Ian & Stuart's Australian Mac: Not for Sale

home *** CD-ROM | disk | FTP | other *** search

/ Ian & Stuart's Australian Mac: Not for Sale / Another.not.for.sale (Australia).iso / fade into you / being there / Issues & Ideas / Digital Cash / First Virtual / FAQ-security.txt < prev next >

Wrap

Text File | 1994-10-15 | 23KB | 461 lines

First Virtual SECURITY Frequently Asked Questions This list of Frequently Asked Questions (FAQ) addresses concerns about the security of First Virtual's Internet Payment System. To receive a copy of this list from us by email, please send an email message to the address "security@fv.com"; our information server will automatically send you a copy of the most current version. This version was last updated on 1 September 1994. Copyright (c) 1994 First Virtual Holdings Incorporated. All rights reserved in the United States and other countries throughout the world. First Virtual is a trademark of First Virtual Holdings Incorporated. For information about First Virtual, send email to "help@fv.com". You may freely redistribute this document in any form, as long as you distribute it in its entirety, including this copyright notice. To find out how you can get more information about First Virtual, please see the end of this document. ------------------------------------------------------ Outline This SECURITY FAQ answers the following questions: 1. What are "encryption" and "digital signatures," and why do other Internet commerce schemes use them? 2. Why don't you use encryption with First Virtual? 3. Without encryption, how can you keep my credit card number secure? 4. But wouldn't using encryption with First Virtual add an extra level of security? 5. Can I use encryption or digital signatures with First Virtual if I want to? 6. Who takes the risk in First Virtual transactions? 7. What prevents buyers from getting information without paying for it? 8. How secure are First Virtual's servers? 9. How hard is it to impersonate an accountholder and buy information fraudulently using First Virtual? 10. Where can I find out more about First Virtual? ------------------------------------------------------ QUESTIONS AND ANSWERS ------------------------------------------------------ What are "encryption" and "digital signatures," and why do other Internet commerce schemes use them? "Encryption" refers to scrambling the contents of an email message, using some sort of cryptographic scheme, so that only the intended recipient -- who has the "key" -- can unscramble and read it. Some Internet commerce models use encryption to enable people to send sensitive information like credit card numbers over the Internet and limit the risk that they might be intercepted. A "digital signature" is a code, embedded in a message, which special software can decode to confirm that the person whose name appears on the message is actually the sender. An Internet email message may pass through any number of networks as it travels from the sender to the recipient, and at any point in its journey, there exists the possibility that someone might intercept and read it. If the message contains a credit card number (for example), there exists the possibility that someone might take that number and use it for fraud. ------------------------------------------------------ Why don't you use encryption with First Virtual? Encryption is almost always cumbersome and difficult. And it always adds an additional step, and something else to worry about. After all, even banks and armored cars are subject to robbery attempts, and sometimes those attempts succeed. Rather than use encryption, we decided to design a system in which it wouldn't be necessary. ------------------------------------------------------ Without encryption, how can you keep my credit card number secure? Rather than build encryption into our system, we decided to design a system in which no sensitive information like credit card numbers would ever have to travel over the Internet in the first place. The result is First Virtual's Internet Payment System. With First Virtual, no one -- neither us, nor you, nor any information seller or other party to a transaction -- ever needs to send sensitive information about you, like your credit card number, over the Internet. Transactions are all handled with your unique First Virtual account identifier, which may safely travel in ordinary Internet email because, even in the highly unlikely event that it were intercepted, an unauthorized user couldn't use it for fraud. He or she couldn't even use it to buy information over the Internet fraudulently, because -- as discussed in detail in the BUYING and SELLING FAQs -- all transactions are confirmed via email before you're charged. If someone tried to use your First Virtual account identifier to buy something without authorization, you'd simply tell us so when we sent you email asking to confirm the charge, and the stolen account identifier would be inactivated immediately. Even when you're first signing up for a First Virtual account, we will never ask you to enter sensitive information, like your credit card number, in email or over an Internet connection. Your credit card number will only be given to us over a private telephone line. We'll keep it secure, on a computer which isn't on the Internet at all. ------------------------------------------------------ But wouldn't using encryption with First Virtual add an extra level of security? No. Not only do we think it wouldn't add an extra level of security; we think it would make the system so complicated and difficult to use that it would entirely defeat the purpose for which we designed First Virtual's Internet Payment System in the first place: to make Internet commerce safe and easy for everyone to use, even ordinary Internet users without a computer science degree or years of experience. Most people assume that digital encryption or digital signatures are essential for doing real commerce on the Internet, or at the very least that they are the best mechanism for commerce on the Internet. First Virtual disagrees, for several reasons: * Encryption and signature technologies, by their nature, prevent most people from participating in Internet commerce. * Encryption and signature technologies are complicated and confusing. * Encryption and signature technologies yield a false sense of security. * Encryption and signature technologies require the use of software and certification infrastructures that aren't commonly available. * Encryption and signature technologies don't add any legal weight to most transactions. * Encryption and signature technologies are restricted by patents, copyrights, and export restrictions. We'll discuss each of these in some detail: Encryption and signature technologies, by their nature, prevent most people from participating in Internet commerce. To be an information seller in a marketplace based on encryption and signatures requires that you be a "member of the club." At the very least, you have to have a digital signature; give it to a centralized certifying institution, so that other people can look you up when they want to verify your identity; and prove to the certifying institution that you really are who you say you are. And, of course, you need to be able to use all the digital encryption and signature software that keeps the system running. At the very least, becoming an information seller under those conditions would be as hard as getting a credit card merchant account AND operating your own Internet server. And on top of everything else, you'd have to be willing to go through all the trouble of encrypting, decrypting, and digitally signing and verifying messages every time you send or receive one. In contrast, the First Virtual system allows anyone to sell information, including people with no business credit history and (using our Infohaus, as described in the SELLING FAQ) no Internet servers of their own. Encryption and signature technologies are complicated and confusing. The most widely used encryption program, PGP, comes with a printed manual divided into two parts, the first of which is considered "essential" and "should be read by all PGP users". Yet this "essential" part is 40 pages long, and is generally incomprehensible to the ordinary user. So people develop "shortcuts" -- quick tutorials or cheat sheets -- that leave readers with an incomplete understanding of the system. The problem is, if people use the system without completely understanding how it works, that undercuts the system's security for everyone -- even for those who are persistent enough to master its use. Some simpler-to-use technologies have been proposed that are based on specialized hardware, e.g. "smart cards." But the Internet has always allowed anyone to connect and use the worldwide network, no matter what kind of computer they have. It would violate that tradition to require every Internet user to have a specific piece of hardware in order to use the net. Moreover, deploying such hardware would be an extremely lengthy, costly, and complicated effort, and anyone who hadn't yet installed the special hardware wouldn't be able to participate. In contrast, First Virtual is available to almost everyone, right now, without requiring anyone to buy any special hardware at all. Encryption and signature technologies yield a false sense of security. First, the use of "shortcuts" as described above tends to make encryption systems less secure in a number of ways -- for instance, when people don't store passwords securely, select passwords that are easy for them to remember and easy for others to guess, or rely on unverified passwords and keys without realizing the implications. Second, encryption and signature technology, even if they were perfect, would really only address two aspects of security anyway: they'd assure you that the other party really was who he said he was, and they'd assure you that other people could't listen in on your communication. But to call such a transaction "secure" is to ignore the fundamental importance of the establishment of trust. To put it simply, would you rather have a signed, authenticated transaction with Al Capone, or an open transaction with Mother Teresa? Encryption and signature technologies require the use of software and certification infrastructures that aren't commonly available. People have been trying to deploy such technologies on the Internet for nearly two decades, and people are still fighting over the basic infrastructure. Some of us are tired of waiting. If they're not needed, why wait for them? Encryption and signature technologies don't add any legal weight to most transactions. There have been no definitive legal opinions on this matter in the United States, but several experts believe that unencrypted email may have as much legal standing as many other kinds of correspondence, and there is no consensus that digital authentication technology adds any legal standing to an agreement. In contrast, First Virtual's transaction confirmation system -- in which buyers must agree, as a condition of using First Virtual, that their email confirmation of a transaction constitutes a commitment to pay -- is clear, unequivocal, and legally enforceable without any need for encryption. Encryption and signature technologies are restricted by patents, copyrights, and export restrictions. The most common form of encryption, using public keys, is protected by a well-defended patent in the United States. Most strong encryption technologies are export-restricted by the United States government, causing serious problems for international information commerce. We're committed to making First Virtual easy to use all around the world, but we couldn't use common encryption technologies for certain international transactions without risking prosecution for us, the information seller, and the information buyer. ------------------------------------------------------ Can I use encryption or digital signatures with First Virtual if I want to? Of course. If you're an information seller, you're free to set up a system which encrypts information before sending it to buyers, or which requires buyers to digitally sign messages to you. We certainly wouldn't recommend doing this, for all the reasons outlined in detail above. It would drastically reduce your sales, because only a very small subset of the Internet community is comfortable using these difficult and complicated security methods. But that's a choice that you're completely free to make. ------------------------------------------------------ Who takes the risk in First Virtual transactions? Ordinarily, the seller takes all risks associated with a First Virtual transaction, including risks associated with non-payment and currency fluctuations. The seller is also responsible, as in any transaction, for complying with any laws associated with the sale, such as tax laws, obscenity laws, and export restrictions. The risks to the seller are actually very few, with very little impact on business, revenues, or profitability. Here are the main ones we foresee: * Someone might use a First Virtual account identifier to try to buy information from you without the accountholder's consent. Ordinarily, this will be caught as soon as the buyer receives our email message asking to confirm the transaction; he or she will inform us that the account was used without authorization, and the account will be suspended. * A very small percentage of people who download information from you, review it, and then decline to pay for it may keep and use the information anyway. This will occasionally happen, but as explained in detail above, any accountholders who abuse your goodwill or our system will have their First Virtual accounts immediately suspended. Fortunately, the impact on you is virtually nil, since it costs you nothing to "manufacture" a new copy of your product. * Someone may buy and pay for a legitimate copy of one of your information products, then make copies for all their friends without paying you. This is true, but it's also true, to a greater or lesser extent, of information sold in virtually any other form. Printed matter, recordings, drawings and photographs, computer software -- all of these can be duplicated for very low cost even if purchased through traditional channels. First Virtual is as subject to these dangers as any other method of distribution. * Some people who agree to buy information from you may refuse to pay their credit card bills, or may dispute the charges. Anyone who does this will immediately have his or her First Virtual account suspended. First Virtual accountholders are informed very clearly, and agree, that replying "YES" to a message from First Virtual asking whether they agree to pay constitutes the equivalent of a signed contract to pay, which the buyer's credit card company can be expected to enforce. Eventually, if the buyer continues to refuse payment, his credit card will probably be cancelled. The risks are described in more detail in the SELLING FAQ and the THEORY FAQ. ------------------------------------------------------ What prevents buyers from getting information without paying for it? The short answer is: nothing. In fact, if you're a seller, you're virtually guaranteed that some people will in fact download your information without having any intention of paying for it. However, both First Virtual and our sellers will be keeping very careful track of how frequently each accountholder requests that information be sent to him in email (or downloads it) for examination and then declines to pay for it. First Virtual will suspend the account of any accountholder who appears to be taking advantage of our sellers or our system, and sellers may refuse to do business with any accountholder who they believe is taking advantage of their goodwill. In particular, First Virtual will cancel the account of anyone who declines to pay more often than we deem acceptable. We have no interest in harrassing people who are legitimately using our system for the purpose for which it was designed in the first place -- to permit people to evaluate information, in good faith, before deciding whether to buy it. People in that category are the reason First Virtual was created. However, there are reasonable limits, and we will enforce them. (We won't disclose in advance what our limits are, but we'll let you know if you're getting close.) If you're honest, and using the system for the purpose for which it was intended, we don't think you'll ever have any problem. If an account is cancelled for reasons such as these, it is impossible to create a new First Virtual account using the same credit card as the underlying payment mechanism. Thus, a dishonest First Virtual accountholder can abuse the system a few times for each credit card he has, and that's it. (Anyone who can generate an unending string of valid credit cards probably has more lucrative prospects for thievery than information theft on the Internet anyway.) The important point is that if you're going to sell information over the Internet, it is impossible to protect it from a truly determined thief, just as a good professional burglar can break into nearly any home. Even with the strongest encryption, a thief can order one copy legally and then resell it to his heart's content. The First Virtual Internet Payment System, like most real-world engines of commerce, acknowledges that there will be a small amount of theft and takes all realistic measures to limit it without making the system excessively painful for honest people to use. There would be less credit card fraud if you had to have a retina scan every time you used your card, but that doesn't mean this would make credit cards a better mechanism for commerce. We anticipate that some sellers may find the level of risk in our system unacceptable. They are, of course, under no obligation to sell their information using First Virtual. However, we believe they being unrealistic if they think that any other mechanism for Internet information sales will be fundamentally more secure. ------------------------------------------------------ How secure are First Virtual's servers? It is our intention to operate the most secure machines on the Internet. To this end, we will retain first-rate security expertise, and stay current or ahead of the state of the art. Beyond this, the "line" between our Internet machines and the financial networks (see the CASHFLOW FAQ) constitutes the most extreme form of firewall. For obvious reasons, we are not inclined to detail all of our security precautions here, but you can be assured that we have given security the highest priority in the design and implementation of our system. ------------------------------------------------------ How hard is it to impersonate an accountholder and buy information fraudulently using First Virtual? The key authentication mechanism in the First Virtual protocol is the buyer's email-based confirmation of each purchase. To defeat this mechanism requires someone to steal a First Virtual account identifier; to identify the corresponding email address (which is not public knowledge, cannot be determined from the account identifier, and will not be released by First Virtual); to know or guess the account password; to intercept all incoming messages to that email address; and, of course, to know what First Virtual is and understand what our messages are about and how to respond to them. While this chain of events is conceivable, it is in practice highly unlikely, and we are taking substantial precautions against the mechanisms that we have thought of for accomplishing these goals. We think that defeating our system will be several orders of magnitude harder than, for example, stealing the carbons from credit cards, and we also think that we will be able to quickly detect any successful efforts to compromise our system. ------------------------------------------------------ Where can I find out more about First Virtual? The First Virtual GENERAL INFORMATION FAQ is the best place to start if you are looking for information about First Virtual. It provides details about all the FAQ documents available via email, and about additional information available from our anonymous FTP and Gopher servers and our World Wide Web database. To receive a copy of the GENERAL INFORMATION FAQ, send an email message to "help@fv.com"; the GENERAL INFORMATION FAQ will be sent to you by email automatically. You can also find a copy in other places: * Connect to ftp.fv.com, our anonymous FTP server, and look in the directory /pub/docs for the file called "FAQ- general.txt". * Using Mosaic, Lynx, or another World Wide Web browser, connect to our Web page using the URL http://www.fv.com and Look for the link to the "Frequently Asked Questions" page. Here's a summary of other First Virtual FAQ documents; to receive a copy by email, send a message to the specified address: * 1-2-3 FAQ -- Steps for getting started -- 123@fv.com * SIGNUP FAQ -- Signing up for an account -- signup@fv.com * BACKGROUND FAQ -- Our company and our vision -- background@fv.com * BUYING FAQ -- Buying information -- buying@fv.com * SELLING FAQ -- Selling information -- selling@fv.com * INFOHAUS FAQ -- Using the Infohaus -- infohaus@fv.com * SECURITY FAQ -- Security issues -- security@fv.com * CASHFLOW FAQ -- Flow of money in our system -- cashflow@fv.com * PROBLEMS FAQ -- Dealing with problems -- problems@fv.com For information in languages other than English, send email to "international@fv.com". To help us provide our services to the public at the lowest possible cost, please search the FAQs before sending email to our human operators. Thanks for understanding. And welcome to First Virtual!