Web Worker Daily

Comments (13)

• I think that the piece above raises a good point – simply having “https://” is simply not enough to put my mind at ease about disclosing my personal information to a website. In terms of what I look for in a web application before I sign up for it, a very important factor for me is if there is a brick-and-mortar component to the company. For instance, I feel confident going to my bank’s website to check the balance of my checking account. If there is a problem, I can call the bank to confirm the problem. Another important attribute for an online service to have is press coverage. Not to beat a dead horse in regards to banks, but if an online banking company has had press coverage, then to me, that means that there has been some investigation of that site, and that any difficulties or suspicious aspects or activities would have been reported. It is after that, that I can do my own investigation of the site.

  Andrew — 11:19 AM on January 25, 2007 Reply

• can we really trust online banking?
  i think we should..but its difficult really…

  http://www.diyanazman.com

  azman — 2:59 AM on January 26, 2007 Reply

• I wouldn’t be so quick to distrust a site that uses PayPal as its online payment component. For many smaller (or newer) online businesses, it’s an excellent way to handle the security issue and actually ensure the safety of one’s financial information. Our business currently uses PayPal exclusively for our subscription service to our website because they’re set up to handle recurrent payments and we don’t have access to any of our members’ financial information. In many ways, it’s like OpenID in that you set up once and can use that information in the places that are set up to accept it.

  Amie Gillingham — 9:25 AM on January 26, 2007 Reply

• Amie, I wasn’t discounting the site on the fact that payment was through PayPal alone. Like you said, there are a lot of advantages to it. I was looking at their payment method in combination with all the other factors…private domain registration, no information about the company, etc. to form an overall opinion about the level of trust. If they provided a contact address or talked about the technology they used and they happened to use PayPal, I wouldn’t have any complaint.

  Judi Sohn — 1:42 PM on January 26, 2007 Reply

• Just playing devil’s advocate here, but whats wrong with just using a fake name? If the site isn’t trying to validate any of the information (which it shouldn’t be), just call yourself “Judi Smith.”

  boredandblogging — 3:19 PM on January 26, 2007 Reply

• @Judi

  Yes, I agree, that in combination would make me a little leary as well.

  Amie Gillingham — 5:32 PM on January 26, 2007 Reply

• Hi,

  I’m Jason Knight the CEO of Wesabe, and we seem to be in the same space as the company that Judi writes about. At the risk of plugging our service here is how we handle trust and personal information: You can call me 800.511.8544 (12-4pm PST seven days a week) if you have any queastions about our privacy or security policies (or anything else you want to talk about). You can also email me jason@wesabe.com. All of our support email is handled by the developer who writes the code, and our goal is to be as close as possible to our users.

  We must earn trust every day, but we are succeeding…we know it because our users tell us so.

  jason knight — 9:11 PM on January 26, 2007 Reply

• The issue has nothing to do with web security but in the way personal financial information is handled. Your Aunt does not use online banking or shop online because she is worried about data privacy but she most likely gladly hands over her credit or debit card to a waiter or gas attendant who walks away to authorize a purchase.

  As long as your financial data is available on a database in some networked environment it is potentially as risk.

  An exercpt from this article here:

  6.1.5 Financial security

  Consumers also have legitimate concerns about using their credit/debit cards to make on-line payments – especially internationally.

  There have been some spectacular cases of ‘hacking’ of credit card numbers from on-line banks and other companies (most of which are kept out of the public eye). Mike Webb (one of the authors of this report) himself experienced fraudulent use of his credit card as a result of making legitimate on-line transactions in 1999.

  Although standards have improved, security experts such as Bruce Schneir[4] have identified the fundamental insecurity of computer-based systems, ensuring that hackers and others will continue to exploit security weaknesses on computer systems used by both businesses and consumers.

  Schneir identifies a number of generic problems in trying to achieve 100% security using computer-based systems:

  · Increasingly complex operating systems will inevitably include exploitable weaknesses unforeseen by software designers[5]

  · It only takes one person to discover a security hole or weakness, and the information can be published globally (via secret hacking sites) to thousands of other hackers in a matter of minutes

  · Security should be considered a process, not a product. It is only as secure as the weakest link, which is almost always people.[6] For example, as has often been reported, most users choose insecure passwords. ‘Cracking’ software can recover 20 per cent of all passwords in a few minutes, and 90 per cent of all passwords in less than a day.[7]

  In addition, it should be noted that even in the West, where companies have several years’ experience operating networked systems, many companies have lax security policies. According to figures from the UK Department of Trade and Industry (DTI), about 33 per cent of UK businesses still do not have a firewall between their websites and their internal computer systems, leaving them vulnerable to hackers. And 66 per cent do not have intrusion detection systems, which could detect hackers if they penetrated other defences.[8]

  However security experts also acknowledge that on-line financial transactions, such as the use of credit/debit cards, while never 100% secure, are likely in general to be more secure than off-line transactions.

  Island in the Net — 8:20 AM on January 27, 2007 Reply

• In our society, people trust a website, an individual or an organization because they know that other people trust that website, individual or organization. Pagerank seems to be a good indicator of trustworthiness and I use that a lot. A longer green bar on my google toolbar means (to me) means that a lot of other important websites vouch that the particular website I’m visiting is trustworthy.

  sc — 9:39 AM on January 27, 2007 Reply

• I think trust will be a bigger issue in 2007 than previously, because so many of the social media services are being “gamed” by less salubrious people far more

  alan p — 2:55 PM on January 27, 2007 Reply

• Excellent post, and relevant to me given my Paypal account was hacked into and I had a bunch of money extracted. Fortunately, the fine folks at Paypal are going to get my account back to normal.

  Mark Evans — 6:29 PM on January 27, 2007 Reply

• Can someone explain to me the inherent security risk posed by doing business with a site that uses paypal for processing their credit card transactions? How is that different than using any other mechant processor? At least they were upfront about it.

  We use Paypal’s Virtual Terminal, so that might be a bit different, but I still don’t get what the issue is here. But, I’d really like to know because we will change processors if I learn something I don’t like.

  Paul Freet — 7:06 AM on January 28, 2007 Reply

• Paul, there’s nothing wrong with PayPal. Let me explain my thinking here, as I said it’s an “instinctual” thing with me. PayPal is easy. Anyone at any time can set up a PayPal account and start taking money with an email address. In combination with no information about the company and hidden domain registration it screams “fly-by-night” to me.

  So if a company, let’s use BigContacts as an example, has an “About” page that includes information about the developers (right down to a phone number!) and a “Systems & Security” page that explains how the data is protected, I won’t notice or care that you take PayPal for payment. When I’m looking at whether or not I trust a website and I see no other reason to trust, I’ll look to see how they take their money…do they at least have enough of a business to get a merchant account?

  I hope that helps, and I apologize if I made anyone nervous about their own sites.

  Judi Sohn — 12:00 PM on January 28, 2007 Reply