Exercise 13: Electronic payments and security I

1. List and describe your experiences with a secure Web site. Some examples may be:

• University enrolment
• online banking, auctions, real estate;
• booking a cheap air ticket or concert ticket;
• shopping online for a book, software or a CD.
  

I always do my banking transactions in an online banking Web site at http://www.hsbc.com.hk. Before doing the banking transactions, I need to log on the site with my user name, password and a instant security code that generated by a security device. The security device is small enough for me to carry to anywhere. The instant security code must be used not longer than 60 seconds. After 60 seconds not used, I must regenerate another security code. After I log on the site, I will redirect into a SSL security Web page to process my banking transactions. If I need to transfer money to other bank accounts that not owned by me, I will be asked to key in a instant security code again. Although Web security are not 100% secure, it is a well secure Web site and make me feel confident in doing my banking transaction.

2. What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?

Secure Electronic Transaction (SET) is a standard protocol for credit card transactions over public networks in secure. SET is a security protocols and formats that let users capable to employ the existing credit card payment, not a payment system (Wikipedia 2009). SET uses hashing algorithm to sign a transaction message with the sender's public key and decrypt by the private key. The authenticity of the transaction can be verified in both merchants and customers with their own digital signatures (Wiley & Sons 1996).

SET purchase involves three parties. They are customer (cardholder), merchant and payment gateway. But now people pays for online purchases by sending their credit card details direct to the merchant . They use Secure Sockets Layer (SSL) protocol to encrypt the card details in the Internet, but it does nothing to protect the merchants or customers for dishonest. Although SSL is less protect for both merchant and customer, SSL is commonly used in the Internet for less cost and more convenient (Wikipedia 2009) compare with SET.

But SET cannot win the market share with the following reasons (Wikipedia 2009):

• Client need to install software (e-wallet)
• Higher cost and more complex in the support of merchants compare with the alternative solution of SSL
• Cost of distribution of client-side certificate
  

Reference

1. Wikipedia (2009), Secure Electronic Transaction, Retrieved at http://en.wikipedia.org/wiki/Secure_electronic_transaction on 24th April, 2009.
2. Wiley, J. and Sons (1996), Secure electronic transactions : an overview, Schneier, Bruce. Applied Cryptography, Retrieved at http://www.davidreilly.com/topics/electronic_commerce/essays/secure_electronic_transactions.html on 24th April, 2009.