Security researchers knock 'Verified by Visa'
Credit-card authentication system teaches online shoppers risky habits because it doesn't display visual markers, such as a color-coded browser bar or "https," researchers say.
The "Verified by Visa" credit-card authentication system has come under criticism from Cambridge University researchers, who say it is training online shoppers to adopt risky security habits.
The feature, which is used to authenticate online financial transactions, confuses people by not displaying security cues, security engineering researchers Ross Anderson and Steven Murdoch said in a paper (PDF) published Tuesday.
The protocol underlying Verified by Visa, as well competitor MasterCard's SecureCode service, is 3-D Secure (3DS). The protocol is implemented as an iframe pop-up box, said Anderson. The pop-up does not display any commonly used markers, such as a color-coded browser bar or "https" in the URL, that demonstrate the box has been secured using the Transport Layer Security protocol. Because of this, online buyers have no visual verification that the box is a valid part of the credit-card transaction.
Read more of "Cambridge researchers knock Verified by Visa" at ZDNet UK.