http://www.HostsFile.org/pac.html
http://www.SecureMecca.com/pac.html

What gets me is that it gave me a user name I didn’t want and a phone number for my bank (I called – it is them so at least it is legitimate) but now I have an ad-hoc user name they created with no password, no way to change that, and no way to make a purchase! It says you need to login to your bank to set the stuff up. I did and there is nothing there. Either they need to have you set it up with your bank with a user name of your choice and a way to enter a password or they should scrap the whole fiasco.

Does anybody know what it is for MasterCard? I heard they had something similar. But I had to modify my PAC filter rule from this which prevented access to bogusvisa.com:

GoodDomains[i++] = “.visa.com”;

to this which allows it:

GoodDomains[i++] = “visa.com”

just because of this thing that is supposed to make you safer (they actually use just plain old “visa.com”). This rule used to prevent the bogusvisa.com:

BadHostParts[i++] = “visa\.com”;

It still prevents unknown phishers like visa.com.gobbledygook.co.uk, but the fact that Visa doesn’t always call subdomain.visa.com or http://www.visa.com but instead uses just plain visa.com opens up a pattern for abuse.

I think this needs to be sent to the scrap heap. I don’t mind a different user name and password from the bank and different ones for each card but the information should be creatable (sic) at each of your bank sites and not hid some place in their menus. I never found the place to do it at my bank so I am going to have to go in and see them in person tomorrow. You should also have complete control of the process BEFORE you hit it at a purchase check-out. That opens up so many chances for abuse that you cannot believe it.

http://www.richardskingdom.net/verified-by-visa-bad-for-security-worse-for-business

It beggars belief that Visa and Mastercard, the latter under their “SecureCode” brand, have adopted a technology that behaves just like the phishing attacks about which they constantly warn us.

Verified by Visa would have more credibility if credit card companies were required to post the passwords to account-holders. This wouldn’t be difficult – it’s what they do with PINs, after all.

Good article. I did a blog post similar to this a few weeks back but focusing more so on their forgot password functionality.

I was already enrolled for 3D Secure but when prompted for my 3D secure password I selected the ‘forgot password’ option. Then I was prompted to enter some information to verify my identity. All of this information except for my date of birth was available on my card. Finding someone’s date of birth is not difficult with the popularity of social networking sites.

I was able to change my password and make my purchase. Not very secure in my view!! You can find the complete blog post here –

http://www.webpayments.ie/blog/fundamental-flaw-with-3d-secure.html

Dave

Thankfully Amazon doesn’t yet. I’m using PayPal wherever it’s offered now.