Security researchers knock 'Verified by Visa'

Credit-card authentication system teaches online shoppers risky habits because it doesn't display visual markers, such as a color-coded browser bar or "https," researchers say.

The "Verified by Visa" credit-card authentication system has come under criticism from Cambridge University researchers, who say it is training online shoppers to adopt risky security habits.

The feature, which is used to authenticate online financial transactions, confuses people by not displaying security cues, security engineering researchers Ross Anderson and Steven Murdoch said in a paper (PDF) published Tuesday.

The protocol underlying Verified by Visa, as well competitor MasterCard's SecureCode service, is 3-D Secure (3DS). The protocol is implemented as an iframe pop-up box, said Anderson. The pop-up does not display any commonly used markers, such as a color-coded browser bar or "https" in the URL, that demonstrate the box has been secured using the Transport Layer Security protocol. Because of this, online buyers have no visual verification that the box is a valid part of the credit-card transaction.

Read more of "Cambridge researchers knock Verified by Visa" at ZDNet UK.

Featured Video

Why do so many of us still buy cars with off-road abilities?

Cities are full of cars like the Subaru XV that can drive off-road but will never see any challenging terrain. What drives us to buy cars with these abilities when we don't really need them most of the time?

by Drew Stearne