Ray Van Eng (10/27/97)
Judging from the number of SET pilots going on around the world, the standard that Visa, Mastercard and their technology collaborators intended for safe shopping over the Internet seems to be moving along steadily. European banks including those from France, Germany, Swiss and others are using it to safeguard Internet purchases. Japan is using it in combination with smart cards. Singapore and Taiwan are using it. Pockets of south and central America in such places as Mexico and Brazil are experimenting with it. So do the Canadian and South African banks and even the U.S. Departnment of Treasury.
However, SET does have its detractors. Some say that SET is an over-kill, is too complicated, and is too burdensome to the server which runs it. In the minds of many, Internet merchants and banks included, SET is just not necessary. And worse, it is a who-needs-it solution looking for a problem. On the other hand, the consumers are none the wiser. They have been told time and again that the Internet is not safe for business and there are online lurkers everywhere engaged in snatching credit card information by poking holes in the security network. Online merchants and even some Internet e-commerce software vendor say that they are doing fine with an existing mode known as the secure socket layer (SSL) used to encrypt data (such as credit card numbers and order details) from the purchaser's desktop PC to the online merchant server. There is no argument that SSL is doing its job, but often it is what happens after the sale that could compromise data security. A few months ago, it was revealed that thousands of credit card numbers have been stolen from an Internet service provider's computer (rumored to belong to Netcom Inc. in the U.S.) by a hacker who intended to sell the loot but was caught by the FBI in a sting operation. The reason that the ISPs have to maintain files on the credit card sales is because SSL does nothing in executing the actual credit card transactions. Once the web server operators or merchants acquired the credit card details safely over the Internet, they will have to go through the manual steps in processing the credit card order just like in a retail point-of-sale operation. Here is an area where SET would prove to be immensely superior to SSL. Not only does SET authenticates all parties involved in an online purchase by verifying the various digital certificates and making sure that those entities are who they say they are, SET also provides many desirable value added services as well. For example, buyers don't have to enter credit card and shipping information everytime they shop. ISPs do not have to store credit card details as the transaction is strictly a financial matter between the buyer and the bank. Likewise, merchant fraud is greatly reduceded. Direct deposits into merchant bank accounts are made possible. Merchants would have the opportunity to recognize repeated shoppers automatically once they log on and be able to offer them with special customer loyalty rewards. SET may even lower the cost of doing business online as everything would be handled over the network with very little human intervention. Of course, the downside to SET is that everyone from merchants to banks to consumers would have to invest time and money into learning how to carry out safe commerce electronically. Banks will have to pay for new software and lay the necessary security groundwork. Merchants will have to upgrade their web server systems. Consumers will have to obtain digital certificates and learn how to use electronic wallets which will soon be incorporated into web browsers from Netscape and Microsoft. All that add up to some very major changes (and some immense expenses for some financial institutions) and that is why there is so much resistance to the dawning of SET. But critics of the Visa/MC standard often runs the risk of missing the big picture all together. Many failed to see that the SET platform could be much more useful than just for electronic commerce. SET could potentially act as a glue or a major software component in combining multiple applications which would likely be embodied in smart cards or computer embedded credit card size devices taking care of every operation from personal identification, building and remote computer access, credit/debit card and e-cash transactions, health care record keeping, membership benefits and customer loyalty programs etc. The business case for using only one card and a unifying technology that can handle all these tasks is very appealing. In the evolution of a cashless and networked computing world, SET is right on the money as a technology innovation necessary to push forth such ideals. As version 1.0, SET is by no means perfect. It can be improved upon and indeed work is currently being done by Visa and Mastercard and many of their mighty industry partners to design the next version which will have smart card and other operation functionalities built into it. Meanwhile, two distinct paths are being put into motion. One is the creation of an infrastructure so that banks, merchants and consumers can interact with each other in the most convenient, efficient, and cost effective way to conduct business in cyberspace. The other is the rapid expansion of online consumer services that will include electronic cash, smart cards, credit, debit, electronic check payments etc that can be enabled through a PC, a TV set-top box, a screen phone, a wireless cellular unit or a handheld computing device. Watch for an exciting year in 1998 for the further development of electronic commerce and digital communication technologies to serve an increasing population of wired consumers.
U.S. Treasury & Others SET for Net Commerce Europay SETs Internet Shopping in Motion Smart Cards Get SET and Go Multi-application |
IBM
is shipping SET software and has been touting secure shopping on the Internet
in mainstream media. Have you seen Big Blue's @Buisness Solutions TV ads
lately? Those black and white widescreen shots with a blue top and bottom
band framing the pictures? Software vendor RSA Data Security Inc. is offering
a SET developer kit.