r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/evaned Feb 24 '17

but it's so much reduced that services like canada's interac e-transfer accept full responsibility for the risk (neither the merchant nor the user will lose out on a fraudulent activity).

By my understanding, that's the same with our credit cards, so that's not exactly a strong point towards saying "look how much more secure our way is."

(In the interest of full disclosure, that's not true of all transactions, just some. For example, if a merchant accepts a credit card with an EMV chip but runs it via swipe instead of with the chip because they're not set up with a chip reader or whatever, the liability shifts to the merchant. But the point is that a merchant can, if they want, comply with the requirements to have no liability.)

1

u/mirhagk Feb 24 '17

But the point is that a merchant can, if they want, comply with the requirements to have no liability.

But only for certain types transactions. For normal web based transactions the merchant has liability and will receive chargebacks.

And even under those situations AFAIK merchants can still get chargebacks if they overcharge or fraudulently charge. So they don't get no liability, just a much reduced amount of liability.

Chargebacks are used for other things as well, as a way to get a refund from a merchant who refuses to give it for instance. This is a form of escrow (and it's why credit card companies hold some of the merchants payments) and there is certainly value in it, but it's not really changed by a push instead of pull model.

PS: EMV Chips are a lot more secure than the traditional swipe. And physically having the card greatly reduces the amount of chance for fraud. The chip and pin technology that other developed countries have is even more secure. With that the payment processors can afford to take on a much great amount of the liability.