Electronic commerce: who carries the risk of fraud? Ian Brown
Non-repudiation and contracts <ul><li>A non-repudiable contract signature removes risk that signer will later disavow the ...
Overview <ul><li>The trouble with non-repudiation </li></ul><ul><li>Legal consequences </li></ul><ul><li>Where should frau...
Vulnerable private keys <ul><li>Key files not adequately protected - no access control in consumer Windows; access by back...
Key viruses <ul><li>Signed code no panacea </li></ul><ul><li>Peter Gutmann’s ActiveX key-stealing virus (Where do your enc...
What about private key tokens? <ul><li>If even you can’t access your private key, you  must  have made that signature! </l...
A bigger TCB <ul><li>You need a secure display to show what is being signed… </li></ul><ul><li>and secure input for access...
Is m-commerce the answer? <ul><li>Mobile phones certainly far more secure at the moment… </li></ul><ul><li>but feature cre...
Token attacks <ul><li>Anderson, Kuhn, Kocher and many others have shown existing tokens are  far  from tamper-proof </li><...
Government attacks <ul><li>RIP non-repudiation </li></ul><ul><li>GTAC, forensic hacking </li></ul>
The obvious conclusion <ul><li>Non-repudiation is not a magic bullet for e-commerce </li></ul><ul><li>Unfortunately, few l...
Digital signature laws <ul><li>Governments rushing to pass laws to make their country “the best in the world for e-commerc...
EU Signature Directive (1999/93/EC) <ul><li>“ Advanced electronic signatures” must be “created using means that the signat...
Member states’ implementations <ul><li>UK Electronic Communications Act 2000 section 8 allows legislation to be amended to...
Contract law <ul><li>Contracts may always provide that signatures should be relied upon </li></ul><ul><li>Fine between bus...
Cheques <ul><li>Banks bear entire risk of cheque fraud under s.24 Bills of Exchange Act 1882: “where a signature on a bill...
Cheque guarantee cards <ul><li>Merchants bear some risk in accepting cheques that may be forgeries </li></ul><ul><li>Banks...
Signature verification <ul><li>Reasonably accurate with care (93.5% by professionals in 1997 study) </li></ul><ul><li>But ...
Credit/debit cards <ul><li>Bills of Exchange Act not applicable </li></ul><ul><li>Customers generally responsible for frau...
Card as token <ul><li>Possession of card is major security check: signatures not checked in US, merchant keeps carbon copy...
Remote transactions <ul><li>Effectively use card number, expiry date and owner as shared secret for authentication - no si...
On-line services <ul><li>Makes provision of information services over Internet particularly risky </li></ul><ul><li>SSL/TL...
Big problems for little firms <ul><li>SMEs can most benefit from Internet sales channel, but are least able to afford high...
Personal banking terms <ul><li>Some Internet banking terms and conditions modelled on credit cards: customer liable up to ...
Bad Egg? <ul><li>3.2: “Until you tell us, you will be responsible for any instruction in writing or by telephone or Intern...
Bank insecurity <ul><li>Ironic given Anderson’s demonstrations of the insecurity of many bank systems </li></ul><ul><li>Ev...
Where should the risk fall? <ul><li>Until consumers have truly secure signature devices, should they carry any risk? </li>...
Back to the banks <ul><li>Entire financial industry is based on one function: risk management </li></ul><ul><li>Banks have...
Upcoming SlideShare
Loading in …5
×

E-commerce: who carries the risk of fraud?

1,944 views

Published on

Seminar at Cambridge University Computing Lab

Published in: Technology, Business
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
1,944
On SlideShare
0
From Embeds
0
Number of Embeds
14
Actions
Shares
0
Downloads
22
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide
  • Report at URL? Co-authors, FIPR.
  • E-commerce: who carries the risk of fraud?

    1. 1. Electronic commerce: who carries the risk of fraud? Ian Brown
    2. 2. Non-repudiation and contracts <ul><li>A non-repudiable contract signature removes risk that signer will later disavow the signature </li></ul><ul><li>Obvious benefit in risk reduction for relying party </li></ul><ul><li>“ Non-repudiable digital signature” makes eyes light up </li></ul>
    3. 3. Overview <ul><li>The trouble with non-repudiation </li></ul><ul><li>Legal consequences </li></ul><ul><li>Where should fraud risk belong? </li></ul>
    4. 4. Vulnerable private keys <ul><li>Key files not adequately protected - no access control in consumer Windows; access by backup operators and administrators in almost all other OSes </li></ul><ul><li>Passwords/passphrases, even if chosen properly, vulnerable - no SAS </li></ul><ul><li>Most PCs defenceless against viruses - checkers reactive, user understanding low </li></ul>
    5. 5. Key viruses <ul><li>Signed code no panacea </li></ul><ul><li>Peter Gutmann’s ActiveX key-stealing virus (Where do your encryption keys want to go today?) http://www.cs.auckland.ac.nz/~pgut001/pubs/breakms.txt </li></ul><ul><li>Key export functions should be very restricted </li></ul>
    6. 6. What about private key tokens? <ul><li>If even you can’t access your private key, you must have made that signature! </li></ul><ul><li>But what is your smartcard/iButton signing? </li></ul>
    7. 7. A bigger TCB <ul><li>You need a secure display to show what is being signed… </li></ul><ul><li>and secure input for access control </li></ul>
    8. 8. Is m-commerce the answer? <ul><li>Mobile phones certainly far more secure at the moment… </li></ul><ul><li>but feature creep (WAP is just the beginning!) will inevitably reduce this security </li></ul>
    9. 9. Token attacks <ul><li>Anderson, Kuhn, Kocher and many others have shown existing tokens are far from tamper-proof </li></ul><ul><li>Is best we can hope for tamper-evident? </li></ul><ul><li>Severe problems with zombie signatures </li></ul>
    10. 10. Government attacks <ul><li>RIP non-repudiation </li></ul><ul><li>GTAC, forensic hacking </li></ul>
    11. 11. The obvious conclusion <ul><li>Non-repudiation is not a magic bullet for e-commerce </li></ul><ul><li>Unfortunately, few legislators or banks have yet realised this... </li></ul>
    12. 12. Digital signature laws <ul><li>Governments rushing to pass laws to make their country “the best in the world for e-commerce” </li></ul><ul><li>Some reverse allocation of risk for forgeries - signer is responsible </li></ul>
    13. 13. EU Signature Directive (1999/93/EC) <ul><li>“ Advanced electronic signatures” must be “created using means that the signatory can maintain under his sole control” </li></ul><ul><li>No direct consequences, but misleading that such signatures currently exist </li></ul><ul><li>Member states’ determination of signature security must be recognised EU-wide </li></ul>
    14. 14. Member states’ implementations <ul><li>UK Electronic Communications Act 2000 section 8 allows legislation to be amended to require signer to prove forgeries </li></ul><ul><li>Ireland’s Electronic Commerce Bill: “The contents of an electronic communication shall be presumed to be that of the person or public body by whom it purports to have been sent, unless… the contrary is proved.” </li></ul>
    15. 15. Contract law <ul><li>Contracts may always provide that signatures should be relied upon </li></ul><ul><li>Fine between businesses with appropriate legal and technical resources </li></ul><ul><li>Not for general consumers </li></ul>
    16. 16. Cheques <ul><li>Banks bear entire risk of cheque fraud under s.24 Bills of Exchange Act 1882: “where a signature on a bill is forged… the forged … signature is wholly inoperative” </li></ul><ul><li>Banks decide level of signature verification necessary </li></ul><ul><li>Cannot be changed by contract in Britain </li></ul>
    17. 17. Cheque guarantee cards <ul><li>Merchants bear some risk in accepting cheques that may be forgeries </li></ul><ul><li>Banks introduced cheque guarantee cards to delegate signature verification for small amounts to merchant </li></ul>
    18. 18. Signature verification <ul><li>Reasonably accurate with care (93.5% by professionals in 1997 study) </li></ul><ul><li>But banks balance cost of fraud against that of verification: risk management is a major part of their business </li></ul>
    19. 19. Credit/debit cards <ul><li>Bills of Exchange Act not applicable </li></ul><ul><li>Customers generally responsible for fraudulent transactions up to £50 before loss is reported: banks carry remainder </li></ul><ul><li>Provides customer incentive to look after cards and report loss </li></ul>
    20. 20. Card as token <ul><li>Possession of card is major security check: signatures not checked in US, merchant keeps carbon copy of receipt in UK </li></ul><ul><li>Risk allocation very different for “cardholder not present” transactions </li></ul>
    21. 21. Remote transactions <ul><li>Effectively use card number, expiry date and owner as shared secret for authentication - no signature </li></ul><ul><li>Address can be checked for physical goods delivery </li></ul><ul><li>Merchants bear entire risk without voucher or proof of delivery </li></ul>
    22. 22. On-line services <ul><li>Makes provision of information services over Internet particularly risky </li></ul><ul><li>SSL/TLS protects information in transit, but provides no card authorisation </li></ul><ul><li>SET is unpopular and still vulnerable to all problems with private key management </li></ul>
    23. 23. Big problems for little firms <ul><li>SMEs can most benefit from Internet sales channel, but are least able to afford high chargebacks </li></ul><ul><li>But some banks are trying to shift risk to consumers </li></ul>
    24. 24. Personal banking terms <ul><li>Some Internet banking terms and conditions modelled on credit cards: customer liable up to £50 for fraudulent transactions (Co-op, Lloyds TSB) </li></ul><ul><li>But others place entire liability on consumer: Prudential Banking, Halifax, Bank of Scotland </li></ul>
    25. 25. Bad Egg? <ul><li>3.2: “Until you tell us, you will be responsible for any instruction in writing or by telephone or Internet which we receive and act on, even if it was not given by you… if we can show you… have not kept your security details and password secret you will be responsible for all payments we make and all losses on your account.” </li></ul><ul><li>3.8: “Our records of your Internet instructions will be conclusive unless there is a clear mistake” </li></ul>
    26. 26. Bank insecurity <ul><li>Ironic given Anderson’s demonstrations of the insecurity of many bank systems </li></ul><ul><li>Even better: almost all banks using symmetric authentication </li></ul><ul><li>How would terms look if “non-repudiable” instructions were possible?! </li></ul>
    27. 27. Where should the risk fall? <ul><li>Until consumers have truly secure signature devices, should they carry any risk? </li></ul><ul><li>Will chargebacks drive SMEs from the Internet? </li></ul><ul><li>IS UK Government doing anything for e-commerce? </li></ul>
    28. 28. Back to the banks <ul><li>Entire financial industry is based on one function: risk management </li></ul><ul><li>Banks have successfully managed current account risk for more than a century </li></ul><ul><li>They need incentives to develop security of online banking and e-commerce </li></ul><ul><li>Online transaction risk is perhaps the best </li></ul>

    ×