is that they are teaching users to enter bank passwords into pop-up / embedded windows.
Trust the pop-up, it's got a VISA logo! So just enter that bank password of yours.
Is there ANY possible way you could better train users to fall for phishing attacks? If the users trust a pop-up, they will enter anything - PIN codes, Social Security numbers, numbers from keychain password generators... anything.
I lost my sig.
For the unfortunate ones of us stuck in India, the VbV/3D secure systems are mandatory by order of the Reserve Bank. Although the law says additional authentication mechanism must be used apart from card details, banks were all to ready to implement VbV/3D systems. And it sucks big time.
Well that's good news, because the American ones like to plant drugs as a practical joke.
"When I am king, you will be first against the wall..."
I worked for a company that runs a payment gateway. We had to implement Verified by Visa in our systems, and we very quickly realised just how pointless it was. It was painfully obvious to us all how easy it would be to circumvent the system. The whole thing was a running joke in the office for the duration of the project.
The trouble was, we weren't given a choice -- if we didn't implement it, we lost our deals with the card companies, which would have basically been the end of the company. And not only that, but we had to do it in a hurry -- Visa were auditing us to make sure we did it, and gave us a very aggressive deadline to get it finished.
Brings back memories of working at a bank while VbV was being implemented, we all knew it was poor system just being used to shift blame to customers but obviously we wern't allowed to say that.
As for security online you are best using a credit card that you pay off in the intrest free period, this way your bank will work to recover any fraudulent activity as it is technically their money.
Chip cards have been in use for a very long time in France. They all have mag stripes, mainly because that's what most ATM use anyway, but also for use abroad. The mag stripe contains information as to whether the card also has a chip, so that even when an authorisation (the terminal phoning the acquirer) is not required, it can decide to deny the transaction preemptively if the card is supposed to have a pin and the terminal is supposed to be able to read it.
In that I case I guess the bank is just being incompetent, and failed to implement the ultra-advanced algorithm:
if (card.haschip() && terminal.haschipreader())
return MUSTUSECHIP;
else
return ITSOKTOUSETHEMAGSTRIPE;
Virtual numbers are very useful, but nowhere to be found on the site. Do you have an URL?
I know what you mean about Newegg. But heres a tip: When you get to the "Verified by Visa" after placing your order w/Newegg, just ignore it. Its meaningless, it doesnt work, and if you ignore it, your order will go through anyway.
Try going here for more information. Scroll down to Virtual Account Numbers. https://www.citicards.com/cards/wv/detail.do?screenID=700
Verified-by-Visa is intended to be a card holder authentication step. If you cancel then all that means is that the merchant hasn't authenticated the card holder and they can decide to take the risk themselves and rely instead on other fraud checks.
So I use the "forgot your password" flow everytime. The genius thing about that is that it asks me stuff I'd already entered on the retailer's purchase form. There's no additional info required
For me it always asks additional information such as date of birth, that you wouldn't have entered at the retailer's form