Hacker News Reader

Really depends on the bank, some of them have a decent 2fa system for 3d secure.

Some of my credit cards redirect to a page hosted by the issuer. Others require me to authorise the transaction in an app on my phone.

Social security numbers?! Who the hell implemented it like THAT?

3D Secure redirects to the bank's site (not in an iframe! a real window with a visible address bar) where you enter a one-time code from SMS!

I have worked with systems implementing 3D Secure and have multiple credit cards that trigger it. I can assure you that the standard deployment for US-based banks and merchants uses iframes and in the majority of cases will ask for enough personal information to steal your identity or drain your bank account.

I assume this is a US problem because in the US card fees are high enough that banks don't need to worry too much about fraud yet. Look at European banks if you want to see reasonable 3D Secure.

Eh. 3D Secure is a protocol which can be implemented in reasonable ways. My bank has a 2FA in there.