But it is set up in an insecure way via an iframe at a merchant site, it would be easy to fake it. Furthermore, it is also very easy to reset the password, I only needed my card number and my date of birth. If my wallet were lost or stolen, the finder or thief would have all the information to set a new password. Hardly secure, is it?
If it were an iframe, with the right browser, you could check the SSL certificate on the iframe. The problem is that it usually isn't; the card processor really does go man in the middle on the outbound leg (which also means that their system has a copy of your challenge phrase!)! The form is typically copied into the card processor's web page (or at least that was the case on the last few VbV's that I've tried (and aborted as a result).
They are all operated by the same company.
Not true on our Nationwide Visa card, when the Verified by Visa window appears it offers two 'users'.
"S" wrote
Nope, you're right - it is hardly secure to keep your date of birth in your wallet!!
Thx for the info about Verified By Visa. What a swizz.
Is there a way to un-register from it?
It's on your driving licence. And most people carry that in their wallet.
Mark
"Mark Goodge" wrote
Correct.
"Mark Goodge" wrote
Do they really? How silly! I don't...
You'll be telling me next that they also keep a spare front door key there - it's a good job their address isn't in their wallet too! Wait a minute, isn't that on the driving licence too? Oh dear...
Do "most people" also carry their chequebook around in the same pocket as their cheque guarantee card, and also a plain-sight copy of all their PINs?
This is all quite worrying...
I must agree. The proper place for a driving licence is in a desk drawer at home, you never usually need to have it with you except when hiring a car, or being asked to produce it by a PC (but you don't need to produce it on the spot - you can take it to any police station within a reasonable time).
Most people who carry handbags probably do, if you can count the interior of a handbag as one pocket. Or they used to. Nowadays chequebooks tend not to be required so much out of the house.
No, not most people. But some of us do have difficulty remembering the numbers, so have to write them down (I'm pleased to be able to say I'm not quite there yet). Those of us who are sensible enough to write them down in some form of code may in due course be thwarted by also having difficulty remembering that code. :-(
Quite so. Let's abolish PINs and re-introduce the good old fashioned signature.
Shock horror! I've just found a web site that does this properly. I'd normally back off at the first sign of 3D secure, but this is a site that is relatively unique and I wanted the order to go through quickly, so I set a session password and used 3D Secure, only to find that they did give the form with full chrome under the card issuer's URL. Unfortunately, 3D Secure will not now let me revert my session password to the original master one.
By session password, I mean one that is only valid for the duration of the one transaction.
Have something to add? Share your thoughts — no account required.
Ask the community — no account required