Saturday, October 16, 2010

Verified by Visa Is Evil

Just spent 30 minutes trying to buy an airline ticket on Delta. In the final stages of the transaction, I got thrown into a "Verified by Visa" screen. It looks, for all the world, like a moderately sophisticated, man-in-the-middle phising attack. I had encountered it a few times before, but not recently, and those times I was able to click past it. This time I couldn't get past it to save my life. So I aborted and purchased through Travelocity. Did I mention that in addition to consuming 30 minutes of my life, all-told, it also delayed my purchase and the price increased by $50?

I got motivated to do some research. This is a very good blog post, and here are some comments from Bruce Schneier. It sounds like: A) A disadvantage to the consumer; B) Almost inconceivably bad security practices. Nice going, Visa, Banks and Merchants.

3 comments:

  1. I haven't encountered this, but would be hesitant to participate.

    Perhaps the simple answer is to use American Express.

    ReplyDelete
  2. I hope your luck continues. I think the idea is kind of good, but in the U.S. at least offers no actual additional protection to the consumer, and perhaps dilutes what is legislated. But the really horrendous part is how it is implemented, which resembles a medium-sophistication phishing attack.

    ReplyDelete
  3. I was sucked into the "Verified by Visa" hell hole once... think I spent 30 minutes getting out of it.....calling the help-line etc. And yep, we switched to the AmEx card.

    ReplyDelete