--- begin forwarded text Date: Tue, 19 Aug 1997 15:42:21 -0400 From: pj ponder <ponder@mail.irm.state.fl.us> Subject: SET discused in Risks Forum To: set-discuss@lists.Commerce.Net Mime-Version: 1.0 Sender: set-discuss-owner@mail.irm.state.fl.us Precedence: bulk +----------------------------------------------------------------------+ This message was addressed to: set-discuss@lists.commerce.net +----------------------------------------------------------------------+ -----BEGIN PGP SIGNED MESSAGE----- Just got this on the Risks Forum (usenet comp.risks; html: http://catless.ncl.ac.uk/Risks) I apologize if this has been posted here already and I missed it. - ----------------------- from comp.risks: ------------------------------- Date: Sat, 16 Aug 1997 16:20:14 -0700 From: smartcard@sprynet.com Subject: SET risk The Secure Electronic Transaction (SET) process is proposed by the credit-card associations to secure credit-card usage on the Internet. It consists of a 28-step process using a standard digital certificate. It relies on vendor software to provide security. These include an electronic wallet program in the originator's PC, merchant review software at the merchant's bank, card transaction processing software at the card issuer bank and merchant software in the merchant's server. The SET process claims to be better than using a credit card on the Internet. However, the SET process has three serious exposures - confirmed with IBM and HP/Verifone. The process does NOT know who is presenting the certificate. The process does NOT know if merchant employees have redirected the certificate through another merchant. All of the critical software is directly accessible by the card users, merchant employees and bank employees. Historically, these individuals have been the prime source of fraud in credit card transaction systems. There are more than 50 other card security products available for Internet usage. They are generally simplier, faster, and avoid the SET exposures identified above. Internet transaction users might try the viable alternatives. jerome svigals, smartcard@sprynet.com -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM/n5lF4ZsVsZPDGdAQFdwgQAu8IZGp153xgyJs5km/ah7KYtMmwT8k4d Pqo1I5qV532thAIjL8y5uGwxraTTQjxOcWTwvP7Y+Z+wh1467nAElYY1t4VPEB1m K0nZ/3r7kDelj5Jp6H2fTPdBdHWrEj5m/XrTmhVYb0dkQSxW1gFN39y+7AGeBQsO ctgUfEJY2tU= =188u -----END PGP SIGNATURE----- ------------------------------------------------------------------------- This message was sent by a majordomo-based automatic list manager. Subscriptions to and archives of this list are available to any person or organization. For further information send a mail message to 'set-discuss-request@lists.commerce.net' with 'help' (no quotations) contained in the body of your message. --- end forwarded text ----------------- Robert Hettinga (rah@shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/