Slashdot Mirror
Korea Post Office Supports XPCOM Based E-Banking
Channy writes "Mozillazine is reporting that the Korean Post Office has decided to support Mozilla Firefox for internet banking and has started the developement project of an XPCOM based internet banking system. From the article: 'In past there were no web browsers for 128 bit encryption except Opera 3.5 for international users when Korea started internet banking services in 1998.'"
All they need to do is DROP support for IE.
Also quite the undertaking switching 4700 from windows to linux.
Yay for Korea and Korean memes!
WHERE is Zonk, and why are you posting this shit in HIS game blog?
The kiddies are swapping cvs details over Telnet.
Mongrel News all the news that fits and froths
Great news, does this mean they will be including a "get firefox" icon on their website?
Linux Video Tutorial Project, Tutoring the masses.
Anything that helps take market share away from Microsoft...
is this north korea south korea or both?
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
You know... [[insert IE bash here]]
Next week, on slashdot, Pimp-my-Anything-but-microsoft...
E = m * c^(Hammer)
All you need to do is support a standard web browser (without requiring activeX crap to work), and firefox works fine.
My bank doesn't "support" firefox, but it works great.
The article is a little ambiguous - this seems to be only for SEED, a Korean only strong encryption algorithm, which itself isn't native to browsers, which is why they required activex in the first place.
The Koreans are mostly running Windows, so they are probably loaded down with keyloggers -- or they will be, once it pays to load them down with keyloggers.
What's the point of the encryption? They still lose.
http://www.thebricktestament.com/the_law/when_to_
Who cares that they are creating an XPCOM piece of shit? Why dont they just make a web-based thing that would work for all browsers. And seriously, you people are such hypocrites. XPCOM doesnt work on IE, and activex doesnt work on Firefox. So that instantly makes Firefox better? Give me a break.
Not your average
Because they were unable to use 128bit SSL in 1998, they are going to develop internet banking that is dependent on Mozilla XPCOM, instead of taking a cross platform standard SSL approach now?
While Mozilla is ostensibly a better platform to be locked into than Microsoft, is this really a big benefit?
Someone please translate for the layman (me)
Mozilla is quite infamous for bundling everything (and the kitchen sink) into one. Only OpenOffice is worse...
In Soviet Washington the swamp drains you.
He's an asshole, but he's right this time. Why not use AJAX? Not just to support IE, but to avoid installing software on the local machine...
Don't thank God, thank a doctor!
... that South Korea was going to be calling X-COM for something, but nooo...
http://www.mozilla.org/why/framework.html
they're gon8e mac
It's a good question.
Obligatory cheers to Opera 3.5, the first browser to support 128-bit SSL
In case you were wondering, most bills are paid at the post office in Korea.
-DB-
E-mail is like a prison: a prison with no walls... and no toilet. -Strong Bad
They aren't supporting firefox, they are just not supporting other browsers. I will be terrible to see when everyone becomes locked in to firefox. Free software is about freedom and compatibility. This will be neither.
...and that is all I have to say about that.
http://jessta.id.au
"Mozilla is quite infamous for bundling everything (and the kitchen sink) into one. Only OpenOffice is worse..."
I believe OO has a dinette and washer/cryer set in theirs.
Are you proposing implementing the encryption on the server side, and sending passwords over the net unencrypted?
Or are you suggesting they implement the 128 bit encryption algorithm in JavaScript?
-Don
Take a look and feel free: http://www.PieMenu.com
Oh yeah, I can see you at the board meeting now:
... we tell them that it is foolish of them to use Windows and Internet Explorer and that they should switch to something else."
You: "Well, sir. I think we should block out Internet Explorer users because their browser is unsafe."
Boss: "Is it unsafe for us or them?"
You: "Them. It would'nt really effect us. They are just more likely to become victims of identity theft through a virus."
Boss: "Can they also get the same virus through an email attachment? Or by someone digging through their trash?"
You: "... yes."
Boss: "How many of our customers use IE?"
You: "About 80%"
Boss: "And what is there to prevent them from moving to another bank that DOES support their browser?"
You: "Well, that would be a lot of trouble for them to go through. It's easier to just download a safe browser."
Boss: "And what would we do about the advertisements our competitors would air stating that we don't properly support internet banking because we dropped support for IE? Getting new customers might become difficult."
You: "Well
(Long Pause)
Boss: "While we are at it, why don't we refuse entry to SUVs in the drive-thru ATM because the customer is more likely to scratch his paint and he is wasting the gas he paid for? You should stick to IT, you don't know jack about how a business works. "
Remember folks, slashdot doesn't have a -1 "disagree" moderation!
The ActiveX Specification is freely available for anyone to implement. In case you didn't know, XPCOM is just an open source knock-off of ActiveX, with enough gratuitious changes to make them incompatible in practice. But essentially, they're the same thing.
XPCOM is no more secure than ActiveX. They both have total access to your computer. It's irresponsible of you to spread the misinformation that XPCOM is more secure than ActiveX, when it's not. It doesn't help anyone to have a false sense of security based on well meaning hype and uninformed cheerleading.
You're right that both ActiveX and XPCOM are more functional than AJAX (for some definition of the word "functional" -- in the sense that it has more client side functionality).
Perhaps Firefox should include support for ActiveX? There's nothing stopping them, really. So then it wouldn't have been necessary for to write a special XPCOM control, since they could have used their original ActiveX control.
Oh yeah, I forgot, it's more important for Firefox to make a rhetorical point by excluding ActiveX support, than to serve the needs of its users. That's called cutting off your nose to spite your face.
-Don
Take a look and feel free: http://www.PieMenu.com
Isn't 128 bit encryption already provided via SSL? So if you have to, you send passwords over the net, encrypted?
Don't thank God, thank a doctor!
Please read (and understand) the article before posting, next time.
By the way, AJAX is not the solution to every problem.
-Don
Take a look and feel free: http://www.PieMenu.com
In case you haven't been paying attention, the whole point of this plug-in is to work around the problem that 128 bit encryption is NOT provided via SSL.
In old browsers. My Firefox does support it, and has since there even was a Firefox. And what old browser is going to have xpcom?
If you're going to force them to use a new browser anyway, why lock yourself in more than you have to?
Please read, and understand, and THINK about the article before posting.
Don't thank God, thank a doctor!
There's no 'on' position on the Slacker switch!
that FrreBSD is
Activex makes use of the windows api, so it will work on internet explorer. The second most popular browser is firefox, which, of course, uses xpcom. If 85% of the internet uses internet explorer (correct me if I'm wrong), then what is the point of make the banking system client in xpcom? That's cutting your potential userbase by 85%, which, needless to say, is suicide. Also, if (like some other person said earlier on this topic) only old people use secure banking, this would further cut your userbase, as most elderly folks don't know jackshit about computers, so they won't be downloading firefox. They think that the whole internet resides in that little blue "e" on their desktop. So there ya go. You've just cut about 95% of your potential userbase. Good job Korea!
Not your average
Do you speak it?
benefits 0f being for the state of BSD's acclaimed about ou7side are having trouble With any sort Hubbard and Mike the future holds implementation to lead developers
Secondly unless someone has built a SOAP bridge into Firefox, XPCOM runs strictly in-process. It's quite possible someone has built such a bridge, but XPCOM itself is mostly ignorant.
So if all they're talking about here is writing a DLL or plugin with an XPCOM scripting interface I don't see what the fuss is about. It's hardly a big deal. Personally I'd rather they stuck with HTML, JS and make it work cross-platform by default. Lots of banks manage this using plain old markup with some JS over SSL.
Browser specific code is just evil. It annoys me to see banks using Java, ActiveX, Shock or some other convoluted faff to do the same since they are invariably inferior or easy to break.
Old browsers didn't support 128 bit encryption, so Korean banks developed their own encryption algorithm (SEED), which all their financial services now use. Firefox does not support SEED, but Internet Explored does support SEED via an ActiveX control.
If Firefox supported ActiveX controls, then Firefox would support SEED, but it doesn't. The 128 bit encryption built into Firefox will not solve their problem, because they need to use SEED. They developed SEED because the US government prohibited the export of strong 128 bit encryption at the time Korea deployed their online banking system.
They can't just decide to change their encryption algorithm overnight, so using SSL is simply not an option right now. The ActiveX control solution already exists, and works just fine for 95% of the people. It's nice that they finally support Firefox via XPCOM, but if Firefox supported ActiveX as an option in the first place, then all those Firefox users who needed to do online banking wouldn't have had to wait till now.
ActiveX and XPCOM are similar technologies, and they both have the same security problems and limitations, but they're different enough that somebody has do some programming to repackage the encryption module as an XPCOM control instead of an ActiveX control. If Firefox had an option to support ActiveX at the user's request, then extra effort and delay would not be necessary.
It would take a lot less work to make Firefox support ActiveX, than it would require to rewrite every ActiveX control so it supports XPCOM.
-Don
Take a look and feel free: http://www.PieMenu.com
I would hate to have to capture a Lobsterman Commander everytime I want to make a withdrawl.
The whole point of using a native ActiveX or XPCOM DLL is so you don't have to send your password over the network unencrypted. So why would you use an unencrypted SOAP network service to encrypt data you didn't want to send over the net? What bank in their right mind would do that?
The AJAXian alternative would be to implement the SEED encryption algorithm in JavaScript, and run it in the browser. That's certainly possible, but quite impractical.
If Firefox supported ActiveX as a user option, then there would be no need for a special XPCOM plug-in, and Korean users would have been able to do their banking in Firefox using the ActiveX control that has existed for years now.
ActiveX is just as secure as XPCOM, so why doesn't Firefox support it too? Seems like there's a double standard here.
-Don
Take a look and feel free: http://www.PieMenu.com
Why is this an issue? If people don't like the way Internet Explorer works, why don't they release a virus that targets IE, downloads Firefox, patches it so that it looks like IE, and then uninstalls IE.
That is why Microsoft have made IE so full of holes isn't it?
Scared of flying, pointy things snce 1979!
"They can't just decide to change their encryption algorithm overnight"
Of course they can! Why they shouldn't?
They know that they'll have to go SSL eventually and nothing avoids them having both SSL and SEED deployed in parallel during transition. Then (just an idea) they could deviate non-IE browsers to the SSL implementations so they could real-world test them on a low volume environment. Once they are satisfied they can open 128-SSL to everybody.
Sorry, try again.
They need SEED before 2000, because of restrictions on exporting 128-bit encryption. They don't need it anymore. And I can't believe it's taken them five years to develop an XPCOM app, and nevertheless, it seems to be available for the brand-new Firefox.
Well, true, all TFA says is "128bit enabled browser didn't be exported out of US by US laws before the year of 2000." Yeah, I wonder if a native Korean wrote that? Anyway, there's currently no reason to stick to SEED, unless there are ulterior motives. Maybe SEED is the new Skipjack?
That, or the native Korean has bungled it to the point where I completely missed some obvious fact, like maybe 128-bit browsers still can't be exported? I doubt it, though.
Don't thank God, thank a doctor!
+5, Smart. Not smartass, just smart.
What they'll be delivering, as far as i understand it, is a custom application designed around some Mozilla technologies, mainly XPCOM but perhaps also using the XUL engine for UI.
they're not delivering a custom browser or browser content. it's a custom app making good use of Mozilla techs.
I don't feel like it...
Yes they do need SEED. No they are not going to switch the entire country of Korea over to SSL and reissue millions of certificates this afternoon because some Firefox evangelist who still lives with his mom thinks they should.
Yes you have certainly missed some obvious facts.
-Don
Take a look and feel free: http://www.PieMenu.com