Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by levelz on Saturday August 17, 2024 @04:18PM (#41277615)

Unless you've worked for a payment processing company, or for a major retailer that does a lot of payment processing, you have no idea how much fraud or attempted fraud happens in transactions (you can even see it as a small retailer if you are getting sales online and say you'll ship international).

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by __MatrixMan__ on Saturday August 17, 2024 @05:38PM (#41278200)

A credit card number is a symmetric secret that's printed on the outside of something that you hand to strangers all day. That's not exactly best practice.

If we moved to a PKI where the private keys live in secure enclaves, you could cut that fraud down significantly. But that won't happen, because then how would they justify the fees?

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by eps on Saturday August 17, 2024 @05:43PM (#41278232)

3DS exists and it is widely supported.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by __MatrixMan__ on Saturday August 17, 2024 @05:56PM (#41278320)

Doesn't that just trade one symmetric secret for another? (your password)

I suppose it's a little better because you probably haven't written your password on the side of your card, but everytime I have to go through it it feels like I'm getting phished. Also, SSL seems kind of messy for the job. You've already got the processor as a third party, now the CA's are a fourth party, plus whoever gets to install certs on that device as a fifth...

You could just have the card sign the transaction and have the merchant send that signature to the clearinghouse. For online orders, your phone could just be the payment terminal, and still the secret on the card is the signing key.

But none of that actually helps unless you deprecate the insecure stuff.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by dzikimarian on Sunday August 18, 2024 @08:01AM (#41281817)

3ds is usually done with inapp confirmation these days. Your bank is responsible for the experience.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by __MatrixMan__ on Sunday August 18, 2024 @11:46AM (#41283060)

If my bank were responsible, they wouldn't be using SMS 2FA.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by dzikimarian on Saturday August 24, 2024 @04:24PM (#41341208)

Well apparently they are. Or at least have choosen vendor who doesn't have better option.

This piece of software is called ACS and is at issuer's discretion.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by snotrockets on Saturday August 17, 2024 @09:43PM (#41279511)

Or how many different rails and protocols there are, and how many of those you need to support if you actually want to serve most customers.

[ Parent | on HN ]

Re:Do we need to pay billions in fees to Stripe, Block, PayP... by welder on Sunday August 18, 2024 @07:04AM (#41281599)

Visa enables the fraud with their insecure payment system, then place the blame on merchants with chargeback fees.

[ Parent | on HN ]