[hakfoo]

3-D Secure has been a fiasco IMO.

I can recall when we first tried 3DS in the US and it went over like a lead balloon. Let's jump out of the middle of checkout and go to a page which looks like they're trying to phish your bank account to continue, and by the way, you can just skip it. So customers did, and then merchants followed, except in countries that effectively required it because they cared about fraud.

One of the major selling points of 3DS2 was basically "we can guesstimate fraud with magic black-box logic behind the scenes so most of the time the customer is not disrupted."

But it's still lipstick on a pig because there are plenty of outs where you don't strictly need 3DS even in "countries that required it", and it's still window dressing around the idea that we're giving merchants an unscoped credential and hoping desperately it doesn't get misused or stolen elsewhere.

When we finally decide we don't want to get lapped by India and Brazil in payment tech anymore, I hope the camel-designed-by-committee it spawns is a push-only paradigm. If I want to buy something, let Newegg render a HTML microformat that browsers can detect and turn into a big clicky link to my bank's website/app with a pre-configured outbound transaction. Just as easy for the customer as a stored card, with less risk of abuse/compromise.

[SkiFire13]

> 3-D Secure has been a fiasco IMO.

> I can recall when we first tried 3DS in the US

Exactly, it has been a fiasco in the US, but it's working quite well in Europe.

> When we finally decide we don't want to get lapped by India and Brazil in payment tech

They are indeed ahead, but they still work based on some kind of user authentication that's not a plaintext credit card number. That's the same disruption as 3DS, except normalized and a better executed.

[mcintyre1994]

> Let's jump out of the middle of checkout and go to a page which looks like they're trying to phish your bank account to continue, and by the way, you can just skip it.

Any idea why they implemented it like that?

In the UK you either get a text from your bank with transaction details and a code to approve it. Or the better ones you just open their app and tap approve.

[robertlagrant]

> Any idea why they implemented it like that?

3D-Secure long predates apps, including in the UK. I had to work on a Government Gateway integration for local council payments in the mid 2000s that included 3D-Secure. I still see it today, although it normally now results in a ping to an app approval.

[account42]

It's also stupid because most people already have a bank app as 2FA so they could just make approve payments there. And this functionality exists or at least existed but I can count the number of times I have seen it on one hand. Instead my bank went back to randomly denying transactions based on questionable heuristics.

[tupac_speedrap]

In my experience that's how 3DS actually works though, you have 8 minutes to approve the transaction in your bank app and your bank app usually has it's own security to actually access it to accept the transaction

[jack_pp]

that's how it works in my country, though there are no denies, almost 90% of transactions over 20-30$ will require I go into my bank app and confirm it.

rarely a big transaction will go through without 2FA but I've never had a transaction declined outright without first asking me to 2FA from the bank app

[ThePowerOfFuet]

> Let's jump out of the middle of checkout and go to a page which looks like they're trying to phish your bank account to continue

Except that your bank has just sent you an SMS OTP with the details of the transaction, or has sent you a push notification via their app for you to confirm that it's you.

Nowhere do we enter credentials of any sort on the 3DS2 interstitial page.