News for hackers. Stuff that matters.

A comment on Stop restricting my password - Help these sites get better security..

Re:Stop restricting my password - Help these sites get bette... by pierrefar on Friday January 22, 2010 @04:23AM (#1069381)
Just 2 days ago, I got a call from Natwest bank (UK) from the credit card fraud team. Again. I duly called back and they explained that an attempt to use my card online failed at the Secure Code step. I explained to the caller that Secure Code is a piece of rubbish because it uses very weak passwords (alphanumeric only, 8 chars long) and it's the equivalent of protecting my money by wrapping it in a piece of paper. I refuse to sign up to it or use because it is so rubbish.

He couldn't care less. So I asked him to file a formal complaint about this point. I doubt he did.

For those that want to know more about InSecureCode: http://www.mastercard.com/us/personal/en/cardholderservices/...

[ Parent | on HN ]
Re:Stop restricting my password - Help these sites get bette... by henrikschroder on Friday January 22, 2010 @05:11AM (#1069417)
It's the same as Secure3D for Visa, right?

It is actually kind of secure because the card processor never gets or knows your extra code, but the implementation is atrocious since it requires the website wanting your money to display a webpage from your bank. The odds of that page integrating nicely with the website's payment flow is kinda non-existant, and always sets my fraud alert spinning.

[ Parent | on HN ]
Re:Stop restricting my password - Help these sites get bette... by mmelin on Friday January 22, 2010 @07:13AM (#1069533)
Visa calls it "Verified by Visa", actually. The common name is 3-D Secure. And yes, the implementation sucks, especially since you're dependent on the _issuing_ bank being able to keep their 3-D Secure server up (which serves the auth step).
[ Parent | on HN ]
Re:Stop restricting my password - Help these sites get bette... by pierrefar on Friday January 22, 2010 @05:29AM (#1069429)
The fact it's always on a separate domain doesn't help either.
[ Parent | on HN ]