W3C Sets Up Web Payments Standards Group To Improve Check-Out Security

campuscodi writes to note that the World Wide Web Consortium has launched a Working Group to help streamline the online "check-out" process and make payment by internet easier and more secure. The proposed standards will support a wide array of existing and future payment methods, including debit, credit, mobile payment systems, escrow, and Bitcoin and other distributed ledger technologies. The group estimates that the new payments API will reach browsers by the end of 2017. For more details, you can consult the Web Payments Working Group Charter, and the group's wiki FAQ page.

Comments

Re:Food stamps

[U2xhc2hkb3QgU3Vja3M]

I much prefer this one, the prizes may be tiny in comparison but the game is fun to play.

Fantastic!

[Anonymous Coward]

In 10 to 15 years we'll have a standard.

Re: Fantastic!

[Anonymous Coward]

Nah, we'll have a standard in about 5, but Google and Mozilla will jump the gun and implement it (badly) in 2, just to show how progressive they are. Then they'll abandon it and put forward their own implementation, which is incompatible. Oh, and it doesn't work on Android yet. Well, it does, but only on the very latest version which you can't install on YOUR device. Again, just being progressive and all that.

And in 5 years they'll end up adopting the standard anyway because that's what everyone will do.

Meanwhile, nobody will touch it with a 10 foot pole until it is supported by IE*, which should happen by 2025, once they iron out the wrinkles on IE12. Oh, and Apple doesn't care either way, so they'll implement once everyone stops bickering...if they feel like it.

Meanwhile, the people who's living actually depend on this shit will do what we've always done: use some third party JS and PHP, liberally sprinkled with some in-house hacks to handle this crap and hope that we don't get hacked too much.

* yes, IE will still be around by then and you'll still have to support it. Despair.

Re: Fantastic!

[U2xhc2hkb3QgU3Vja3M]

Or people will simply continue to use what works today, which are simple PayPal links and Bitcoin wallet addresses.

Re: Fantastic!

[itamihn]

> Oh, and Apple doesn't care either way, so they'll implement once everyone stops bickering...if they feel like it.

You forgot to mention that they will launch in a world event and sell billions of devices thanks to their innovation.

Re: Fantastic!

[FreezerJam]

Looks like a strong overlap with RFC 2801 - http://www.rfc-editor.org/info...

That would be "Internet Open Trading Protocol - IOTP Version 1.0, April 2000"

Re:Food stamps

[laie_techie]

This won't help the poor and needy people who don't have access to debit cards and bitcoin wallets.

We should force rich CEOs to give out debit cards from their bank accounts, so that everyone can be free. It's only fair.

Some states offer a debit card interface for unemployment and food stamps.

Fix the real problem

[CastrTroy]

I say that we should fix the real problem. The real problem is that I have to give my credit card number, or debit card number, or bank routing information to the store that I want to make a purchase from. I would much prefer to have a system, more like PayPal, where I can authorize a payment to an online store and not give them any information that would allow them to access my account to create further payments.

As soon as I submit my credit card number to a store, there's any number of things that could go wrong after that time that would cause my account to become compromised. Doubly so for things like debit cards or account routing information that would cause me to lose money from my actual account.

I'm not saying that PayPal should take over. However, there should be a standard way to make a one-time payment from any financial institution and it should work similarly to PayPal in that the money gets transferred to the seller without giving them any information that could be used to make another transaction that isn't verified by me.

Re:Fix the real problem

[Shadow IT Ninja]

I like Bitcoin as my solution to this problem. I just recently bought some stuff and the site emailed me back my password in clear text. Idiots! That's the point where I was really glad I had paid in Bitcoin.

Re:Fix the real problem

[omnichad]

Get a CC from a bank that allows a one time use virtual CC number. You have a lot of choices, (e.g. Citi, BofA), but there are some downsides in the implementation.

And yes - there are competitors to Paypal, such as Android Pay and Apple Pay. But those only really work for NFC.

Re:Fix the real problem

[Anonymous Coward]

Indeed, the payment info should go the the customer (payment of $X to at ), who then signs it with their private key, sends it on to their bank.

Bank verifies that the signature is valid with the public key, and that the payment isn't a replay (the exact same payment), and that the funds are available; they sign it with their private key, sends it back so it gets to the merchant.

Merchant gets the payment information, verifies the bank's signature with the public key, sends merchandise.

Re:Fix the real problem

[Martin Blank]

The path as shown in the WG's wiki suggests the possibility of this. It provides the option for payment processing to happen on the payee side or on the payor side. Once it gets to "Send Payment Response," the payee has the option of performing processing, and if not, it goes to the payor to be processed, perhaps using a signed, token-based architecture. A payment-complete notification is then sent to the payee, completing the transaction.

This seems like it would fulfill your requirements.

Re:Fix the real problem

[Anonymous Coward]

That's not the real problem. You demand a technical solution to a legal problem. If banks were required by law to refund any unauthorized withdrawals immediately, including all fees, interest etc. incurred (including any you may have had to pay to third parties if the bank declined any cheques / transfers), you just wouldn't have to care. Why should it ever be your problem if your bank permits unauthorized parties to access you account?

Re:Fix the real problem

[radarskiy]

If banks were required by law to refund any unauthorized withdrawals immediately, they would require everyone to use single-use account numbers.

Re:Fix the real problem

[thegarbz]

The real problem is that I have to give my credit card number, or debit card number, or bank routing information to the store that I want to make a purchase from

I just moved to the Netherlands and my first online purchase was met with "Pay with iDeal" as the only option. I freaked out and after I was done I was left thoroughly impressed. It's a bank agnostic payment system processed by the banks themselves with your account. I.e. just like paypal the actual payment is handed over to the financial institute and the store never sees your credit card (or in this direct-debit) details. Then the actual process of paying depends on you bank security (in my case I have the option of SMS verification or using a little card reader with my debit card along with my pin code in a challenge response type situation where I type my pin and their challenge number into a little device and then type the response into the bank's website.

At first I thought it was a pain, but then I thought I really can't think of a more secure system.

Re:Fix the real problem

[John.Banister]

Sure, but you haven't explained how MC & Visa will make 2% of every transaction. If your new, technologically superior payment system doesn't include that feature, they will use their not inconsiderable resources to see to it that anything that pays them more gets used instead.

Re:Fix the real problem

[CastrTroy]

Yeah, it really does seem to be the best solution. Other commenters said that people should just get an account that allows them to generate 1 time use credit card numbers. But that is usually a cumbersome task and requires a lot more effort than most people are willing to go through to make an online payment.

A properly designed customer initiated payment can be almost as simple as using a credit card, and much more secure. Plus there are ways you could allow ongoing/subscription payments, which one time card numbers would be unable to accomplish. One time card numbers are just a hack bolted on to an insecure system.

Re:Fix the real problem

[Lennie]

I've never had the need to (because I'm careful where I use it online) so I don't know if this is true.

But iDeal has no refund, at all.

The band transfers the money and it's gone.

If you don't get what you asked for, you might be out of luck.

Something like Bitcoin would allow for a mutually agreed up on third party to do arbitration with a contract.

Re:Fix the real problem

[thegarbz]

That could be very true but is true of every direct debit / cash / check transaction. Online protection is something provided by individual credit card companies complying with LOCAL credit card laws.

iDeal is generally protected at present since it is unique to the Netherlands, registered businesses, and thus subject to consumer protection laws. This would be quite different if the system is expanded internationally, but again while we're postulating possible solutions a similar such solution could simply be laws requiring the same kind of protection for debit transactions as credit transactions. The specifics of such a law may be more difficult though since you're dealing with actual money and not just fancy number games and loans.

Re:Food stamps

[jellomizer]

Which is the part about bitcoins which is scary. All those questionable bitcoin sources. I had did some calculation, you wouldn't even make minimum wage with these things.
Legit sources of Bit Coins will also offer you normal cash. Which is often still easier to deal with in the real world.

Re:Food stamps

[U2xhc2hkb3QgU3Vja3M]

The goal of these things isn't to make minimum wage, it's to be able to get free fractions of bitcoins in the hopes that it ever gets much higher than it is right now. It did get from 14 cents up to 1200 dollars once, so we never know what might happen in the future.

Re:Food stamps

[KGIII]

When BTC opened up to the world, I mined 48 (I'm pretty sure) BTC on a headless box that chugged away in my 'server closet.' Rather than deal with the taxes, I simply donated them to EFF. They were worth some $11,000+ (total) when I donated them. I'm not sure when/if they cashed them in.

Yes, tax avoidance is legal. Tax evasion is illegal. I didn't feel like dealing with putting them on my tax statements which would be public information and subject to scrutiny as I'm running for the State Senate in 2016. No, the donation will not be written off. Yes, this is legal. No, I don't feel it is immoral.

Anyhow, if the spikes happen and one pays attention (and is not in dire need for funds with an immediacy) then they may well work out for a select few. I'd actually completely forgotten about the BTC's that I'd mined - like completely and totally forgotten until someone here mentioned how much they were worth. I have no idea how long they'd taken to mine. The server had been powered down for years. However, it's not like you can't do other things besides mine them - you don't have to sit and watch the server. It works on its own once configured.