SET discused in Risks Forum

Robert Hettinga rah at
Tue Aug 19 20:46:45 PDT 1997

--- begin forwarded text

Date: Tue, 19 Aug 1997 15:42:21 -0400
From: pj ponder <ponder at>
Subject: SET discused in Risks Forum
To: set-discuss at lists.Commerce.Net
Mime-Version: 1.0
Sender: set-discuss-owner at
Precedence: bulk

This message was addressed to:  set-discuss at


Just got this on the Risks Forum
(usenet comp.risks; html:
I apologize if this has been posted here already and I missed it.

- -----------------------  from comp.risks:  -------------------------------
Date: Sat, 16 Aug 1997 16:20:14 -0700
From: smartcard at
Subject: SET risk

The Secure Electronic Transaction (SET) process is proposed by the
credit-card associations to secure credit-card usage on the Internet.  It
consists of a 28-step process using a standard digital certificate.  It
relies on vendor software to provide security.  These include an
electronic wallet program in the originator's PC, merchant review software
at the merchant's bank, card transaction processing software at the card
issuer bank and merchant software in the merchant's server.

The SET process claims to be better than using a credit card on the
Internet.  However, the SET process has three serious exposures - confirmed
with IBM and HP/Verifone. The process does NOT know who is presenting the
certificate.  The process does NOT know if merchant employees have
redirected the certificate through another merchant.  All of the critical
software is directly accessible by the card users, merchant employees and
bank employees.  Historically, these individuals have been the prime source
of fraud in credit card transaction systems.

There are more than 50 other card security products available for Internet
usage. They are generally simplier, faster, and avoid the SET exposures
identified above.  Internet transaction users might try the viable

jerome svigals, smartcard at

Version: PGP for Personal Privacy 5.0
Charset: noconv


This message was sent by a majordomo-based automatic list manager.
Subscriptions to and archives of this list are available to any person
or organization.  For further information send a mail message to
'set-discuss-request at' with 'help' (no quotations)
contained in the body of your message.

--- end forwarded text

Robert Hettinga (rah at, Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page:

More information about the cypherpunks-legacy mailing list