|
Point
taken....
I am
working on a "Real" answer.. This is one of the reasons I have been a little
quieter on the list these days.
It
became clear from our discussions a couple of weeks ago that, at best -- the
'identity' component of the certificate is not as critical to you as the
incumbent market leading Certificate Authorities would have us believe and
at worst, the whole idea of web certificates is an inadequate solution to the
problem they are intended to solve (namely non-repudiation of commercial
transactions).
I was
particularly moved by the observation that it is really the merchant that is
taking the risk of repudiation -- this is true. For credit card transactions the
provider of the payment gateway/merchant account is trusted third party enough
for the purposes of non-repudiation -- leaving the value of a
web-certificate only in the encryption component. Personal identity
that would benefit the merchant is accomplished through personal certificates
and e-commerce merchants have thus-far chosen to accept the risk of not
requiring them and/or verifying identity in off-line methods (only shipping to
the same address as listed on the credit card, phoning the listed phone number
on the credit card etc.).
However, without the identity component the end-user is
not protected against fraudulent collection of information from an imposter (I
have posted an article from today's Wall Street Journal below -- it shows a
situation in which a fraud would have been prevented if users demanded a
properly authenticated certificate -- ultimately that may have been what tipped
the users off in the first place -- spelling errors and healthy
scepticism were noted in the article). This is of greater
concern for some applications than others. The message I clearly received from
our discussion is that you do not feel you need full identity verification for
all applications. Just as long as the browser error message is
avoided.
As
stated before, I am working on a "Real" answer to your concerns. In the
mean-time, for those applications that require full identification we now have
the cheapest solution on the market and you should find the verification process
running smoothly. If you don't you can let me know immediately and we will get
it sorted out. Given some of the troubles in the last month we are on high alert
right now to ensure that verification runs as smoothly and smoother than it did
previously.
Regards
Darryl Green 'Spoofer' Tries Unsuccessfully to Snag
|
Image of "spoof" PayPal site |
According to domain-name registration records at VeriSign Inc., the PayPal-Secure.com address is registered to an entity called PayPalSecure. The record lists a phony phone number and address for the company. PayPal said it could subpoena the account information for the site from DigitalSpace.net, but that information would most likely be faked as well.
"One of the problems with the Net is that it's easy to dummy something up to look like a legitimate entity, and you might have to click through further to ensure that it is the place that you think you are visiting," said Susan Grant, director of the Internet Fraud Watch for the National Consumers League. These types of scams make it harder for legitimate companies to gain users' confidence, she added.
PayPal does warn its customers about fraud and says it is vigilant about protecting its users. The company says its customers are safe because they are reimbursed -- either by PayPal or by their credit-card company, depending on the situation -- for any fraudulent charges to their account.
|
|
The PayPal-Secure scam played on PayPal's earlier viral marketing campaign, which helped to fuel its exponential growth. The company, which launched in October 1999, had 10.6 million accounts as of Sept. 30, 2001, and processes an average of 171,000 payments per day totaling $8.5 million in daily volume, according to the company. During its early days, PayPal would give $10 to any user who signed up a friend, and gave the friend $10, too.
PayPal still provides some bonuses, but the requirements for receiving one have become much stricter. Now, according to the PayPal Web site, customers must verify their account with a credit card, deposit $250 and sign up for a money-market account to receive the new account bonus.
The attack comes at an inopportune time for PayPal, which last week set the range for its proposed initial public offering. The company is already under scrutiny from investors nervous about its exposure to liability from credit-card fraud, in part because PayPal promises to reimburse any customer whose credit card or account is fraudulently used. PayPal is used primarily by users of eBay Inc. and other auctions to process payments for online transactions.
In the past, customers have complained to the Better Business Bureau and Federal Trade Commission about PayPal's fraud protections. Over the last year, however, the company has aggressively worked to combat credit-card fraud at the site. "They have very good fraud protection," said Gartner's Ms. Litan. PayPal's fraud rates are better than average, with about 0.87 % of its sales lost to fraud, according to its SEC filing.
Neither PayPal nor Digital Space said they notified law enforcement authorities after PayPal-Secure.com was taken offline. "We certainly wouldn't bother the FBI about it," said Mr. Solitto, who called the "spoof" category of fraud "not particularly novel or sophisticated."
PayPal said it hasn't received any reports from customers who were actually tricked into entering their personal information. Mr. Cichanowicz, for his part, said he didn't give up any account information, but is still disturbed that he was targeted for fraud. "This is a terrible time for unsuspecting people to be had by this, especially so close to the holidays," he said.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Allen
Sent: Wednesday, December 19, 2001 11:14 AM
To: Matthew Feinberg
Cc: [EMAIL PROTECTED]
Subject: Re: Digital Certificates
That's why I am REALLY considering, and more than likely signing up today. It has been a week with no "Real" answers from OpenSRS. Just a statement saying they are working with EnTrust with a new procedure..Mike Allen, 4CheapDomains.Net
[EMAIL PROTECTED]
http://www.4CheapDomains.Net
(812) 275-8425 - Office
(815) 364-1278 - Fax----- Original Message -----From: Matthew FeinbergSent: Wednesday, December 19, 2001 10:55 AMSubject: RE: Digital CertificatesI have already switched over to Entrust and it it going well.I could no longer spend 5 to 8 hours of time on SSL Cert issue per Cert to only make $25.Entrust, never once delivered a certificate without us chasing them around. 1 customer took 4 weeks to get the Cert... Terrible!Matthew-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Allen
Sent: Tuesday, December 18, 2001 4:06 PM
To: [EMAIL PROTECTED]
Subject: Digital CertificatesHi Guys... About this digital certificate thing and our current problems... If open SRS is going to fix things, it better be fast. GeoTrust just contacted me and they are making us a very sweet offer for re-selling. Chuck, you may even want to re-consider the prices for these certificates and maybe offer also the QuickSSL with a GOOD price...Mike Allen, 4CheapDomains.Net
[EMAIL PROTECTED]
http://www.4CheapDomains.Net
(812) 275-8425 - Office
(815) 364-1278 - Fax
