Securing online services - Revision history

Jhfrontz: /* Future research */ Link to TPM and fixing typos.

2018-11-29T20:37:41Z

Future research: Link to TPM and fixing typos.

← Older revision		Revision as of 20:37, 29 November 2018
Line 80:		Line 80:
	== Future research ==		== Future research ==

	Whilst running your own physical servers with no datacenter operator access is secure, it lacks convenience. In future it may be possible to the use TPM (trusted platform module) chips to allow managed hosting such that root or even physical access is insufficient to steal the funds, as the wallet keys would be bound to a particular software environment. Well engineered trusted computing solutions have some degree of physical resistance so rebooting the machine, opening it up or logging in with local/remote root would be not allow you to steal the ~~wallets~~ balance.		Whilst running your own physical servers with no datacenter operator access is secure, it lacks convenience. In the future it may be possible to the use [[trusted platform module \| TPM (trusted platform module)]] chips to allow managed hosting such that root or even physical access is insufficient to steal the funds, as the wallet keys would be bound to a particular software environment. Well engineered trusted computing solutions have some degree of physical resistance so rebooting the machine, opening it up or logging in with local/remote root would not allow you to steal the wallet's balance.

	Unfortunately engineering such systems is non trivial and the technical difficulty places this solution out of reach for most traders right now. In future easy to use software libraries, documentation, examples and managed hosting providers that sell TC enabled hardware may increase its attractiveness.		Unfortunately engineering such systems is non-trivial and the technical difficulty places this solution out of reach for most traders right now. The future availability of easy-to-use software libraries, documentation, examples and managed hosting providers that sell TC enabled hardware may increase its attractiveness.

	==See Also==		==See Also==

Mikecameron: Added fraud prevention service providers

2014-07-25T07:16:14Z

Added fraud prevention service providers

← Older revision		Revision as of 07:16, 25 July 2014
Line 19:		Line 19:
	As you may have noticed, whilst happy customers are somewhat under your control in aggregate, you have no control over how many credit card numbers are stolen. For this reason credit-card accepting merchants typically have large and sophisticated fraud control measures in place, involving dedicated risk operations staff, machine learning, JavaScript browser fingerprinting and so on. The goal being to spot repeat fraudsters and deny their transactions. Too many false positives and legitimate customers who want to pay for your product cannot, limiting your market. Too many false negatives and you can lose significant money to chargebacks, which may arrive weeks or months after the product or service has been delivered.		As you may have noticed, whilst happy customers are somewhat under your control in aggregate, you have no control over how many credit card numbers are stolen. For this reason credit-card accepting merchants typically have large and sophisticated fraud control measures in place, involving dedicated risk operations staff, machine learning, JavaScript browser fingerprinting and so on. The goal being to spot repeat fraudsters and deny their transactions. Too many false positives and legitimate customers who want to pay for your product cannot, limiting your market. Too many false negatives and you can lose significant money to chargebacks, which may arrive weeks or months after the product or service has been delivered.

	Unsurprisingly, many merchants choose to outsource this arduous process to a third party like [[PayPal]], Google Checkout and so on. However all these services add their own policies, fees and often do not provide any guarantees of chargeback protection.		Unsurprisingly, many merchants choose to outsource this arduous process to a third party payment gateway like [[PayPal]], Google Checkout and so on or a third party fraud prevention like FraudLabs Pro, Signifyd and so on. However all these services add their own policies, fees and often do not provide any guarantees of chargeback protection.

	=== Risks involved in online banking ===		=== Risks involved in online banking ===

Sgornick: Add to category Security.

2012-10-24T16:54:36Z

Add to category Security.

← Older revision		Revision as of 16:54, 24 October 2012
Line 94:		Line 94:

	[[Category:ECommerce]]		[[Category:ECommerce]]
			[[Category:Security]]

Sgornick: /* See Also */ Add article relating to PayPal fraud.

2012-07-17T22:47:51Z

See Also: Add article relating to PayPal fraud.

← Older revision		Revision as of 22:47, 17 July 2012
Line 88:		Line 88:
	* [[In-store Transactions]]		* [[In-store Transactions]]
	* [[How to accept Bitcoin, for small businesses]]		* [[How to accept Bitcoin, for small businesses]]
			* [http://bitcointalk.org/index.php?topic=93770.0 How CoinPal avoided PayPal fraud]

			==References==
			<references />

	[[Category:ECommerce]]		[[Category:ECommerce]]

Sgornick: /* Transaction reversals */ Make reference to Finney attack a link to that section in the Double spending article.

2012-06-18T17:04:43Z

Transaction reversals: Make reference to Finney attack a link to that section in the Double spending article.

← Older revision		Revision as of 17:04, 18 June 2012
Line 67:		Line 67:
	* For merchants that are shipping physical goods you probably don't have to worry. Reversing a transaction gets harder and harder with time. After only one hour it becomes computationally infeasible to reverse a Bitcoin transaction. Inserting a small delay before shipping isolates you from this risk entirely.		* For merchants that are shipping physical goods you probably don't have to worry. Reversing a transaction gets harder and harder with time. After only one hour it becomes computationally infeasible to reverse a Bitcoin transaction. Inserting a small delay before shipping isolates you from this risk entirely.
	* For automated trading platforms that may pay out some other currency in response to Bitcoin deposits, you should also delay payment for a short time until reversal becomes infeasible. Low risk deposits from trusted customers could be processed faster, as reversing a Bitcoin transaction is a non trivial problem at this time which is suited only to relatively skilled attackers who are after large sums of money.		* For automated trading platforms that may pay out some other currency in response to Bitcoin deposits, you should also delay payment for a short time until reversal becomes infeasible. Low risk deposits from trusted customers could be processed faster, as reversing a Bitcoin transaction is a non trivial problem at this time which is suited only to relatively skilled attackers who are after large sums of money.
	* For merchants shipping things immediately, like digital downloads, measuring the propagation of a transaction across the network and waiting until most nodes have reported it is probably good enough. This allows you to accept the payment within seconds. Whilst there's a higher risk of transaction reversal here, the attack is still expensive and the attacker cannot choose the timing of the attack. Therefore watching out for users who receive an address and then delay the act of payment significantly is probably enough to insulate you from this attack (the Finney attack).		* For merchants shipping things immediately, like digital downloads, measuring the propagation of a transaction across the network and waiting until most nodes have reported it is probably good enough. This allows you to accept the payment within seconds. Whilst there's a higher risk of transaction reversal here, the attack is still expensive and the attacker cannot choose the timing of the attack. Therefore watching out for users who receive an address and then delay the act of payment significantly is probably enough to insulate you from this attack (the [[Double-spending#Finney_attack\|Finney attack]]).

	=== Your wallet may be accidentally destroyed ===		=== Your wallet may be accidentally destroyed ===

Sgornick: /* Risks involved in online banking */ Correct on Fedwire transfers being reversible.

2012-05-17T03:04:59Z

Risks involved in online banking: Correct on Fedwire transfers being reversible.

← Older revision		Revision as of 03:04, 17 May 2012
Line 36:		Line 36:
	# There are no dedicated hardware devices used		# There are no dedicated hardware devices used
	# Security may be entirely heuristic		# Security may be entirely heuristic
	# ~~Bank~~ wires that ~~originate in~~ phishing ~~can be easily reversed and often are~~		# Though Fedwire bank wires are not reversible, banks can still return funds that were received such as when the transfer was the result of phishing, for instance.
	# Whilst consumer accounts may have some liability protection, business accounts do not		# Whilst consumer accounts may have some liability protection, business accounts do not

Sgornick: /* Risks involved with accepting credit card payments online */ Add link for article.

2012-05-17T02:18:43Z

Risks involved with accepting credit card payments online: Add link for article.

← Older revision		Revision as of 02:18, 17 May 2012
Line 19:		Line 19:
	As you may have noticed, whilst happy customers are somewhat under your control in aggregate, you have no control over how many credit card numbers are stolen. For this reason credit-card accepting merchants typically have large and sophisticated fraud control measures in place, involving dedicated risk operations staff, machine learning, JavaScript browser fingerprinting and so on. The goal being to spot repeat fraudsters and deny their transactions. Too many false positives and legitimate customers who want to pay for your product cannot, limiting your market. Too many false negatives and you can lose significant money to chargebacks, which may arrive weeks or months after the product or service has been delivered.		As you may have noticed, whilst happy customers are somewhat under your control in aggregate, you have no control over how many credit card numbers are stolen. For this reason credit-card accepting merchants typically have large and sophisticated fraud control measures in place, involving dedicated risk operations staff, machine learning, JavaScript browser fingerprinting and so on. The goal being to spot repeat fraudsters and deny their transactions. Too many false positives and legitimate customers who want to pay for your product cannot, limiting your market. Too many false negatives and you can lose significant money to chargebacks, which may arrive weeks or months after the product or service has been delivered.

	Unsurprisingly, many merchants choose to outsource this arduous process to a third party like PayPal, Google Checkout and so on. However all these services add their own policies, fees and often do not provide any guarantees of chargeback protection.		Unsurprisingly, many merchants choose to outsource this arduous process to a third party like [[PayPal]], Google Checkout and so on. However all these services add their own policies, fees and often do not provide any guarantees of chargeback protection.

	=== Risks involved in online banking ===		=== Risks involved in online banking ===

Sgornick: Add See Also section with entries for In-store Transactions and How to accept Bitcion, for samll businesses articles.

2012-05-17T02:17:05Z

Add See Also section with entries for In-store Transactions and How to accept Bitcion, for samll businesses articles.

← Older revision		Revision as of 02:17, 17 May 2012
Line 83:		Line 83:

	Unfortunately engineering such systems is non trivial and the technical difficulty places this solution out of reach for most traders right now. In future easy to use software libraries, documentation, examples and managed hosting providers that sell TC enabled hardware may increase its attractiveness.		Unfortunately engineering such systems is non trivial and the technical difficulty places this solution out of reach for most traders right now. In future easy to use software libraries, documentation, examples and managed hosting providers that sell TC enabled hardware may increase its attractiveness.

			==See Also==

			* [[In-store Transactions]]
			* [[How to accept Bitcoin, for small businesses]]

			[[Category:ECommerce]]

D'aniel: typo

2012-05-17T01:53:16Z

typo

← Older revision		Revision as of 01:53, 17 May 2012
Line 13:		Line 13:
	# Ensure it is secured to the level specified by the PCI DSS (Payment Card Industry Data Security Standards)		# Ensure it is secured to the level specified by the PCI DSS (Payment Card Industry Data Security Standards)
	# Handle inspections by PCI auditors		# Handle inspections by PCI auditors
	# Be prepared to handle chargebacks, potentially large volumes of them depending on the ~~time~~ of business		# Be prepared to handle chargebacks, potentially large volumes of them depending on the type of business

	A ''chargeback'' occurs when the owner of a credit card disputes a transaction, typically because either they believe you did not deliver satisfactorily, or because the card details were stolen and used by a card fraudster. If a chargeback occurs, the credit card company will take back the money and also fine you. If too many of your transactions result in chargebacks, you will lose the ability to accept credit card transactions and most likely your online business with it.		A ''chargeback'' occurs when the owner of a credit card disputes a transaction, typically because either they believe you did not deliver satisfactorily, or because the card details were stolen and used by a card fraudster. If a chargeback occurs, the credit card company will take back the money and also fine you. If too many of your transactions result in chargebacks, you will lose the ability to accept credit card transactions and most likely your online business with it.

D'aniel: Undo revision 26813 by D'aniel (talk) (forgot "minor edit" tag)

2012-05-17T01:52:55Z

Undo revision 26813 by D'aniel (talk) (forgot "minor edit" tag)

← Older revision		Revision as of 01:52, 17 May 2012
Line 13:		Line 13:
	# Ensure it is secured to the level specified by the PCI DSS (Payment Card Industry Data Security Standards)		# Ensure it is secured to the level specified by the PCI DSS (Payment Card Industry Data Security Standards)
	# Handle inspections by PCI auditors		# Handle inspections by PCI auditors
	# Be prepared to handle chargebacks, potentially large volumes of them depending on the ~~type~~ of business		# Be prepared to handle chargebacks, potentially large volumes of them depending on the time of business

	A ''chargeback'' occurs when the owner of a credit card disputes a transaction, typically because either they believe you did not deliver satisfactorily, or because the card details were stolen and used by a card fraudster. If a chargeback occurs, the credit card company will take back the money and also fine you. If too many of your transactions result in chargebacks, you will lose the ability to accept credit card transactions and most likely your online business with it.		A ''chargeback'' occurs when the owner of a credit card disputes a transaction, typically because either they believe you did not deliver satisfactorily, or because the card details were stolen and used by a card fraudster. If a chargeback occurs, the credit card company will take back the money and also fine you. If too many of your transactions result in chargebacks, you will lose the ability to accept credit card transactions and most likely your online business with it.