[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SET discused in Risks Forum



--- begin forwarded text


Date: Tue, 19 Aug 1997 15:42:21 -0400
From: pj ponder <[email protected]>
Subject: SET discused in Risks Forum
To: [email protected]
Mime-Version: 1.0
Sender: [email protected]
Precedence: bulk

+----------------------------------------------------------------------+
This message was addressed to:  [email protected]
+----------------------------------------------------------------------+

-----BEGIN PGP SIGNED MESSAGE-----


Just got this on the Risks Forum
(usenet comp.risks; html: http://catless.ncl.ac.uk/Risks)
I apologize if this has been posted here already and I missed it.

- -----------------------  from comp.risks:  -------------------------------
Date: Sat, 16 Aug 1997 16:20:14 -0700
From: [email protected]
Subject: SET risk

The Secure Electronic Transaction (SET) process is proposed by the
credit-card associations to secure credit-card usage on the Internet.  It
consists of a 28-step process using a standard digital certificate.  It
relies on vendor software to provide security.  These include an
electronic wallet program in the originator's PC, merchant review software
at the merchant's bank, card transaction processing software at the card
issuer bank and merchant software in the merchant's server.

The SET process claims to be better than using a credit card on the
Internet.  However, the SET process has three serious exposures - confirmed
with IBM and HP/Verifone. The process does NOT know who is presenting the
certificate.  The process does NOT know if merchant employees have
redirected the certificate through another merchant.  All of the critical
software is directly accessible by the card users, merchant employees and
bank employees.  Historically, these individuals have been the prime source
of fraud in credit card transaction systems.

There are more than 50 other card security products available for Internet
usage. They are generally simplier, faster, and avoid the SET exposures
identified above.  Internet transaction users might try the viable
alternatives.

jerome svigals, [email protected]


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBM/n5lF4ZsVsZPDGdAQFdwgQAu8IZGp153xgyJs5km/ah7KYtMmwT8k4d
Pqo1I5qV532thAIjL8y5uGwxraTTQjxOcWTwvP7Y+Z+wh1467nAElYY1t4VPEB1m
K0nZ/3r7kDelj5Jp6H2fTPdBdHWrEj5m/XrTmhVYb0dkQSxW1gFN39y+7AGeBQsO
ctgUfEJY2tU=
=188u
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This message was sent by a majordomo-based automatic list manager.
Subscriptions to and archives of this list are available to any person
or organization.  For further information send a mail message to
'[email protected]' with 'help' (no quotations)
contained in the body of your message.

--- end forwarded text



-----------------
Robert Hettinga ([email protected]), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/