Subject: Consumer Authorization of PH

From: Andrew Drapp <[email-masked]>
Date: Tue, 22 Sep 1998 13:09:56 +0900

There may be a need for the Consumer to authenticate the Payment Handler 
before sending the PaymentRequest message.  Imagine a situation where 
someone sets up a PH and then spoofs the IP of a known PH.  When the 
consumer sends the PaymentRequest message, it could be intercepted by the 
fake PH.

In the current version of the specs, a trading exchange cannot be 
temporarily suspended and an authentication exchange started.  Since 
everything is signed and is assumed to be going over a secure channel (ssl), 
it seems that there is no reason that a PH or DH would need to authenticate 
a consumer.  Furthermore, it was mentioned at Reston that the fake PH would 
have to decrypt the offer exchange messages in order to successfully spoof a 
PH. I don't think this is quite true.  Once a hacker knows what PH a 
merchant uses, and what brands, he can set up a fake PH at his leisure.

The simplest way to solve this would be to leave it up to the implementation 
of the client OTP software.  Something like having a checkbox somewhere 
saying "Send Authorization Request and wait for verification before sending 
Payment Request."  There should  be little problem adding an 
AuthReq/AuthResp between the OfferResp and the PayReq messages.

Does this seem like something we should solve in OTP, or leave as an 
exercise for the reader?  Does anyone have any suggestions on how to change 
OTP to allow for the consumer to Authenticate the Payment Handler before any 
personal information is sent?

Regards,

Andrew Drapp

--
Andrew Drapp
[email-masked]
Hitachi Systems Development Laboratory
1099 Ozenji, Asao, Kawasaki, 215-0014 JAPAN
TEL:+81-44-966-9111   FAX:+81-44-966-1796
Fingerprint: 84D8 3D19 018E 9385 6581  0081 C89C D2AD F06A 565F

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: Michael Gillespie <[email-masked]>
Date: Wed, 23 Sep 1998 09:01:41 +0100

I hope that I have understood you correctly because I think that this equates
with an area of "business risk", as perceived by the Consumer, but which may
have been satisfactorily covered within the Model.

From the Customer's perspective there are some Merchants with whom they would
never do business because they don't trust them for a number of reasons, could
be product quality or after sales service quality etc.  But there are some
Merchants whom the Customer had noy previously known, and which they may become
unhappy/suspicious about DURING the total sales process - even after the Product
has been Selected, Payment Methods agreed, but before the "Point-of-No-Return"
in the Payment Stage.  As a Consumer I am not TOO worried that the problem can't
be resolved if I pay by Credit or Debit Card.  I AM worried if I pay by E-Cash,
especially if it is a type where Merchant Disintermediation is permitted (ie
Mondex in UK), that the "Merchant" could do a runner with my E-Cash which they
subsequently "spend" rather than "bank".  The TRADING RISK is very much on the
CONSUMER to be happy with the AUTHENTICITY of the Merchant.  From the other
angle, the Merchant (Payment Handler) is more than haapy to accept Payment from
ANYONE for a Transaction, so long as it is, in their view, "good money" and for
which they will receive Settlement.

With the interest being shown by Fraudsters in the opportunities/challenges for
them with both Smart Cards and E-Commerce, Consumers (including me!) do want to
be complete peace of mind (with zero risk) that the Merchant is not a
fraudster/student purporting to be one of well-known highly-trusted Merchants.

So, I'm interested in Andrew's views, but I would hope that his concerns have
been fully covered already in the Model.