<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Johannes Ernst wrote:
<blockquote cite="mid453D8FD4-BCC7-492E-A45C-D87EA438CC69@netmesh.us"
type="cite">I'd like to take issue with the following statement that's
being made all too often: [not picking on anybody in particular, just
"established wisdom"]
<br>
<br>
<blockquote type="cite"> the security requirements to authorize
<br>
financial transactions are much higher than the requirements to login
to
<br>
most consumer oriented websites.
<br>
</blockquote>
<br>
Ahem, no?
<br>
<br>
Just today, I ordered something from Amazon with no credential at all,
just my credit card number and "security code" (also printed on the
card) that every waiter knows in every restaurant I have ever been to.
<br>
<br>
This is *less* security than username and password, not "much higher"
as is generally stated.
<br>
</blockquote>
Of course you're ignoring the risk mitigation (==security) provided by
the credit card anti-fraud measures and its safety net insurance policy
after the ($50?) deductible that keeps you from having your bank
account sucked dry. The _only_ reason you can get away with this is
because of that hidden security infrastructure -- and you and merchants
pay for that infrastructure. <br>
<br>
A financial transaction where you, say, buy Enron stock is a quite
different matter.<br>
<blockquote cite="mid453D8FD4-BCC7-492E-A45C-D87EA438CC69@netmesh.us"
type="cite">So, let's beware of blanket statements re security
requirements ...
<br>
</blockquote>
Agreed.<br>
<br>
<br>
<blockquote cite="mid453D8FD4-BCC7-492E-A45C-D87EA438CC69@netmesh.us"
type="cite"><br>
Cheers,
<br>
<br>
<br>
<br>
Johannes.
<br>
<br>
<br>
<br>
Johannes Ernst
<br>
NetMesh Inc.
<br>
<br>
<br>
<br>
<hr size="4" width="90%"><br>
<center><img src="cid:part1.09000700.09010204@acm.org"></center>
<p><br>
</p>
<hr size="4" width="90%"><br>
<center><img src="cid:part2.09080408.05000907@acm.org"></center>
<p><a class="moz-txt-link-freetext" href="http://netmesh.info/jernst">http://netmesh.info/jernst</a>
<br>
<br>
</p>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
<br>
</body>
</html>