Misc AADS & X9.59 Discussions

> there is even simpler "misappropriation" ... that of virus on the machine
> ... how do you really know what your computer is doing.

> with paper signatures .... it is somewhat more clear-cut that the person
> signing a document ... is actually looking at the document they are
> signing. With digital signatures it becomes murkier ... how does somebody

> know that what they are looking at is the same thing that the computer is
> calculating a digital signature for.

>
> That said, the Treasury Dept. working with the Financial Service
> Technology Consortium (FSTC) developed and piloted what we call an
> "echeck" which was in fact an electronic check -- not an ACH --
> governed by check law but always digital and sent over the
> internet. Echecks were used to pay a small number of defense
> contractors.

I was curious if anyone knew of any "Payment Processing" schools or
seminars dedicated to learning the detailed in's/out's of credit card
and ACH electronic processing.

I am not interested in Payment Processing software, but training on
banking industry payment processing processes.

Thanks,
Richard

On Mon, 17 Sep 2001 11:50:13   Hadmut Danisch wrote:
>
>Depends on which kind of logic you apply.
>
>Technical logic: Yes, you're right.
>
>Policital logic: No, you're wrong.
>
>The reason is, that air planes, phones, hotels, cars, etc.
>are used by common people - those who elect politicians -
>and therefore can't be bad by definition. Policital logic:
>What is used by most people who elected me, can't be wrong.
>Which politician would dare to ban hotels?
>
>In contrast to that, cryptography isn't commonly used or
>understood. From a public point of view, cryptography is
>something exotic, used by spys and secret agents, hackers,
>terrorists, who need to keep their business secret. And even
>worse: It's new (at least its civil use with internet). All
>other things exist for decades and have become part of
>normal life. Cryptography doesn't.

• physical security for the data processing room, motion detecters, guards, etc
• multiple layers of firewalls & packet filtering routers
• actual financial transactions performed on backroom dataprocessing equipment away from the actual web server
• fbi background checks for all employees
• security audits
• minimum business & security certification levels.

> The problems, of course are 1) account numbers are essentially
> shared-secrets, 2) SSL only provides for protection for numbers in flight, 3) the
> numbers at rest remain a major exploit (as per press stories regarding
> copying of account number master files at web servers) ... aka the use of
> SSL/ecryption only addressed a small portion of the problem. The web server
> account number master file also typicall represents a risk that is
> significantly greater than what typical merchant otherwise has at risk ...
> making it difficult to support a solution where the level of
> security/protection is proportional to the risk

>
> there are all sorts of shortcomings in this world. you find a "merchant"
> that buys a computer, installs some webserver software and puts it up and
> the web and expects that to handle everything.

> The web server
> account number master file also typicall represents a risk that is
> significantly greater than what typical merchant otherwise has at risk
...
> making it difficult to support a solution where the level of
> security/protection is proportional to the risk

>
> Actually, I believe it's by the merchants.  Internet transactions
> generally count as "card not present" transactions, which means that
> the merchants take the risk.

1) in a typical credit card transaction, the seller neither knows, nor cares, what bank issued the credit card. Thus, connecting to the correct gateway becomes a minor problem.

2) No provision for dispute resolution. What happens in a month and a half when george gets his credit card bill back and says "I've never been there and never done any business with this person"? The bank generates a chargeback and sends it to the merchant who, in the absence of knowledge about the buyer's identity, has no recourse. George may or may not be the person who made the transaction; but the merchant has no way to even begin to try to find out.

In general, "anonymity" and "credit" are immiscible. If you want anonymous transactions, you absolutely cannot abide by the laws that require chargebacks, merchant and/or bank liability in case of fraud (instead of consumer liability), etc. Compliance with those laws requires the merchant and banks to have the very information that anonymity prohibits them from having.

For anonymous transactions, you want something a whole lot more like cash, with the same failure modes (ie, no shift of liability in case of fraud) as cash. That requires infrastructure which will not be allowed to be built.

[FYI] Did Encryption Empower These Terrorists?

From: Lynn Wheeler
Date: 09/27/2001 07:24 AM
To: "Enzo Michelangeli" <em@xxxxxxxx>
cc: "Ray Dillinger" <bear@xxxxxxxx>, "Ben Laurie" <ben@xxxxxxxx>,
     cryptography@xxxxxxxx, "Hadmut Danisch" <hadmut@xxxxxxxx>
Subject: Re: [FYI] Did Encryption Empower These Terrorists?

[FYI] Did Encryption Empower These Terrorists? (addenda to chargebacks)

From: Lynn Wheeler
Date: 09/27/2001 01:04 PM
To: "Enzo Michelangeli" <em@xxxxxxxx>
cc: "Ray Dillinger" <bear@xxxxxxxx>, "Ben Laurie" <ben@xxxxxxxx>,
    cryptography@xxxxxxxx, "Hadmut Danisch" <hadmut@xxxxxxxx>,
jim_windle@xxxxxxxx
Subject: Re: [FYI] Did Encryption Empower These Terrorists? (addenda to chargebacks)

The end of P-Cards?

From: Lynn Wheeler
Date: 09/30/2001 02:54 PM
To: Anders Rundgren <anders.rundgren@xxxxxxxx>
cc: internet-payments@xxxxxxxx
Subject: Re: The end of P-Cards?

The end of P-Cards? (addenda)

From: Lynn Wheeler
Date: 10/02/2001 07:43 AM
To: Anders Rundgren <anders.rundgren@xxxxxxxx>
cc: internet-payments@xxxxxxxx
Subject: Re: The end of P-Cards? (addenda)

The end of P-Cards? (addenda)

From: Lynn Wheeler
Date: 10/02/2001 08:08 AM
To: internet-payments@xxxxxxxx
Subject: Re: The end of P-Cards? (addenda)

AADS Postings and Posting Index,
next, previous - home