3

I was trying to pay for mobile phone credit online from a service provider. I selected the amount to pay and clicked next to continues. The following page asked me to turn on third party cookies if I wanted to proceed. I thought that this wasn't acceptable so I didn't go through with the purchase. Is it normal for a payment procedure to be exposed to third party cookies or am I being paranoid?

  • 2
    Yes, it is normal. Yes, you're being paranoid. – Adi Feb 18 '14 at 11:35
1

A common reason for having third-party cookies on payment pages is analytics. Payment events are usually the most important ones to track because they are the actual measure of success and most analytics is done with third-party cookies.

Other reasons can be CDNs and third-party payment providers.

It would seem unlikely for an active attack to use third-party cookies at all, let alone interrupt the process to request that you switch them on. An attacker would find a different way to exfiltrate the sensitive data without drawing attention to the attack.

0

Amazon Payments requires third-party cookies to work. I encountered this while buying something from Lenovo. If you're expecting a third-party payment provider to be in the loop, then add an exception to allow their cookies for the site you're on.

I'd suspect the reason for this is to embed the payment processor nicely on the merchant's site, instead of doing all that ugly redirect or hosted page stuff.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.