1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look like phishing: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf
2) My understanding is that my bank shifts liability to me for 3D Secure transactions. Why would I want extra liability?
Good lord! Reading through this document is like reading a primer in how not to make a secure form.
[1]: https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstron...
Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved.
Do people encounter this on a daily basis?
(The redirect sometimes happens, but it's automatically approved.)
It sends a text to my mobile for me to plug into the form to approve the txn -- thus, not like phishing in this case. But for a while this was a real nightmare because my mobile number changed, and I couldn't figure out how to convince my bank to store the new number (it turned out after many months and phone calls I was sending the requisite paper form to the wrong address for my type of account...).
There could be, say, an HTML5-exposed API capable of triggering "super-modal" forms (like OS UAC does) if-and-only-if the page is being served from a secure origin cross-signed by some "Web Banking Working Group Certificate Authority" that all the banks and OS makers are members of.
Unfortunately the banks have less motivation to invest in this as long as the costs of fraud are pushed onto merchants and all of the major players charge similar fees. If something like Apple Pay starts to catch on, perhaps we'll see that change once the banks’ main concern is avoiding a single vendor getting too much market share.
[1] https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.j...
Another one uses a smartphone 2FA app.
For every transaction the customer must enter the OTP. It wouldn't serve much for subscriptions, though.
with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp.
p.s. i am yet to read that link.