effing visa 'secure' code rubbish

[briSk]

does it do anything other than make everything take twice as long and screw everything up?

[stuart-b]

It's a private password you set, so that fraudsters can't use your card if they stole the details from an insecure ecommerce shop, or a compromised SSL certificate which sent your data unencrypted over the internet.

I would say it's a good thing in light of the OpenSSL breach which caused tens of thousands or more SSL certificates to be compromised.

http://lists.debian.org/debian-security-announce/2...

It adds another level of security, where you are transfered to the Visa CPI (Where hopefully it's secure!!!).

So yes, it helps.

Edited by stuart-b on Thursday 11th September 11:52

[Gruppe1875]

All you have to do is remember a password! Extra security for another 3 seconds of your time!

I do hope you get over it.

[Fetchez la vache]

You do realise that the real reason behind it is to protect traders, not little old you or me, don't you?

[james_tigerwoods]

And, if like me, you forget the password, you can just set a new one - details of how to do is sent to your email address. WHich will also have been compromised.

Secure? I'm not 100% convinced.

Nationwide give you a card reader thing to secure your transactions - great - Unless you've not got it with you....

[briSk]

Gruppe1875 said:

All you have to do is remember a password! Extra security for another 3 seconds of your time!

I do hope you get over it.

and then another password on top of that when this is proven to be crap and then another and then another.

but my real issue is that it's bks because it seems to fall over if you think you've put the right number in but in fact for that card you don't have one.

this may not be an issue if you have one debit and one credit card but if you have a few it's a load of (new) bks.

[mrmaggit]

james_tigerwoods said:

And, if like me, you forget the password, you can just set a new one - details of how to do is sent to your email address. WHich will also have been compromised.

Secure? I'm not 100% convinced.

Nationwide give you a card reader thing to secure your transactions - great - Unless you've not got it with you....

Or can't remember what password you used when you set the account up with Nationwide three years ago, and they don't give you the option of being able to prompt the question to remind you, which they also set at the time.

Edited by mrmaggit on Thursday 11th September 12:04

[rpguk]

I'm not sure if it's this one or the Mastercard one but I always seem to forget the password I use and it lets me just reregister a new one each time

I also think in with phishing about, banks should be encouraging people to carefully vet the URL's they are visiting, however this scheme seems to take you to a pretty anonomyous "securesuite.co.uk" or something. Same with Natwest Online Banking taking you to a random URL.

[off_again]

Its a hateful system and does very little to protect anyone from anything. They will give it all the usual 'its secure' rubbish, but to be honest it does nothing to prove anything. There is no positive identification of the holder of the card, and if you have stolen the card in the first place, there is a fair chance that you can change the password anyway! So what benefit is that?

I won't bother with the technology either, but suffice to say that I am quite good with my passwords and I had to use it for making a payment on my credit card. Anyway, it asked for the 3rd, 5th and 11th letters from my password. Problem is that its not 11 characters long. I remember these things (and don't write them down) and hence I was mad as hell with them. Complained bitterly with the credit card people about this (it was their site which triggered the SecureCode thing anyway.... their official answer?

Its not that secure and just skip the 11th character bit as its obviously wrong.....

Bloody brilliant. Well worth bothering with then. To be honest its a PR exercise to make the average punter think they are doing something a little more secure....

[cottonfoo]

stuart-b said:

I would say it's a good thing in light of the OpenSSL breach which caused tens of thousands or more SSL certificates to be compromised.

That only affects certs created on Debian systems with the broken OpenSSL binaries installed, probably not an issue if certs are bought from someone recognised, which most will be.

3D Secure is a mechanism to move the responsibility of fraudulent transactions from the merchant to the card issuer (not the card holder). Cardholder not present transactions will only go through if the 3D Secure password is validated against the issuer, so if a cardholder reports a transaction as fraudulent then the merchant shouldn't get a chargeback.

[dilbert]

I was so annoyed by it that I phoned both visa, and mastercard. Both were patient, and listened to my rant, but as you would expect, they did nothing. I felt marginally better.

[youngsyr]

I've tried to register mine numerous times with zero success and rising stress levels each time.

Apparently I don't know the correct card number (which was sat in front of me at the time), my correct home address, and/or my correct date of birth.

How stupid of me.

[dilbert]

I think the biggest problem with the system is that if your card is stolen or compromised before the point at which they ask you to register, then the "secure system" weighs in favour of the criminal.

[Fetchez la vache]

To be quite honest, it's currently only mandatory (from a vendors pov) for Maestro cards. I added this to a few of our sites a few weeks back and the signup rate dropped like a bombshell, so we're taken it off again, exepct for Maestro.

I think that says all you need about peoples perception of this mess.

[Mr Whippy]

This all went wrong with me when doing my online shopping at Sainsburys.

Had a fellow with an Indian accent telling me to go to these websites to set it up after it went wrong, and temporary accounts, and different logons, and giving data over the phone, and passwords all over the shop, and spelling it wrong, going to all manner of random bloody websites, and asking me to input data here there and everywhere, even on some unsecure web pages. A complete and utter joke of a system. Ask me to come into the bank and set it up, or do it through my online banking, but the random system they used. It just stank of another place for data to go missing/cloned cards etc.


I think it's insecure because anyone with just a few personal details can reset it too. I rang up on behalf of my partner (her card, our account) and they wouldn't even let me do anything, they then had to speak to her for 20 mins asking all kinds of details, and this was from a number that just popped up on the screen from an associated company, not HSBC, and not a secure page either (sooooo dodgy, and they suppose to encourage security, yet expect us to use this crap!)

I did argue the point also, that anyone who got the details of the card wouldn't buy shopping from Sainsburys to be delivered to my house, wheras any random unsecure site would still send out goods willy nilly (although most only deliver to the cardholder address for first transactions, and a reminder email would still be sent if it was one where you had already setup a 'different addresses' setup...

I'm not at all convinced.


Last time I set it up for my card it ballsed up because no one said (ie, the web instructions) that it couldn't use special characters, and was length limited (BIG oversight, I wonder what else they have failed to inform us about)
I cancelled it 20 mins after I set it up for my card anyway, if they can't get registration right it's doomed to failure... I had to spend an hour to a person who couldn't speak Yorkshire to set our joint one up to actually buy our bloody shopping, after that setup went wrong too!


Argghhhhhh!

Dave

Edited by Mr Whippy on Thursday 11th September 14:56

[dilbert]

Mr Whippy said:

This all went wrong with me when doing my online shopping at Sainsburys.

Had a fellow with an Indian accent telling me to go to these websites to set it up after it went wrong, and temporary accounts, and different logons, and giving data over the phone, and passwords all over the shop, and spelling it wrong, going to all manner of random bloody websites, and asking me to input data here there and everywhere, even on some unsecure web pages. A complete and utter joke of a system. Ask me to come into the bank and set it up, or do it through my online banking, but the random system they used. It just stank of another place for data to go missing/cloned cards etc.


I think it's insecure because anyone with just a few personal details can reset it too. I rang up on behalf of my partner (her card, our account) and they wouldn't even let me do anything, they then had to speak to her for 20 mins asking all kinds of details, and this was from a number that just popped up on the screen from an associated company, not HSBC, and not a secure page either (sooooo dodgy, and they suppose to encourage security, yet expect us to use this crap!)

I did argue the point also, that anyone who got the details of the card wouldn't buy shopping from Sainsburys to be delivered to my house, wheras any random unsecure site would still send out goods willy nilly (although most only deliver to the cardholder address for first transactions, and a reminder email would still be sent if it was one where you had already setup a 'different addresses' setup...

I'm not at all convinced.


Last time I set it up for my card it ballsed up because no one said (ie, the web instructions) that it couldn't use special characters, and was length limited (BIG oversight, I wonder what else they have failed to inform us about)
I cancelled it 20 mins after I set it up for my card anyway, if they can't get registration right it's doomed to failure... I had to spend an hour to a person who couldn't speak Yorkshire to set our joint one up to actually buy our bloody shopping, after that setup went wrong too!


Argghhhhhh!

Dave

Edited by Mr Whippy on Thursday 11th September 14:56

I'm just going to add into this beast that the banks won't trust me to accept money for goods that I can only really sell online, by credit card, because I'm new.

The thing that I resent the most, is that means they think I'm worse than they are. TBH if I thought I was that bad, I wouldn't bother trying.


Frankly I see a situation where the HSBC on the highstreet takes down it's sign and puts one up that bears the word.......

PayPal.

Edited by dilbert on Thursday 11th September 15:16

[stuart-b]

cottonfoo said:

stuart-b said:

I would say it's a good thing in light of the OpenSSL breach which caused tens of thousands or more SSL certificates to be compromised.

That only affects certs created on Debian systems with the broken OpenSSL binaries installed, probably not an issue if certs are bought from someone recognised, which most will be.

3D Secure is a mechanism to move the responsibility of fraudulent transactions from the merchant to the card issuer (not the card holder). Cardholder not present transactions will only go through if the 3D Secure password is validated against the issuer, so if a cardholder reports a transaction as fraudulent then the merchant shouldn't get a chargeback.

You obviously know a bit about this, but in order to buy an SSL certificate you have to send the certified CA your CSRs (You can self generate yes, but this isn't what we're discussing). If you generate the CSR from a Debian system and send it to your CA, the CA wasn't* checking if your CSR had the key error, and were issuing bad certificates. Source, and list of a few affected ecommerce sites http://codefromthe70s.org/sslblacklist-badcerts.as....

• (GoDaddy, and various other big names only just started checking for the bug as of 18th Aug '08).

Here is a black list package that contains fingerprints for 1,179,648 known bad keys. https://launchpad.net/ubuntu/+source/openssl-black...

You can install a firefox plugin to detect bad keys, and CAs have been revoking certificates that they have found errors with.

The verified by Visa provides another level of security, which does work to some extent, and is a step in the right direction. If someone steals your card and tries to use it online, it won't work. However, your shop has to be set up with verified by visa as an option, it's not a requirement (IIRC), so it only protects the trader from accepting a fraudulent transaction. Hopefully all traders will follow suit, or Visa make it a requirement before a process can be done.

If someone has managed to get hold of your card details any other way, via packet sniffing over an unencrypted network, it's likely they have also sniffed your login details too - and you will no doubt use the same login password for your email, as you do for your account with the shop, so in theory the hacker could reset your verified by visa password - which is why I think a password reset needs to be done via Internet Banking or Telephone Banking.

[stuart-b]

dilbert said:

I think the biggest problem with the system is that if your card is stolen or compromised before the point at which they ask you to register, then the "secure system" weighs in favour of the criminal.

Agreed, this needs to be set up before the card is activated.

[GreenDog]

james_tigerwoods said:

Nationwide give you a card reader thing to secure your transactions - great - Unless you've not got it with you....

And if you also have an account with Barclays you have 2 different readers to carry around with you !!!

[Mr Whippy]

They would solve half the issues is they allowed people to turn their card on and off for internet transactions.

Ie, allow trusted sites, that you define via your online banking, and then lock all others. It really can't be hard. Trust Amazon, and amazon have my details already, so they know my card is registered to me already, not someone else at a new address for example.



Even for cloned cards this would work by location. Ie, I'm in the UK, so lock it for the USA, Turkey, China, India etc etc...


How hard can it be?


I see all the current efforts as cheap and lame. Cripes, we didn't even get encrypted chip and pin here, thats how cheap they are!

Dave