Hacker News Reader

Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada.

It's nearly impossible for normal users to verify that they're sending their password to their bank, and not to the merchant.

Training users to send merchants sensitive bank passwords is a step backwards.

View on HN

True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre

I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.

Reply on news.ycombinator.com