News for hackers. Stuff that matters.

A comment on Stripe Chargeback Protection. Parent comment

Re:Stripe Chargeback Protection by hedora on Monday June 03, 2019 @09:39AM (#20082924)
As an end user, how can I tell the modal dialog is actually my bank?

It looks trivial for the vendor to man in the middle attack.

I’d take my business elsewhere if presented with a UI from some random e-commerce site asking for extra personal information.

[ Parent | on HN ]
Re:Stripe Chargeback Protection by HatchedLake721 on Monday June 03, 2019 @10:18AM (#20083301)
3D secure payments in Europe have been a standard for years - being presented with additional verification steps for online purchases.

Attacker cannot know who you bank with. Plus, most of the time the confirmation screens are something like confirming 2nd/Xth characters of your password/date of birth.

[ Parent | on HN ]
Re:Stripe Chargeback Protection by oakesm9 on Monday June 03, 2019 @11:34AM (#20084274)
I bank with Monzo and they send a push notification to my phone with an "Approve" button. No way to fake that.
[ Parent | on HN ]
Re:Stripe Chargeback Protection by plttn on Monday June 03, 2019 @11:21AM (#20084088)
> confirming 2nd/Xth characters

That is somehow significantly less reassuring than not having 3D Secure payments in the first place.

[ Parent | on HN ]