CIO

Trusted Source

You can lead a consumer to the Internet, but you can’t make him trust it

I don't entirely trust the Internet. I realize this is not an original sentiment, but the rapid increase in financial usage of the Internet suggests that we now trust it a lot more. Trust increases when the frequency and impact of perceived risks decrease. For the Internet, the risks fall into three categories: hackers with viruses, spams and scams with careless users and profiteers spreading fear.

Trojans took an impressive 80 percent share of the Internet threat market in 2006, defeating Windows-based worms for the second year running. It was a Trojan that cost the Swedish bank Nordea 8 million kronor over the past few months. This Trojan is available for sale and its hacker creator offers purchasers a graphical user interface, customized code scripts and software support. I wish some of my commercial applications had ease-of-use features and support like that.

Trust the banks to scan and manage my computer? That alone should ensure everyone rushes out and installs their own security software

Banks are obvious targets and have protected themselves from widespread fraud using a combination of sophisticated security systems and flat denial. This hacker says 99 percent of bank fraud is unreported to protect their image, and mentioned an Australian bank that was also hit by the same Trojan. But then, he's probably lying because we know he's a crook, whereas the banks . . .

The public generally regard bank-jacking with benign amusement since the current law largely protects us from financial loss caused by Internet fraud. So there was outrage through the community when news emerged that ASIC has been lobbied by the banking industry to make customers who were negligent liable for Internet fraud. A righteous response — except the information wasn't accurate. The reports originated from "mistaken information" in a computer security company's press release.

The company's CTO added his two cents, advising that to be secure, users must "check the fingerprint of the SSL certificate" and ensure "the DNS server is properly configured". Picture the average PC user. Mention the phrases SSL certificate fingerprint and DNS server configuration and count the microseconds before their eyes glaze over. Mention these phrases to the average CIO and marvel at an identical reaction. The CTO then suggested that the only way to overcome financial attacks would be to integrate customer PCs into the bank's security chain, and let the bank perform security health checks and scans on them. Trust the banks to scan and manage my computer? That alone should ensure everyone rushes out and installs their own security software.

Secret Password

I know that banks are very concerned about security because of the many e-mails they send me to update my password on their Web site. Being a careful user, I delete them all. However, when I received an e-mail from National Australia Bank's "High Executive Bureau", it seemed too important to ignore, so I complied and clicked the helpfully included Web address. I concluded that their Web site had a Hong Kong domain purely for offshore taxation reasons, and entered a login and password as requested. I'm not actually a NAB customer, so I had to invent a likely login before entering my usual secret password — which like countless other users is secret.

The Internet also provides personal financial gain. So many people e-mail me each week offering jobs of little effort with fantastic incomes that I've stopped bothering with any that promise less than $5000 per week. A recent development is to be offered specific positions with real companies. An Icelandic company repeatedly e-mailed me saying someone with my skills and experience is ideal for a senior job in their finance department. The Web address is indeed a company in Reykjavik and the sender's name and e-mail is that of their finance manager. That I don't speak Icelandic, have no experience in finance, don't like Bjork's music and didn't apply for a job were apparently no obstacle.

I need to be less trusting as it's possible some of these e-mails are not genuine. A South Korean woman was arrested last month for sending several trillion spam e-mails. Assuming an online population of 3.5 billion people, that's around 1000 e-mails per user from just one spammer. I calculate this online number from the population of the planet (6.5 billion), less those who can't use computers — that is, parents (0.5 billion), people with better things to do with their time (1 billion) and those who don't have access to clean water or fresh food, so broadband is less of a concern (1.5 billion).

Page Break

Tithe of Activity

With increased trust is increased activity, and nowhere is this more obvious than on eBay. eBay far surpassed the many online auction sites that had sprung up around the same time, demonstrating both Metcalfe's Law of networks increasing exponentially with each individual, and the Restaurant Rule, where diners are more likely to enter a busy restaurant than an empty one. eBay Australia recently celebrated its five millionth customer, and pointed out that the average Australian has $1700 worth of unwanted items around the home, meaning eBay sees around $75 of potential fees in every Australian.

I first used eBay 10 years ago, when it was still an eBaby, but had already implemented the great concept of customers reporting on and supporting each other to build trust, which had two inherent difficulties. Paying sellers for their goods required expensive and inconvenient money orders as these were the days when eBay was mostly individuals buying from individuals, so credit facilities were rare. Secondly, Americans didn't seem to realize the US Postal Service delivered items, and kept insisting on using expensive couriers. This made the international purchase of smaller items almost unviable.

The courier requirement remains. Indeed, the most profitable Internet-related businesses must be courier companies, as everything can be bought on the Internet, but only computer based programs and files can be delivered by it.

The purchasing difficulties have largely disappeared as we embrace the Internet as a financial transaction tool. In addition to widespread credit card usage, PayPal is increasingly used as a simple, cheap and secure method to pay for purchased goods, and being owned by eBay hasn't hurt its uptake. This reduction in overall purchase cost has been balanced by most eBay sellers now being businesses, some of whom get friends to bid on items to raise the price — a practice called shill bidding. This used to be common with house auctions, but is now outlawed and very rare. On eBay the practice is only outlawed.

Increased trust in the Internet was only a matter of time, as we have seen with previous communication technologies. In the 1950s and 60s, the newcomer TV news was less trusted than newspapers. When newssheets became widespread in the 18th century, they were initially greeted with scepticism, as was undoubtedly the case when our ancestors originally learned to speak. ("Don't believe this new fangled talking, Og, trust only what you see.")

Where is all this increased trusted activity taking us? According to French researchers in January, the Internet is about to fill up. That's it! No more space — at least not until IPV6 is fully implemented. Internet banking will become like going to a real bank — long queues with Windows closing just as you get to them. You can always enjoy the last page on the Internet — http://www.shibumi.org/eoti.htm — though typical of the Internet, there are over a million such last pages.

I'm confident the Internet will move past the current spate of Trojans, worms, viruses, fear predators and stupid users to become a secure, simple to use international financial network.

Trust me.

Bruce Kirkham is a veteran IT satirist and professional speaker ­specializing in leading edge technologies and scepticism, who views the IT industry not so much as "dot com" as "dot comedy"