1&nb= sp; Background

I’m a security architect by profession. As part of my career history, I wo= rked for the first online payment gateway company, CyberCash, and in that compan= y we were aware of all existing threats against online commerce and a bunch that haven’t materialized yet.

In the course of this experience, I devised a few observations and rules for myself and my friends about online shopping.

2&nb= sp; Cryptography doesn’t protect you onlin= e

Cryptography is wonderful stuff. That’s what you’re usi= ng when you see the little closed padlock icon in the margin of your browser window.

I got into computer security through a passion for cryptography and I’m still passionate. When you have a chance to use cryptography, do it.

However, just seeing this padlock does not mean you are safe.

What this padlock means is that the information you pr= ovide (like a credit card number) can not be eavesdropped between your computer a= nd the server offering the web page. So, in the common shopping situation, you might define safety as mak= ing sure your credit card number isn’t misused by someone.

The cryptography here stops someone between your machi= ne and the web page server from seeing your credit card number, but:

Many attacks today (called phishing) induce you to go t= o the wrong web server where you see a carbon copy of the correct web page.<= span style=3D'mso-spacerun:yes'> So, to all appearances, you w= ent to the right page – but it’s on the wrong machine. It’s= on a machine under the control of the attacker.
Your credit card number will probably be held in a database on = that server. Many attackers l= ooking for credit card numbers break into web servers and just download the w= hole database. As Willie Sutt= on said, he robbed banks because that’s where the money is. Attackers rob server databases because that’s where thousands of credit card numbers are stored= .
Remember Choicepoint? http://www.epic.org/= privacy/choicepoint/
Spyware is a h= uge threat. If your computer= has spyware – or, worse, the kind of infection called a bot – then that attack software can wait for you to type a credit card number and then send t= hat number back to a server run by the attacker, where it is put into the attacker’s database. You can and should protect your computer with security measures. See http://suppor= t.microsoft.com/?pr=3Dsecurityhome for guidance along those lines.

3&nb= sp; Credit Cards

So, with all that gloom and doom, why do I shop online= ?

I shop because the credit card companies protect me. They have to. When I hand my credit card to a wa= iter at a restaurant and he takes it into a back room, he could easily be making= a copy to sell to some attacker. This doesn’t require online shopping to enable the attack. This attack has been possible for decades – long before computer shopping was invented – and the credit card companies have addressed it very well, at least from the consumer’s point of view.

By national regulation in the US, when you use a credit car= d and the number is stolen and misused by some attacker, you are liable for only = the first $50.00 of charges the attacker ran up. In my experience, though, no credi= t card company has ever charged me that $50. Rather, they took any false charge on my statement and put the liabi= lity for the full charge back onto the merchant.

From a security geek’s point of view, the way th= ey protect me is with a two part protocol. The first part is handing over your card to the waiter, reading it over the phone to an telephone salesperson, writing it on a mail-in form or entering it on a web page. Those are all equivalent. This part has enough security to g= et the merchant to send you the thing you bought, but you aren’t out any mon= ey yet.

The second part of the protocol is when you get the statement from the credit card company.&nb= sp; It’s your job, now, to read over that statement and make sure = that every line item is something you actually did buy. If you find something you didnR= 17;t buy, you call the credit card company and reject the charge. That starts an investigative proce= ss and might result in reversal of charges. For the line items that you agree you bought, you then write a check= to the credit card company and mail it. This completes the second part of the protocol.

Because those two parts occur at different times and u= se information delivered by independent channels (the second part delivered by= the post office), it is very difficult for the attacker to intercept both parts= and subvert the whole protocol. B= ecause it ends with your writing a check, that piece of the process has its own security and that’s probably enough to block the attacker. That is, if the attacker could for= ge your checks, then that’s the most direct attack and there’s no reason to engage a credit card purchase.

4&nb= sp; Debit Cards

Most debit cards look just like credit cards and they = act almost the same. There is a regulation limiting your liability in cases where the debit card number is stolen.

However, there is a major difference. When you buy with a debit card, the money comes out of your checking account immediately. There is no check-writing process.= When you get your statement, it sh= ows things already done.

So, if there is a charge you didn’t make on the statement, you can’t just refuse to include that in the check you wri= te. There is no check you write. Instead, you have to open a procedure with the bank to try to get reimbursed for this charge.

I have never tried that procedure, but I assume that u= ntil this is resolved, your account does not have the contested money in it. In that case, if the attacker drai= ned your account dry, you are doing all this process to get reimbursed while be= ing broke.

For this reason, even though the law protects me, I refuse to carry a debit card. I consider them too dangerous. I would certainly never use one for mail order, telephone order or w= eb shopping and strongly recommend that my friends not use them.

5&nb= sp; Electronic Funds Transfers (EFT)

This is what I use to have my paycheck automatically deposited. It is what some merchants want me to use to pay for goods.

I absolutely refuse to pay for anything by electronic (direct) funds transfer!

As far as I know, there is no regulation limiting my l= oss if someone uses EFT to drain my bank account.= No one is responsible for reimbursing me. This makes EFT very desirable for a merchant. Once you have money= by EFT, you can count on it. It won’t be later challenged, as a credit c= ard payment can be. It won’= t be later withdrawn. But that same quality that makes this desirable for a merchant makes it completely unacceptable to me as the consumer. With EFT I am totally at the mercy of the merchant. Worse, I don’t know of any safeguards of my EFT information that would prevent an attacker from tapping into my account and draining it (in one transaction or in a series of transactions). Such safeguards might exist. If so, please se= nd them to cme@acm.org and I will modify th= is page.

6&nb= sp; My rules for online shopping

Never pay for anything by EF= T.
It saves money for the merchant.
It saves time for me.
I can do it from anywhere.
I don’t have to burn gasoline to do it.