Subject: Adopting IOTP (was RE: future OTP transactions)

From: "Smith, Chris " <[email-masked]>
Date: Fri, 10 Mar 2000 14:23:26 -0500

One question at a time...

In my opinion, Version 1 of IOTP satisfies the requirements
of the vast majority of e-retailing sites, as far as the 
customer side is concerned.

Adoption is subject to the chicken-and-egg problem.
Merchants won't jump in large numbers to a protocol (or 
even a full standard) unless their customers are using 
it. Customers won't jump in huge numbers unless they 
see merchants offering it.

That said - IOTP is structured to make it's adoption 
relatively easy. For the simplest setup, the merchant will 
simply issue an OfferResponse, and then be prepared to 
accept a DeliveryRequest. The working idea is that the 
PaymentHandler is operated by one (or more - competition) 
agencies, much the way credit card processors operate today.
The merchant's task is made considerably simpler if they 
don't have to handle the payment steps, just deliver when
notified of successful payments. In a dedicated 
implementation, even if SCCD is used (which is roughly 
equivalent to SSL today) the merchant no longer carries the
credit card info with its attendant risks. The risks are 
now transferred to the PaymentHandler - however, ensuring 
that relatively few PaymentHandlers are properly secured
and defended is easier than ensuring that a relatively 
large number of Merchants are secured and defended.

Interestingly, IOTP, if adopted, makes the addition of
additional payment systems much easier. The merchant simply
updates their offer to indicate the acceptance of the added
payment system and the details of the PaymentHandler for
that system.

------------------------------------------------------------ 
 Chris Smith                                +1.416.348.6090 
 Royal Bank                       [email-masked] 

> -----Original Message-----
> From: David Bourget [mailto:[email-masked]]
> Subject: Re: future OTP transactions

> - Second, the real one: What are the expectations of the WG 
> about merchants
> adoption of the protocol ? I'm talking about e-retailing 
> sites like Amazon, Cdnow
> etc. Do you consider "baseline" OTP to fullfil most of their 
> requirements, i.e will
> they have to wait until v2 ?