{"id":1017,"date":"2008-10-24T10:01:12","date_gmt":"2008-10-24T18:01:12","guid":{"rendered":"\/?p=1017"},"modified":"2008-10-24T10:01:12","modified_gmt":"2008-10-24T18:01:12","slug":"the-emperors-new-clothes","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1017","title":{"rendered":"The Emperor's new clothes"},"content":{"rendered":"

The UK's Register <\/a>has been running a a series of articles by John Leyden<\/a>\u00a0\u00a0(here<\/a>, here <\/a>and here<\/a>) about Verified By Visa. (VByV)\u00a0<\/a>\u00a0Verified By Visa uses the same kind of “site redirection” I've written about many times with respect to OpenID and other password-based federation technologies – but in this case it is a banking password that can be stolen.<\/p>\n

The phishing scenario is simple enough.\u00a0 If you happen onto an “evil” site and are tricked into purchasing something, it can “misdirect” your browser to a counterfeit VByV signon page.\u00a0 As John explains, you have little chance, as a user, of knowing you are being duped, but once you enter your password it is available to the evil site for both instant use an future reuse.\u00a0 Those familiar with this site will understand that this is yet another example of an attack that cannot be made against Information Card users.<\/strong><\/p>\n

Beyond focussing attention on the phishing problems inherent in “site redirection” approaches,\u00a0John argues that\u00a0the system – though\u00a0claiming to be more secure – is actually\u00a0just as vulnerable<\/strong> as\u00a0non-VByV mechanisms.\u00a0\u00a0He then\u00a0argues – and I have know knowledge as to whether this is\u00a0the case –\u00a0that the false claims about increased security are being used to\u00a0reject complaints by end-users about irregularities and fraudulent purchases made in their name.\u00a0 If that were true, it would be scandalous.<\/p>\n

Friends, this is a case of “The Writing on the Wall”.\u00a0 I think people in the industry should see John's work as\u00a0a sign of what's to come.\u00a0 \u00a0He is the guy in the fable who is\u00a0shouting out that\u00a0“the Emperor has no\u00a0clothes!”\u00a0\u00a0And he's doing it\u00a0cogently to\u00a0the wide readership of the Register.<\/p>\n

If I were an advisor to the emperor at this point\u00a0I would\u00a0insist on\u00a0two things:\u00a0<\/p>\n

    \n
  1. admit the vulnerability of all systems based on “site redirection”; and<\/li>\n
  2. start getting into phishing-resistant technologies like Information Cards while one's modesty\u00a0can still be protected.<\/li>\n<\/ol>\n

    John makes his points without the stench of jargon.\u00a0 In spite of this,\u00a0North American readers will require a dictionary to follow what he's saying (I did).\u00a0\u00a0I'm talking here about a dictionary of British idioms (thanks to my friend Richard Turner for boosting my vocabulary on this one)\u00a0:<\/p>\n

    punter <\/strong><\/span>n<\/span><\/em> guy. A punter is usually a customer of some sort (the word originally meant someone who was placing bets at a racecourse)…<\/span><\/p>\n

    To see a bit of\u00a0what mainstream press worldwide will be writing about as the paucity of redirection technology for long-tail scenarios is concerned, I do suggest looking first hand at these articles.\u00a0 One small taste<\/a>:<\/span><\/p>\n

    Both Verified by Visa (VbyV) and MasterCard's equivalent SecureCode service are marketed as offering extra security checks to online purchases. Importantly, the schemes also transfer liability for bogus transactions away from merchants who use the system back towards banks (and perhaps ordinary e-commerce punters).<\/p>\n

    Online shoppers who buy goods and service with participating retailers are asked to submit a VbyV or SecureCode password to authorise transactions. These additional checks are typically submitted via a website affiliated to a card-issuing bank but with no obvious connection to a user's bank.<\/p>\n

    Punters aren't informed up front that a merchant has signed up to Verified by Visa. Sites used to authenticate a VbyV or SecureCode password routinely deliver a dialogue box using a pop-up window or inline frame, making it difficult to detect whether or not a site is genuine.<\/p>\n

    The appearance of phishing attacks hunting for Verified by Visa passwords are among the reasons some punters are wary of the technology.<\/p>\n

    Once obtained by fraudsters, either by direct phishing attack or through other more subtle forms of social engineering trickery, VbyV login credentials make it easier for crooks to make purchases online while simultaneously making it harder for consumers to deny responsibility for a fraudulent transaction…<\/p>\n

    The little-publicised mandatory use of the technology by some banks means that those with reservations have an uphill struggle to opt out of the scheme…<\/p>\n

    Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that.<\/p>\n

    [More here<\/a>}.<\/p>\n

    \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

    Does an Internet purchase turn you into a “punter”?<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[63,62,13,2,7],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1017"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1017"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/1017\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}