5 ms·
Unless you've worked for a payment processing company, or for a major retailer that does a lot of payment processing, you have no idea how much fraud or attempt
by levelz 2y ago
Unless you've worked for a payment processing company, or for a major retailer that does a lot of payment processing, you have no idea how much fraud or attempted fraud happens in transactions (you can even see it as a small retailer if you are getting sales online and say you'll ship international).
- __MatrixMan__ 2y agoA credit card number is a symmetric secret that's printed on the outside of something that you hand to strangers all day. That's not exactly best practice. If we moved to a PKI where the private keys live in secure enclaves, you could cut that fraud down significantly. But that won't happen, because then how would they justify the fees?
- eps 2y ago3DS exists and it is widely supported.
- __MatrixMan__ 2y agoDoesn't that just trade one symmetric secret for another? (your password) I suppose it's a little better because you probably haven't written your password on the side of your card, but everytime I have to go through it it feels like I'm getting phished. Also, SSL seems kind of messy for the job. You've already got the processor as a third party, now the CA's are a fourth party, plus whoever gets to install certs on that device as a fifth... You could just have the card sign the transaction and have the merchant send that signature to the clearinghouse. For online orders, your phone could just be the payment terminal, and still the secret on the card is the signing key. But none of that actually helps unless you deprecate the insecure stuff.
- dzikimarian 2y ago3ds is usually done with inapp confirmation these days. Your bank is responsible for the experience.
- __MatrixMan__ 2y agoIf my bank were responsible, they wouldn't be using SMS 2FA.
- dzikimarian 2y agoWell apparently they are. Or at least have choosen vendor who doesn't have better option. This piece of software is called ACS and is at issuer's discretion.
- snotrockets 2y agoOr how many different rails and protocols there are, and how many of those you need to support if you actually want to serve most customers.
- welder 2y agoVisa enables the fraud with their insecure payment system, then place the blame on merchants with chargeback fees.