Hacker News Reader

I see a lot of comments blaming either substack or 1password, but to me it seems the archaic transaction method of credit cards deserves most of the blame for these kinds of problems.

If the transaction authentication takes place on a separate page hosted by your own bank (so after the amount has been finalised) these kinds of mistakes can't happen. Unless the user neglects to look at the shown amount, but then the user is clearly at fault.

View on HN

This is the way it happens in India. We have to enter an OTP to authenticate the transaction. The OTP comes as a SMS and it tells the amount.Some merchants tie up with bank and we can enter the OTP on the merchant's site or choose to go to the bank's site to enter OTP. In any case the OTP page is a new page and the amount is displayed.

That's a good solution. The risks associated with many issues can be transferred to the user in a way that they retain operational control.

Reply on news.ycombinator.com