[12803] in Commercialization & Privatization of the Internet
Re: Failings of credit cards
daemon@ATHENA.MIT.EDU (John Curran)
Sun May 29 14:25:19 1994
To: Nick Szabo <szabo@netcom.com>
Cc: com-priv@psi.com
In-Reply-To: Your message of Sat, 28 May 1994 13:50:01 -0700.
<199405282050.NAA07200@netcom.com>
Date: Sat, 28 May 1994 23:57:02 -0400
From: John Curran <jcurran@nic.near.net>
--------
] From: Nick Szabo <szabo@netcom.com>
] Subject: Failings of credit cards
] Date: Sat, 28 May 1994 13:50:01 -0700 (PDT)
] ...
] The vendor also has to trust the number. Many small
] vendors are not in a position to check numbers in real time.
] Even if they can check the numbers they can't truly
] authenticate the identity of the person at the other
] end over the Internet without a prohibitively complex
] authentication system.
] ...
] Credit card fraud is already bad enough (over 3% of credit
] card transaction volume and growing); the card companies
] will be quite loathe to serve Internet-based ordering if
] it starts happening here.
]
] Finally, the credit card system, with its delayed
] billing assumes billing dispute resolution methods.
] If a customer disputes a bill, the credit card company
] should wipe it off, and the vendor should have good enough
] records and authentication that he can prove the transaction
] took place. Again, this assumes jurisdictional uniformity,
] accounting standards, and high per transaction costs, a
] situation light-years away from somebody running a web
] site on an network that crosses hundreds of jurisdictions
] and dispenses files at $.50 a pop.
]
] This kind of multinational small business may be by far and
] away the most lucrative market for Internet-based commerce.
] ...
] There are a wide variety of these net-based businesses that Visa,
] Mastercard & Co. wouldn't touch with a ten-foot pole; but it
] would be perfectly reasonable to deal with them on a cash or
] other debit basis.
]
] What about some of the net.transaction systems that are in
] the works; how close do they come to the ideal of jurisdiction
] independent transaction? The CommerceNet system is fundamentally
] based around the credit card and other methods of payment heavily
] dependent on uniform jurisdiction. It authenticates vendors against
] a public key hierarchy, which is prone to single-point failure at the
] top of the hierarchy, where of course CommerceNet has placed itself.
] No customer authentication is provided, as this would be prohibitively
] complex, so the threat of credit card spoofing remains.
Nick,
Your assessment of the failing of credit cards seems quite accurate,
but I'm not sure that total condemnation of credit cards for Internet
transactions is the only conclusion.
Depending on the transaction model, credit cards may actually be suitable.
Given a secure manner to communcate information to the vendor, relatively
low transaction costs and an infrequent transaction model (such as ordering
flowers every fews months :-), there's no reason why credit cards cannot be
used successfully over the Internet for electronic commerce. Absolute
authentication of the buyer (beyond the constraints imposed for card use)
is not necessary for most transactions and some might even assert that it is
quite undesirable.
Change the assumptions (e.g. product costs comparable to transaction costs,
hundreds of transactions per day, etc. ) and the relatively simple model of
credit cards does not lend itself directly to the job. Digital cash is
certainly one way to approach this problem, but another is issuance by the
vendor of digital "credentials" to the buyer (similiar to the manner in which
store credit cards are issued today). The management of such credentials
(including creation, issuance, and re-presentation by the client) is a non-
trivial but solvable problem. If done in a flexible manner, one might even be
able to interoperate with stronger certificate models for those transactions
where stronger authentication and non-repudiation is necessary.
/John
