Why I Shop Online

Carl Ellison

23 November 2005

1
Background

I’m a security architect by profession.  As part of my career history, I worked
for the first online payment gateway company, CyberCash, and in that company we
were aware of all existing threats against online commerce and a bunch that
haven’t materialized yet.

In the course of this experience, I devised a few
observations and rules for myself and my friends about online shopping.

2
Cryptography doesn’t protect you online

Cryptography is wonderful stuff.  That’s what you’re using
when you see the little closed padlock icon in the margin of your browser
window.

I got into computer security through a passion for
cryptography and I’m still passionate.  When you have a chance to use
cryptography, do it.

However, just seeing this padlock does not mean you are
safe.

What this padlock means is that the information you provide
(like a credit card number) can not be eavesdropped between your computer and
the server offering the web page.
So, in the common shopping situation, you might define safety as making
sure your credit card number isn’t misused by someone.

The cryptography here stops someone between your machine and
the web page server from seeing your credit card number, but:

Are
you sure you went to the correct web server?  Many attacks today (called phishing) induce you to go to the
wrong web server where you see a carbon copy of the correct web page.  So, to all appearances, you went to
the right page – but it’s on the wrong machine. It’s on
a machine under the control of the attacker.

Even
if you did go to the correct web server, how sure are you that the correct
server is secured well enough?
Your credit card number will probably be held in a database on that
server.  Many attackers looking
for credit card numbers break into web servers and just download the whole
database.  As Willie Sutton
said, he robbed banks because that’s where the money is.  Attackers rob server databases
because that’s where thousands of credit card numbers are stored.

Even
if the web server is secure, how careful is that legitimate company going
to be with its database of credit card numbers?  Remember Choicepoint? http://www.epic.org/privacy/choicepoint/

Finally,
even if the server and its company are very secure, how secure is your own
computer?  Spyware is a huge
threat.  If your computer has
spyware – or, worse, the kind of infection called a bot – then that attack
software can wait for you to type a credit card number and then send that
number back to a server run by the attacker, where it is put into the
attacker’s database.  You
can and should protect your computer with security measures.  See http://support.microsoft.com/?pr=securityhome
for guidance along those lines.

3
Credit Cards

So, with all that gloom and doom, why do I shop online?

I shop because the credit card companies protect me.  They have to.  When I hand my credit card to a waiter
at a restaurant and he takes it into a back room, he could easily be making a
copy to sell to some attacker.  This
doesn’t require online shopping to enable the attack.  This attack has been possible for
decades – long before computer shopping was invented – and the
credit card companies have addressed it very well, at least from the
consumer’s point of view.

By national regulation in the US, when you use a credit card and
the number is stolen and misused by some attacker, you are liable for only the
first $50.00 of charges the attacker ran up.  In my experience, though, no credit card
company has ever charged me that $50.
Rather, they took any false charge on my statement and put the liability
for the full charge back onto the merchant.

From a security geek’s point of view, the way they
protect me is with a two part protocol. The first part is handing over your
card to the waiter, reading it over the phone to an telephone salesperson,
writing it on a mail-in form or entering it on a web page.  Those are all equivalent.  This part has enough security to get the
merchant to send you the thing you bought, but you aren’t out any money
yet.

The second part of the protocol is when you get the
statement from the credit card company.
It’s your job, now, to read over that statement and make sure that
every line item is something you actually did buy.  If you find something you didn’t
buy, you call the credit card company and reject the charge.  That starts an investigative process and
might result in reversal of charges.
For the line items that you agree you bought, you then write a check to
the credit card company and mail it.
This completes the second part of the protocol.

Because those two parts occur at different times and use
information delivered by independent channels (the second part delivered by the
post office), it is very difficult for the attacker to intercept both parts and
subvert the whole protocol.  Because
it ends with your writing a check, that piece of the process has its own
security and that’s probably enough to block the attacker.  That is, if the attacker could forge
your checks, then that’s the most direct attack and there’s no
reason to engage a credit card purchase.

4
Debit Cards

Most debit cards look just like credit cards and they act
almost the same.  There is a
regulation limiting your liability in cases where the debit card number is
stolen.

However, there is a major difference.  When you buy with a debit card, the
money comes out of your checking account immediately.  There is no check-writing process.  When you get your statement, it shows
things already done.

So, if there is a charge you didn’t make on the
statement, you can’t just refuse to include that in the check you write.
There is no check you write. Instead, you have to open a procedure with the
bank to try to get reimbursed for this charge.

I have never tried that procedure, but I assume that until
this is resolved, your account does not have the contested money in it.  In that case, if the attacker drained
your account dry, you are doing all this process to get reimbursed while being
broke.

For this reason, even though the law protects me, I
refuse to carry a debit card.
I consider them too dangerous.
I would certainly never use one for mail order, telephone order or web
shopping and strongly recommend that my friends not use them.

5
Electronic Funds Transfers (EFT)

This is what I use to have my paycheck automatically
deposited.  It is what some
merchants want me to use to pay for goods.

I absolutely refuse to pay for anything by electronic (direct) funds
transfer!

As far as I know, there is no regulation limiting my loss if
someone uses EFT to drain my bank account.
No one is responsible for reimbursing me.  This makes EFT very desirable for a
merchant.  Once you have money by
EFT, you can count on it. It won’t be later challenged, as a credit card
payment can be.  It won’t be
later withdrawn.  But that same
quality that makes this desirable for a merchant makes it completely
unacceptable to me as the consumer.
With EFT I am totally at the mercy of the merchant.  Worse, I don’t know of any
safeguards of my EFT information that would prevent an attacker from tapping
into my account and draining it (in one transaction or in a series of
transactions).  Such safeguards
might exist.  If so, please send
them to [email-masked] and I will modify this
page.

6
My rules for online shopping

Use
only credit cards – not debit cards.

Carefully
check all credit card statements, line by line, looking for phony
purchases.

Never pay for anything by EFT.

Use
cryptography (HTTPS://, SSL, TLS, …) because it’s a great
goodness – but don’t count on any security as a result.

Shop
online as much as possible.

It
saves money for the merchant.

It
saves time for me.

I
can do it from anywhere.

I
don’t have to burn gasoline to do it.