Payment Providers

[James Laver]

On 2 Oct 2009, at 12:07, David Precious wrote:

> It's a poor attempt towards three-factor authentication, but relying  
> upon
> entering a password - which will be picked up by the same keylogging/ 
> sniffing
> techniques they'd use to grab the rest of your details if you're  
> entering them
> on a compromised machine.  However, now, the bank has shifted  
> liability to the
> customer, claiming that since the transaction was authorised with  
> their
> "secret password", they have no right to repudiate the transaction.

Yes, those lovely three factors:
- Something you know
- Something you know
- Something you know

Clever, huh.

Firstly, they shift liability to the bank, which is why retailers like  
it. Unfortunately the bank shifts liability to the customer with the  
defence "but noone else knows your 3dsecure password, it was you,  
there was no fraud". HSBC revealed to me that they've had 'zero fraud'  
since the introduction of the scheme, which means they're pinning  
this, exactly like they've all been pinning chip and pin fraud on the  
bank customer, because of the same defence (and they got away with  
that one in court, somehow).

Because of this, banks are loathe to let you opt out. I've been unable  
to do so with HSBC.

I've been writing a paper about attacks on the 3dinsecure system and  
it's all remarkably easy:
1. I steal your card (or memorise your details while you're paying  
with it), you haven't registered yet, I register for you, thus  
choosing the password I want
2. I steal your card (or memorise your details while you're paying  
with it) and go through a simple reset procedure, which generally only  
requires information I could extract from you during an hour at the  
pub without you realising
3. I set up a fake page that looks like a 3dsecure page on my site and  
cream off the details before submitting them myself so the payment  
goes through. Since it's all handled by third parties, you'd never  
know what's legitimate and what isn't.

And many, many more, wait for the paper to be released :) It doesn't  
take an evil genius to see gigantic holes in the system, it's shaped  
like a swiss cheese.

--James