SET discused in Risks Forum

Robert Hettinga rah at shipwright.com
Tue Aug 19 20:46:45 PDT 1997




--- begin forwarded text


Date: Tue, 19 Aug 1997 15:42:21 -0400
From: pj ponder <ponder at mail.irm.state.fl.us>
Subject: SET discused in Risks Forum
To: set-discuss at lists.Commerce.Net
Mime-Version: 1.0
Sender: set-discuss-owner at mail.irm.state.fl.us
Precedence: bulk

+----------------------------------------------------------------------+
This message was addressed to:  set-discuss at lists.commerce.net
+----------------------------------------------------------------------+

-----BEGIN PGP SIGNED MESSAGE-----


Just got this on the Risks Forum
(usenet comp.risks; html: http://catless.ncl.ac.uk/Risks)
I apologize if this has been posted here already and I missed it.

- -----------------------  from comp.risks:  -------------------------------
Date: Sat, 16 Aug 1997 16:20:14 -0700
From: smartcard at sprynet.com
Subject: SET risk

The Secure Electronic Transaction (SET) process is proposed by the
credit-card associations to secure credit-card usage on the Internet.  It
consists of a 28-step process using a standard digital certificate.  It
relies on vendor software to provide security.  These include an
electronic wallet program in the originator's PC, merchant review software
at the merchant's bank, card transaction processing software at the card
issuer bank and merchant software in the merchant's server.

The SET process claims to be better than using a credit card on the
Internet.  However, the SET process has three serious exposures - confirmed
with IBM and HP/Verifone. The process does NOT know who is presenting the
certificate.  The process does NOT know if merchant employees have
redirected the certificate through another merchant.  All of the critical
software is directly accessible by the card users, merchant employees and
bank employees.  Historically, these individuals have been the prime source
of fraud in credit card transaction systems.

There are more than 50 other card security products available for Internet
usage. They are generally simplier, faster, and avoid the SET exposures
identified above.  Internet transaction users might try the viable
alternatives.

jerome svigals, smartcard at sprynet.com


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBM/n5lF4ZsVsZPDGdAQFdwgQAu8IZGp153xgyJs5km/ah7KYtMmwT8k4d
Pqo1I5qV532thAIjL8y5uGwxraTTQjxOcWTwvP7Y+Z+wh1467nAElYY1t4VPEB1m
K0nZ/3r7kDelj5Jp6H2fTPdBdHWrEj5m/XrTmhVYb0dkQSxW1gFN39y+7AGeBQsO
ctgUfEJY2tU=
=188u
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This message was sent by a majordomo-based automatic list manager.
Subscriptions to and archives of this list are available to any person
or organization.  For further information send a mail message to
'set-discuss-request at lists.commerce.net' with 'help' (no quotations)
contained in the body of your message.

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/








More information about the cypherpunks-legacy mailing list