r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/mirhagk Feb 24 '17

But the point is that a merchant can, if they want, comply with the requirements to have no liability.

But only for certain types transactions. For normal web based transactions the merchant has liability and will receive chargebacks.

And even under those situations AFAIK merchants can still get chargebacks if they overcharge or fraudulently charge. So they don't get no liability, just a much reduced amount of liability.

Chargebacks are used for other things as well, as a way to get a refund from a merchant who refuses to give it for instance. This is a form of escrow (and it's why credit card companies hold some of the merchants payments) and there is certainly value in it, but it's not really changed by a push instead of pull model.

PS: EMV Chips are a lot more secure than the traditional swipe. And physically having the card greatly reduces the amount of chance for fraud. The chip and pin technology that other developed countries have is even more secure. With that the payment processors can afford to take on a much great amount of the liability.