%0 Journal Article %1 noauthororeditor %A Rathour, Shweta %D 2013 %E Kumar, Dr. Shiv %J International Journal of Innovative Science and Modern Engineering (IJISME) %K %N 8 %P 32-34 %T Review of 3-D Secure Protocol %U https://www.ijisme.org/wp-content/uploads/papers/v1i8/H0390071813.pdf %V 1 %X Banks worldwide are starting to authenticate online card transactions using the `3-D Secure' protocol, which is branded as Verified by Visa and MasterCard Secure Code. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards (EMV comes from the initial letters of Euro-pay, MasterCard, VISA) for cardholder-present payments. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating lesson in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. The 3-Domain Secure protocol specification defines an architecture and protocol for verifying cardholder account ownership during a purchase transaction in the remote environment. After initiating the final purchase action, the cardholder is placed into a dialog with his issuing financial institution. The Issuer authenticates the cardholder and sends a confirmation of identity back to the merchant; the merchant completes the transaction.

@article{noauthororeditor, abstract = {Banks worldwide are starting to authenticate online card transactions using the `3-D Secure' protocol, which is branded as Verified by Visa and MasterCard Secure Code. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards (EMV comes from the initial letters of Euro-pay, MasterCard, VISA) for cardholder-present payments. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating lesson in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. The 3-Domain Secure protocol specification defines an architecture and protocol for verifying cardholder account ownership during a purchase transaction in the remote environment. After initiating the final purchase action, the cardholder is placed into a dialog with his issuing financial institution. The Issuer authenticates the cardholder and sends a confirmation of identity back to the merchant; the merchant completes the transaction.}, added-at = {2021-09-23T11:05:40.000+0200}, author = {Rathour, Shweta}, biburl = {https://www.bibsonomy.org/bibtex/261e7764f1e331210544d80d292149ce0/ijisme_beiesp}, editor = {Kumar, Dr. Shiv}, interhash = {88a89c79504b95d5ae707b77fa1f6224}, intrahash = {61e7764f1e331210544d80d292149ce0}, issn = {2319-6386}, journal = {International Journal of Innovative Science and Modern Engineering (IJISME)}, keywords = {}, language = {En}, month = {July}, number = 8, pages = {32-34}, timestamp = {2021-09-23T11:05:40.000+0200}, title = {Review of 3-D Secure Protocol }, url = {https://www.ijisme.org/wp-content/uploads/papers/v1i8/H0390071813.pdf}, volume = 1, year = 2013 }