Ramblings of an old Doc

 

No doubt you’ve run into online verification procedures for processing payments…After making a purchase, retailers redirect customers to a page with a Verified by Visa or MasterCard SecureCode form, into which they are required to enter characters from their password to verify their purchase…and the consequences when these sites are hacked. These passwords are a true pain and are difficult to remember. Consumers generally hate these systems.

There are big changes coming, and when they occur, you should be aware so you don’t think you’ve been ‘redirected’, and run into a new system if you get my drift. They won’t be using static passwords but will be focusing on 2 factor verification, biometrics and disposable single use passwords. In the event that authentication is needed, cardholders will be able to identify themselves with the likes of one-time passwords or fingerprint biometrics, rather than committing static passwords to memory. MasterCard is trying Facial and voice recognition software as well as a wrist band to identify through a user’s cardiac rhythm.

So, 3D Secure 2.0 will begin to implement these systems starting next year and will be gradually replacing the older Verified by Visa and MasterCard SecureCard systems.

Source:

http://www.telegraph.co.uk/technology/news/11228300/Mastercard-and-Visa-to-kill-off-password-authentication.html

http://www.neowin.net/news/verified-by-visa-and-mastercard-securecode-to-be-killed-off-replaced-by-unified-standard


Comments (Page 1)
2 Pages1 2 
on Nov 15, 2014

OK, so what if someone doesn't have the cash to buy all those gadgets used to verify?  Is this going to become another part of the web enhanced techno that squeezes out folks that don't have the disposable income to have i phone - level accoutrements (etc.)? Oye.

on Nov 15, 2014

There will be alternatives for those without biometric devices, I'm sure.

on Nov 15, 2014

I hope they never require those stupid wrist bands.  If they think I'd wear a plastic or rubber band around my wrist, they would be wrong.

on Nov 15, 2014

don't worry, the chip implant will not only be free but mandatory.

on Nov 15, 2014

Those systems didn't actually work anyway (even if you don't do it, the sale goes through); back before I switched cards, their javascript would always break and it never made a bit of difference. Their sole purpose seems to be just to prevent folks from being able to falsely claim the charge was fraudulent and get it refunded.

on Nov 15, 2014

Why do you say those systems didn't work? I logon with my fingerprint...

They could use a retina print verified with normal nystagmus and arterial pulsations. 

 

on Nov 15, 2014

DrJBHL

Why do you say those systems didn't work?

Like I said--


Those systems [verified by visa, etc.] didn't actually work anyway (even if you don't do it, the sale goes through);

Unless they've fixed it in the few years since I used a Visa on NewEgg (only site that I ever had do it), you could just close your browser when the verification came up for all the difference it made; the charge went through either way. It flat out didn't do anything but annoy customers. And that's not even getting into the other issues with it (like it looks like a phishing attempt, desensitizing people to real phishing attempts; it allows on-the-fly password reset with only your birthday and info on the card; etc.).

Tacking on biometrics to a system that is fundamentally broken is not the way to improve security.

on Nov 15, 2014

The way I read it, it will supplant the current system...not be tacked on.

on Nov 15, 2014

Ultimately, unless it becomes a standard part of the actual transaction (not an optional tack-on or a third-party popup), it is still going to keep a lot of the same issues. And I don't have much confidence in the card companies to address those issues as quite frankly, they don't really concern them. Their objective is not security--it's to shift liability. So as long as there is something they can point to to make someone else bear the cost of fraud, they're happy.

If they actually cared about preventing fraud, we would have had chip-and-pin at POS terminals in the US years ago. The reason that never happened is because they can make retailers bear the cost of fraud, so they have no reason to require or subsidize better security.

on Nov 15, 2014

Scammers will just get their biometric readings, which they can then use to fool the system.  Anything that turns into data can be faked with said data, a biometric is no different from a four digit pin once the thief has it.

 

The actual solution to the problem is our jackass law enforcement running them in instead of playing traffic monitor all day, and our worthless prosecutorial system throwing the book at them when they do.

 

Fraud isn't prosecuted for shit.  You can rob a bank for 20 grand and the FBI is all over your ass before you even get out, but if you scam them out of 20 grand with fake ID they wont even bother to show up.  A couple hundred bucks on someone's plastic isn't even small time.  Unless you scam the DA or something, no one will show up even if you have a few grand in internet purchases delivered to your home address.

on Nov 16, 2014

Chip and pin are certainly fine in the non-virtual world...but online, not really possible to those of us walking around w/o card readers on us. I think that 3D will fix what may or may not be broken since it's very much in their interest to do so.

on Nov 16, 2014

Yes, the chip-and-pin comment was just an example of their priorities. But in regards to online purchases, they both have some of the same issues. Namely, they both require a hardware purchase by the consumer, and as psychoak pointed out, they both require data from an untrusted client (subject to forgery and other attacks).

on Nov 16, 2014


Namely, they both require a hardware purchase by the consumer, and as psychoak pointed out, they both require data from an untrusted client (subject to forgery and other attacks).

Indeed regarding the equipment...as for the rest, if it relied on a second step involving what I noted in reply #6...however, it's all rather a pita.

on Nov 16, 2014

DrJBHL

Why do you say those systems didn't work? I logon with my fingerprint...

They could use a retina print verified with normal nystagmus and arterial pulsations. 

 

 

Until some enterprising culprits cut your finger off, and pluck your eye to gain access... or at the ATM - make you do it knife/gun point?

on Nov 16, 2014

The point about nystagmus and arterial pulsations, Elana is that one would have to be alive for them to be used...

2 Pages1 2