Hacker News Reader

Comment by tommorris | Hacker News Reader

> UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions.

Ahh, 3D Secure/Verified By Visa/MasterCard SecureCode.

It really needs to die right now. Basically it teachers consumers to fill in random iframes on merchant sites.

And the fact that the card industry thinks 3D Secure is secure or in any way a good idea is why they'll never make standardised forms.

View on HN

The worst thing about these programs is the liability shift. Normally the merchant is left on the hook for fraudulent transactions.

With VbV and 3DS that liability passes back to the credit card company. Since the credit card company doesn't want that liability, and obviously there are no security holes in their system, then only one person can be responsible for not taking adequate care of their card and security details. Yep, you the consumer (read your small print).

Hence, by signing up for any of these programs as a consumer, you are shooting yourself in the foot.

Added to which, the program has been shown to be insecure, since if you hold the card in your hand (i.e. you skimmed the card), you can/could simply choose to reset your password: http://www.alphr.com/realworld/373768/the-security-hole-in-v...

Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.

I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it.

If you know how to opt out of it, I'd love to know.

It does seem to work that way, I'm sure I've signed up for Verified by Visa but I've only had to use it once or twice. Which makes me happy, because I hate it.

A friend of mine told me his bank let him opt out. He just pestered them a lot.

The implementation is up to the bank. My banks use 2-factor authentication solutions for 3DSecure (one has you put the chip in a special reader, the other uses a mobile app)

https://www.flickr.com/photos/kalleboo/2486214902

Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!

Worse than that, it's all bounced through a site called securesuite.co.uk. Take a look:

https://securesuite.co.uk/

Impressed?

"Please type in a whole load of other personal information" Nope! I get a good feeling of petty bureaucratic victory every time I see a site bounce in and out of Verified by Visa since I persuaded my bank to opt me out.

It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty much have freedom in it. You can choose 2D / 3DS. Yes, the different is pretty clear: who will responsible for the fraud. For 2D, merchant is responsible for fraudulent transaction -- and merchant can be charged back; while in 3DS the merchant will free from chargeback (hey you have been notified via two-factor authentication, so it is your fault, customer!)

Meanwhile, in Malaysia, all credit card transaction must be in 3DS.

Reply on news.ycombinator.com