[the_mitsuhiko]

> One of the big issues with the credit card business is fraud. Fraud is around 1% of all credit card transactions. Fraud tends to be higher on online payments where the "card not present" rate that merchants pay is higher than the "card present rate" enjoyed by brick and mortar stores.

These are things that will change over time. 3DSecure is standard in Europe because the EU pushes transaction fees so low that credit card companies need to reduce fraud because they cannot afford it any more.

[lsc]

Do consumers all have little usb smartcard things so they can use the smartcard to make online purchases? or does this mostly just make 'card present' transactions that much safer?

[hrrsn]

3D Secure basically redirects you to a webpage run by a third party (usually your bank) to enter additional details, like a seperate password.

I find it much more annoying. My New Zealand (.co.nz) bank redirects me to a .co.uk domain with their logo (!!), where it doesn't even prompt me for any additional details, just forwards back to the original merchant.

[xyzzy123]

It is likely that they are processing a risk score for your transaction, based on browser fingerprint, referer, ip, time of day and so on. That is, the "bounce" may not be entirely useless.

If the risk score exceeds a certain threshold then they can then require additional security. While this may seem very weak, in practice a lot of fraud has pretty obvious signatures.

[hrrsn]

Fair enough. Just having a .nz bank direct me to a .uk domain is a huge red flag for anyone that bothers looking at this sort of thing

[lsc]

huh. yeah, there's a 'verified by visa' thing that America has that is similar... I think it does some statistical something something. It sure looks a lot weaker than a public key transaction where the key never leaves the card. The 'verified by visa' site itself looks pretty fishy.

In theory, a chip and pin solution where the user owns the reader is more secure than a transaction in the store where the vendor owns the reader. but, I guess that's too expensive and inconvenient or something.

[cowsandmilk]

"Verified by Visa" is 3-D Secure.

https://en.wikipedia.org/wiki/3-D_Secure

[the_mitsuhiko]

When 3dsecure just redirects it means the bank decided to trust the transaction based in something. For instance for me it skips it for some known vendors and transactions.

[the_mitsuhiko]

My Austrian bank embeds a 2FA system on the iframe. I get an authentication code on my phone and enter that. It typically asks that when shipping to a new address or dirst use of a vendor that uses 3dsecure

[gst]

While 3DSecure and Verified by Visa is a good idea in theory, the implementation is a mess. For example, my bank requires me to enter my banking username and password into the banking website, which is loaded via an iframe inside the merchants site. How is a regular user supposed to verify that the iframe loaded his banking website and not some phishing website?

[jon-wood]

My bank is marginally better than this and includes a string I set when I first configured 3D Secure in the iframe, but its still a mess and asking for phishing attacks.

[the_mitsuhiko]

Sounds like a problem with your bank. Mine prompts me for a token that is sent to my phone where it also shows me what transaction i confirm. In addition the iframe pops up a memorable message I can configure to verify that it's a frame from the bank. Even in the absence of ssl this would be safe.

[Natanael_L]

> In addition the iframe pops up a memorable message I can configure to verify that it's a frame from the bank. Even in the absence of ssl this would be safe.

No, they can do a replay attack on this setup when not encrypted

[the_mitsuhiko]

It's a transaction bound short lived one time token. Nothing you can replay.

[thesimon]

My German bank does the same, my UK bank just asks for details that are written on the card. Seems a bit ... weak and prone to attacks.