02 February 2010
3D Insecure
Taking payments online? Were you strongly encouraged to implement a 3D Secure system like Verified by VISA or MasterCard SecureCode?
![Partial image from the title sheet of the paper with the words 'Verified by Visa and MasterCard SecureCode: or, How Not to Design Authentication [by] Steven J. Murdoch and Ross Anderson [at] Computer Laboratory, University of Cambridge, UK http://www.cl.cam.ac.uk/users/fsjm217,rja14g'](/posts/2010/3d-secure-1.png)
A new paper from University of Cambridge Computing Laboratory describes how how online card security fails. It identifies a number of security weaknesses in 3D Secure and proposes that the economics of security have driven insecure implementations (like this), that are difficult to use, in order to move the risk to cardholders.
Ross Anderson's blog post links to comments about the paper elsewhere.
Posted on: 02 February 2010 at 08:07 hrs
Comments are filtered automatically and should appear shortly after they been checked.