Re: SET

At 11:18 AM 11/12/97 -0800, Jeremey Barrett you wrote:
>Robert Hettinga writes:
> > 
> > Unfortunately, I think that no MIS manager will get fired for using
SET, and
> > it'll take a serious demonstration of a security breach before people will
> > listen to anything else. At least until someone demonstrates a transaction
> > protocol which is, say 3 orders of magnitude cheaper...
>
>Perhaps... OTOH, SET is SO bad that it will be impossible to deploy,
>probably forcing everyone away from it anyway.

Having spent the last ten years at this retail outfit, I can assure you
that "impossible to deploy" != "won't be deployed".  If Mastercard tells us
that they will jack our rates by 0.5% for every transaction processed
without SET, then management will demand SET be rolled out.  Function be
damned, security be damned, as long as some bookkeeper somewhere is
satisfied that SET happens, then we avoid a huge rate increase.

If the security of SET is questioned in the trade rags, our management's
approach will be to assume that Mastercard will fix it in the future, but
roll it out now anyway.  OTOH, it's obvious (even to them) that SET
couldn't possibly be any *less* secure than current authorizing techniques.

*Sigh*.  Look for copyrighted swirly red/orange logos to appear on
retailer's doors' soon:  
    "SET(tm) Transaction Processing -- 
     It's safe to use your Mastercard here"

John, who will get dragged into implementing it.  Got any suggestions?
--
J. Deters "Don't think of Windows programs as spaghetti code.  Think
          of them as 'Long sticky pasta objects in OLE sauce'."
+--------------------------------------------------------------------+
| NET:   mailto:jad@dsddhc.com (work)   mailto:jad@pclink.com (home) |
| PSTN:  1 612 375 3116 (work)          1 612 894 8507 (home)        |
| ICBM:  44^58'36"N by 93^16'27"W Elev. ~=290m (work)                |
| For my public key, send mail with the exact subject line of:       |
| Subject: get pgp key                                               |
+--------------------------------------------------------------------+

-----BEGIN PGP SIGNED MESSAGE-----

John Deters writes:
 > At 11:18 AM 11/12/97 -0800, Jeremey Barrett you wrote:
 > >Perhaps... OTOH, SET is SO bad that it will be impossible to deploy,
 > >probably forcing everyone away from it anyway.
 > 
 > Having spent the last ten years at this retail outfit, I can assure you
 > that "impossible to deploy" != "won't be deployed".  If Mastercard tells us
 > that they will jack our rates by 0.5% for every transaction processed
 > without SET, then management will demand SET be rolled out.  Function be
 > damned, security be damned, as long as some bookkeeper somewhere is
 > satisfied that SET happens, then we avoid a huge rate increase.

I don't doubt that... but when they get zero orders because _noone_
has a SET wallet much less SET certs for their cards, that decision
will get re-evaluated pretty quickly (I would think). If the consumer 
has to get out of their chair to use SET, it's dead. And they have to 
do considerably more than that IMO.

The infrastructure required for SET to actually be used is outrageous,
especially for the consumer. All IMHO of course.

 > 
 > If the security of SET is questioned in the trade rags, our management's
 > approach will be to assume that Mastercard will fix it in the future, but
 > roll it out now anyway.  OTOH, it's obvious (even to them) that SET
 > couldn't possibly be any *less* secure than current authorizing techniques.
 > 

True enough...

Regards,
Jeremey.
- -- 
Jeremey Barrett                                BlueMoney Software Corp.
Crypto, Ecash, Commerce Systems               http://www.bluemoney.com/
PGP key fingerprint =  3B 42 1E D4 4B 17 0D 80  DC 59 6F 59 04 C3 83 64

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBNGpC+C/fy+vkqMxNAQHrUAP9Hes9evGvVtIHXkf/STd61cO/biAFX/kf
prAIvveGtdjPId2OHldv3ws4jAZU9swTArcG5/7QYf+pmes/Yyu+pfswEMQp/y64
w0Nk9TA8ojSvQBAy7Mf6i23jcyoocISozh8yqNdG7E5LcL2qeW6K4eUxEQZmd+Nb
HSTj/ExeH/s=
=un1A
-----END PGP SIGNATURE-----