Not content with destroying the world’s economies, the banking industry is also bent on ruining us individually, it seems. Take a look at Verified By Visa. Allegedly this protects cardholders - by training them to expect a process in which there’s absolutely no way to know whether you are being phished or not. Even more astonishing is that this seen as a benefit!
...
Craziness. But it gets better - obviously not everyone is pre-enrolled in this stupid scheme, so they also allow for enrolment using the same inline scheme. Now the phishers have the opportunity to also get information that will allow them to identify themselves to the bank as you. Yes, Visa have provided a very nicely tailored and packaged identity theft scheme. But, best of all, rather like Chip and PIN, they push all blame for their failures on to the customer
I've instinctively hated these "Verified by Visa" ever since they came out, and tried not to use them. The fact that they are not just inherently insecure, but encouraging merchants to use this in the most insecure way possible, is astonishing even for an industry as rank and rotten as banking.
The one consolation has to be that Verified by Visa is so demonstrably insecure that it should be easy to challenge in court any attempts to make customers pay for the banks' own stupidity.
Follow me on Twitter @glynmoody
I know exactly what you are talking about. Very interesting blog. Thanks
ReplyDeleteThis one's for you Mr. Moody:
ReplyDeletehttp://img211.imageshack.us/img211/8048/phish.png
That'll do nicely....thanks.
ReplyDeleteSomeone needs to drum into students at 'security school' that authentication is a TWO-WAY street.
ReplyDeleteThe idea that only the pleb needs authenticating betrays an egregious conceit.