SETting Signatures That Bind

Disclaimer: This information comes from sources that cannot be verified. As such, make no assumptions about its completeness or accuracy. We endeavor to keep this information up to date as much as possible. Feel free to send comments/ updates to the Security News Editor.

January 12, 1998, Issue: 697
Section: News & Analysis

SETting Signatures That Bind

John Evan Frook

The major credit card associations are out to make digital signatures as binding as physical ones.

In separate efforts, MasterCard and Visa last week said they will change the rules that govern Internet-based transactions that take advantage of the Secure Electronic Transactions (SET) protocol, which, by all accounts, is sputtering.

Today, card purchases over the Internet are treated as so-called "card not present" transactions like those conducted over the phone or by mail. When a dispute arises, the merchant is responsible for proving the order was valid.

On April 1, the associations will begin treating online transactions that use the SET protocol much like those that take place at physical points of sale. If a sale recorded using SET certificates is questioned by the consumer, the consumer and the consumer's bank must prove the purchase was fraudulent.

With the policy change, MasterCard and Visa hope to move more phone and mail-order business online. Yet some merchants say it will take financial incentives, such as a reduction in processing fees, for SET to catch on.

Steve Mott, MasterCard's senior vice president of electronic commerce and new ventures, said the policy change could spur telephone and mail-order companies to begin looking at Internet commerce as a preferred platform.

"The biggest thing on the minds of merchants is some relief in the chargeback arena," Mott said. "We feel the promise of SET, if it promises anything beyond merchant identification to the cardholder, is end-to-end verification of all parties in the transaction."

Not An Easy Sell

Kick-starting the SET technology, which relies on acceptance from banks, merchants and individual customers, has proven troublesome. Banks have found SET difficult to integrate into their systems, merchants report little advantage over encryption solutions such as Secure Sockets Layer, and software vendors have had trouble getting SET software into consumers' hands (InternetWeek, Nov. 24, 1997)

Indeed, although MasterCard is involved in more than 60 pilots, company officials cannot point to one operational deployment.

Paul Graham, president of Viaweb Inc., which hosts hundreds of Web storefronts, said merchants will rally around SET only when the processing fees are reduced.

"The moves by MasterCard and Visa don't make any more than a theoretical difference until the consumers go along with it," Graham said.

Technical hurdles aside, there's some interest in SET. Pilots include the Treasury Department's plan to sell bonds over the Internet and a project by retail giant Wal-Mart Stores.

William Tobin, president of PC Flowers & Gifts, said SET could help merchants convince their customers that the Internet is safe.

"One of the largest problems is the perception of security," Tobin said. "It is not a reality, it is a perception."