Slashdot Mirror
Korea Post Office Supports XPCOM Based E-Banking
Channy writes "Mozillazine is reporting that the Korean Post Office has decided to support Mozilla Firefox for internet banking and has started the developement project of an XPCOM based internet banking system. From the article: 'In past there were no web browsers for 128 bit encryption except Opera 3.5 for international users when Korea started internet banking services in 1998.'"
All they need to do is DROP support for IE.
Also quite the undertaking switching 4700 from windows to linux.
Yay for Korea and Korean memes!
The kiddies are swapping cvs details over Telnet.
Mongrel News all the news that fits and froths
Great news, does this mean they will be including a "get firefox" icon on their website?
Linux Video Tutorial Project, Tutoring the masses.
Anything that helps take market share away from Microsoft...
is this north korea south korea or both?
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
You know... [[insert IE bash here]]
Next week, on slashdot, Pimp-my-Anything-but-microsoft...
E = m * c^(Hammer)
All you need to do is support a standard web browser (without requiring activeX crap to work), and firefox works fine.
My bank doesn't "support" firefox, but it works great.
The article is a little ambiguous - this seems to be only for SEED, a Korean only strong encryption algorithm, which itself isn't native to browsers, which is why they required activex in the first place.
Who cares that they are creating an XPCOM piece of shit? Why dont they just make a web-based thing that would work for all browsers. And seriously, you people are such hypocrites. XPCOM doesnt work on IE, and activex doesnt work on Firefox. So that instantly makes Firefox better? Give me a break.
Not your average
It's the thought that counts...
Microsoft is like...no, it's much worse.
Because they were unable to use 128bit SSL in 1998, they are going to develop internet banking that is dependent on Mozilla XPCOM, instead of taking a cross platform standard SSL approach now?
While Mozilla is ostensibly a better platform to be locked into than Microsoft, is this really a big benefit?
Someone please translate for the layman (me)
Replace "Koreans" with any other modern country, and see if the same statement doesn't fit. Also, keylogging isn't a Windows-only problem.
Despite spikes in complexity, the amount of time it takes to decrypt even the newest encryption methods is relatively trivial, so what's the point of encryption for anyone on the planet?
The Earthlings are mostly made of carbon, so they would burn pretty quickly -- or they will once the sun starts to fizzle out and completely engulf the Earth... so what's the point to being alive?
--
"pain is weakness leaving the body."The Koreans are mostly living in cities, so they are probably loaded down with thugs -- or they will be, once it pays to load them down with thugs who beat people up for their passwords.
What's the point of the keyloggers? They still lose.
Mozilla is quite infamous for bundling everything (and the kitchen sink) into one. Only OpenOffice is worse...
In Soviet Washington the swamp drains you.
Hummmmmm. And what none MS keylogger is there? In fact, what none MS virus/worm is there that is causing any real issue? Not just logged, but actually causing a problem?
the amount of time it takes to decrypt even the newest encryption methods is relatively trivial, so what's the point of encryption for anyone on the planet?
Really? So what solution do you have that allows for 2048 bit key RSA to be solved in this year? In fact, lets make it 128 bit.
I prefer the "u" in honour as it seems to be missing these days.
He's an asshole, but he's right this time. Why not use AJAX? Not just to support IE, but to avoid installing software on the local machine...
Don't thank God, thank a doctor!
Surely you jest. Ever heard of rootkits, buffer overflow exploits and the like?
I work IT department at a major university. Our servers are probed relentlessly. If we don't stay up on the patches, we will get 0wn3d rather quickly.
I can't tell you how many times some boneheaded student who thinks he is the alpha geek comes to school with his Gentoo or Fedora box, plugs it into his dorm room's ethernet jack, and then proceeds to get owned becuase he doesn't know jack about securing his box. Within a rather short period of time, these boxes are relaying spam (we block outgoing port 25 now) or have become a zombie host for some script kiddie's botnet on IRC.
Windows is definitely a problem too, I certianly don't want to gloss over that, but you said non-MS doesn't get viruses.
... that South Korea was going to be calling X-COM for something, but nooo...
A 128 bit RSA public key can be trivially reversed. Perhaps you mean an RC4 or AES block cipher?
http://www.mozilla.org/why/framework.html
I prefer none without the e, thank you. Both of your statements were addressed in replies to you by Anonymous Cowards. I hope that answers your question.
--
"pain is weakness leaving the body."It's a good question.
No, I don't jest. The amount of issues that arises with VIRUSES and Keystroke Loggers on none-MS are NIL. As to worms/Rootkits/Buffer Overflows, yes, they do occur. The question is how much a problem is it? Very minor. As to the number of zombies, I used to work on a system that monitored OC-48s. We had several systems installed in several RBOCS (letting them see what traffic was going through, as well as selling to several agencies). One of the trivial things that we did was to pull stats for these. They showed that nearly all of the zombies that were sending were Windows boxes (better than 99.7%, which is interesting in that Windows accounted for less than 83% of all traffic). One of the things that our box did was to ID what type of system the packet was from.
For all intense purpose, all your spam, virus, and worms are coming from Windows boxes.
Obligatory cheers to Opera 3.5, the first browser to support 128-bit SSL
In case you were wondering, most bills are paid at the post office in Korea.
-DB-
E-mail is like a prison: a prison with no walls... and no toilet. -Strong Bad
They aren't supporting firefox, they are just not supporting other browsers. I will be terrible to see when everyone becomes locked in to firefox. Free software is about freedom and compatibility. This will be neither.
...and that is all I have to say about that.
http://jessta.id.au
"Mozilla is quite infamous for bundling everything (and the kitchen sink) into one. Only OpenOffice is worse..."
I believe OO has a dinette and washer/cryer set in theirs.
"the amount of time it takes to decrypt even the newest encryption methods is relatively trivial"
Uh, no.
The perfect sig is a lot like silence, only louder
Are you proposing implementing the encryption on the server side, and sending passwords over the net unencrypted?
Or are you suggesting they implement the 128 bit encryption algorithm in JavaScript?
-Don
Take a look and feel free: http://www.PieMenu.com
Oh yeah, I can see you at the board meeting now:
... we tell them that it is foolish of them to use Windows and Internet Explorer and that they should switch to something else."
You: "Well, sir. I think we should block out Internet Explorer users because their browser is unsafe."
Boss: "Is it unsafe for us or them?"
You: "Them. It would'nt really effect us. They are just more likely to become victims of identity theft through a virus."
Boss: "Can they also get the same virus through an email attachment? Or by someone digging through their trash?"
You: "... yes."
Boss: "How many of our customers use IE?"
You: "About 80%"
Boss: "And what is there to prevent them from moving to another bank that DOES support their browser?"
You: "Well, that would be a lot of trouble for them to go through. It's easier to just download a safe browser."
Boss: "And what would we do about the advertisements our competitors would air stating that we don't properly support internet banking because we dropped support for IE? Getting new customers might become difficult."
You: "Well
(Long Pause)
Boss: "While we are at it, why don't we refuse entry to SUVs in the drive-thru ATM because the customer is more likely to scratch his paint and he is wasting the gas he paid for? You should stick to IT, you don't know jack about how a business works. "
Remember folks, slashdot doesn't have a -1 "disagree" moderation!
hummmm. Actually, I was thinking of AES. Brain fart, I guess. Thanx.
I prefer the "u" in honour as it seems to be missing these days.
The ActiveX Specification is freely available for anyone to implement. In case you didn't know, XPCOM is just an open source knock-off of ActiveX, with enough gratuitious changes to make them incompatible in practice. But essentially, they're the same thing.
XPCOM is no more secure than ActiveX. They both have total access to your computer. It's irresponsible of you to spread the misinformation that XPCOM is more secure than ActiveX, when it's not. It doesn't help anyone to have a false sense of security based on well meaning hype and uninformed cheerleading.
You're right that both ActiveX and XPCOM are more functional than AJAX (for some definition of the word "functional" -- in the sense that it has more client side functionality).
Perhaps Firefox should include support for ActiveX? There's nothing stopping them, really. So then it wouldn't have been necessary for to write a special XPCOM control, since they could have used their original ActiveX control.
Oh yeah, I forgot, it's more important for Firefox to make a rhetorical point by excluding ActiveX support, than to serve the needs of its users. That's called cutting off your nose to spite your face.
-Don
Take a look and feel free: http://www.PieMenu.com
Isn't 128 bit encryption already provided via SSL? So if you have to, you send passwords over the net, encrypted?
Don't thank God, thank a doctor!
Please read (and understand) the article before posting, next time.
By the way, AJAX is not the solution to every problem.
-Don
Take a look and feel free: http://www.PieMenu.com
In case you haven't been paying attention, the whole point of this plug-in is to work around the problem that 128 bit encryption is NOT provided via SSL.
In old browsers. My Firefox does support it, and has since there even was a Firefox. And what old browser is going to have xpcom?
If you're going to force them to use a new browser anyway, why lock yourself in more than you have to?
Please read, and understand, and THINK about the article before posting.
Don't thank God, thank a doctor!
There's no 'on' position on the Slacker switch!
what solution do you have that allows for 2048 bit key RSA to be solved in this year? In fact, lets make it 128 bit.
Those numbers aren't interchangeable like that. 2048-bit asymmetric keys are considerably different than 128-bit symmetric keys because of the math behind them. Saying "Break my 2048-bit encryption! Wait, I'll go easy on you and make it only 128-bit" doesn't work.
Activex makes use of the windows api, so it will work on internet explorer. The second most popular browser is firefox, which, of course, uses xpcom. If 85% of the internet uses internet explorer (correct me if I'm wrong), then what is the point of make the banking system client in xpcom? That's cutting your potential userbase by 85%, which, needless to say, is suicide. Also, if (like some other person said earlier on this topic) only old people use secure banking, this would further cut your userbase, as most elderly folks don't know jackshit about computers, so they won't be downloading firefox. They think that the whole internet resides in that little blue "e" on their desktop. So there ya go. You've just cut about 95% of your potential userbase. Good job Korea!
Not your average
Yeah, I am very aware of all that. I meant to say AES, in which case, 128 will still be non-trivial in its time. However, I let my fingers do the thinking.
I prefer the "u" in honour as it seems to be missing these days.
Secondly unless someone has built a SOAP bridge into Firefox, XPCOM runs strictly in-process. It's quite possible someone has built such a bridge, but XPCOM itself is mostly ignorant.
So if all they're talking about here is writing a DLL or plugin with an XPCOM scripting interface I don't see what the fuss is about. It's hardly a big deal. Personally I'd rather they stuck with HTML, JS and make it work cross-platform by default. Lots of banks manage this using plain old markup with some JS over SSL.
Browser specific code is just evil. It annoys me to see banks using Java, ActiveX, Shock or some other convoluted faff to do the same since they are invariably inferior or easy to break.
Old browsers didn't support 128 bit encryption, so Korean banks developed their own encryption algorithm (SEED), which all their financial services now use. Firefox does not support SEED, but Internet Explored does support SEED via an ActiveX control.
If Firefox supported ActiveX controls, then Firefox would support SEED, but it doesn't. The 128 bit encryption built into Firefox will not solve their problem, because they need to use SEED. They developed SEED because the US government prohibited the export of strong 128 bit encryption at the time Korea deployed their online banking system.
They can't just decide to change their encryption algorithm overnight, so using SSL is simply not an option right now. The ActiveX control solution already exists, and works just fine for 95% of the people. It's nice that they finally support Firefox via XPCOM, but if Firefox supported ActiveX as an option in the first place, then all those Firefox users who needed to do online banking wouldn't have had to wait till now.
ActiveX and XPCOM are similar technologies, and they both have the same security problems and limitations, but they're different enough that somebody has do some programming to repackage the encryption module as an XPCOM control instead of an ActiveX control. If Firefox had an option to support ActiveX at the user's request, then extra effort and delay would not be necessary.
It would take a lot less work to make Firefox support ActiveX, than it would require to rewrite every ActiveX control so it supports XPCOM.
-Don
Take a look and feel free: http://www.PieMenu.com
I would hate to have to capture a Lobsterman Commander everytime I want to make a withdrawl.
The whole point of using a native ActiveX or XPCOM DLL is so you don't have to send your password over the network unencrypted. So why would you use an unencrypted SOAP network service to encrypt data you didn't want to send over the net? What bank in their right mind would do that?
The AJAXian alternative would be to implement the SEED encryption algorithm in JavaScript, and run it in the browser. That's certainly possible, but quite impractical.
If Firefox supported ActiveX as a user option, then there would be no need for a special XPCOM plug-in, and Korean users would have been able to do their banking in Firefox using the ActiveX control that has existed for years now.
ActiveX is just as secure as XPCOM, so why doesn't Firefox support it too? Seems like there's a double standard here.
-Don
Take a look and feel free: http://www.PieMenu.com
Why is this an issue? If people don't like the way Internet Explorer works, why don't they release a virus that targets IE, downloads Firefox, patches it so that it looks like IE, and then uninstalls IE.
That is why Microsoft have made IE so full of holes isn't it?
Scared of flying, pointy things snce 1979!
"They can't just decide to change their encryption algorithm overnight"
Of course they can! Why they shouldn't?
They know that they'll have to go SSL eventually and nothing avoids them having both SSL and SEED deployed in parallel during transition. Then (just an idea) they could deviate non-IE browsers to the SSL implementations so they could real-world test them on a low volume environment. Once they are satisfied they can open 128-SSL to everybody.
Sorry, try again.
They need SEED before 2000, because of restrictions on exporting 128-bit encryption. They don't need it anymore. And I can't believe it's taken them five years to develop an XPCOM app, and nevertheless, it seems to be available for the brand-new Firefox.
Well, true, all TFA says is "128bit enabled browser didn't be exported out of US by US laws before the year of 2000." Yeah, I wonder if a native Korean wrote that? Anyway, there's currently no reason to stick to SEED, unless there are ulterior motives. Maybe SEED is the new Skipjack?
That, or the native Korean has bungled it to the point where I completely missed some obvious fact, like maybe 128-bit browsers still can't be exported? I doubt it, though.
Don't thank God, thank a doctor!
+5, Smart. Not smartass, just smart.
What they'll be delivering, as far as i understand it, is a custom application designed around some Mozilla technologies, mainly XPCOM but perhaps also using the XUL engine for UI.
they're not delivering a custom browser or browser content. it's a custom app making good use of Mozilla techs.
I don't feel like it...
Yes they do need SEED. No they are not going to switch the entire country of Korea over to SSL and reissue millions of certificates this afternoon because some Firefox evangelist who still lives with his mom thinks they should.
Yes you have certainly missed some obvious facts.
-Don
Take a look and feel free: http://www.PieMenu.com