Slashdot Mirror
Online Trust Failing Overall
twitter writes "The BBC and ZDNet are reporting on an RSA poll of 1,000 users about failing confidence in ecommerce. 43% of respondents were reluctant to give details to online sites and 70% said that firms were not doing enough to keep their data secure. The BBC goes on to quote experts who back up the perception, ZDNet claims that action is being taken and is well."
Most people who distrust internet commerce will gladly hand their credit card over to minimum-wage waiters, who disappear into the back room of the restaurant with it for ten minutes. It's all a matter of image and perception.
Have you read my blog lately?
or not taking the security concerns seriously. If you are saving peoples Social Security Numbers and CC Numbers then you should be encrypting that data. Venture to guess how many places actually encrypt that in a database?
But then again i would say most larger places do take these steps. More often than not I won't buy from somewhere I am unsure of or if they are not in the http://www.bbb.org/. Plus, how many people know how to always use SSL when sending sensitive stuff? I would venture my grandparents and mother have no idea.
On a side not to the last statement, i would like to say, office depot does NOT use SSL for their secure communications when you order something from in store.
While I'm somewhat surprised the average user pays attention to such things, I'm not surprised trust is failing in light of recent large scale compromises.
Until the industry as a whole adopts a strategy of preventing compromises, this is not going to improve. Most companies would rather pay a PR guy to fix their image after the fact than a security consultant to keep it from happening in the first place. That's certainly not how I want my information taken care of.
I rarely criticize things I don't care about.
Dear God, ain't this the truth??? I'm a network admin at a large company (please don't ask which), and the password situation here would be laughable if it weren't so sad. I ran LC5 on our hash file here, and was shocked and dismayed at the number of passwords cracked within 10 seconds. I'm constantly finding passwords on sticky notes on monitors and under keyboards, and many users haven't even bothered to change the default Lotus password ('password') to something else! >:(
Last year, a street survey found that more than 70% of people would reveal their password for a bar of chocolate.
That seems to be about the right figure for users in my company.
____
~ |rip/\/\aster /\/\onkey
I like using MBNA bank's credit card number proxy feature whereby you create a onetime use CC# with a limited spending limit to give out online. It's a great feature for paying at Sam's Shady Online Store with a CC# that has a $30 limit and expires in a month.
Here in GA we have ChoicePoint, a company which recently allowed a criminal gang to make off with something like half-a-million IDs.
Only people in California were notified of the leak, because CA has a law requiring notification. Everyone else is going to have to wait 'til their identity gets stolen.
The GA legislature is taking up a bill to require notification of GA residents when their personal information is stolen or accidentally leaked.
Part of the problem, IMHO, is that companies won't tell you when they've shared your information with a non-trusted third party. So, a good first step would be voluntary disclosure.
668: Neighbour of the Beast
I'm not liable for any $$ amount on my credit card or my debit. I'll say, though, I use debit card rather than my credit card. Why? Cause the bank doesn't have as much to lose as the CC company. With the bank it's all your money, with the CC company, it's their's until you pay it back, which means you have one more person in your corner - and with better lawyers, probably ;).
Ladies and gentlemen: this is why you shouldn't trust any legal advice obtained from Slashdot.
All employees must wash hands before seeking equitable relief.