The Melody Shop: security considerations
The problem
The Internet being what it is, there is cause for concern regarding
financial security when it comes to the transmission
of sensitive data such as a credit card number.
We won't talk about the more frightening aspects of
being able to track your purchasing history when you buy with
credit cards, because that's not something peculiar
to the Internet. 1984 has already come and gone.
Many people feel that the risk incurred by financial
transactions on the Internet is not now much greater than
that experienced during a "normal" credit card transaction.
In such conventional transactions there is generally at least
one other person involved who will have access to secret data
like your card number.
How good are the default security procedures?
Web browsers and servers do afford a minimal measure of security
when exchanging some information: data can be passed, while not encrypted,
not as plain text, either. It is "uuencoded". While anyone watching packet
traffic on the network will not see the password in the clear,
the password can be decoded easily enough by anyone who knows what
to look for and catches the right packet.
This method of authentication is roughly as safe as
telnet-style username and password security -- if you trust any of your
data to be on any machine on the Internet, open to attempts to telnet in by
anyone who wants to try, then you have no reason not to trust this
method also. It doesn't matter whether your data are encrypted
in passing or not if the machine where they end up is
not behind a firewall, and that's another whole can of worms.
Not everyone shares this cavalier point of view.
It is undeniable that placing credit card numbers on the Internet makes them
available to a larger number of potential thieves
and other transgressors.
The tradeoffs
Most consumers are protected by their
credit card company which imposes limited or no liability
for fraudulent charges,
especially if the vendor cannot demonstrate delivery of goods
or confirm the authenticity of the order.
This is the advantage to the consumer
of doing business with credit cards instead of cash, money orders or checks.
The advantage to the vendor is immediate cash for authorized transactions.
Vendors have to give back the money only if the goods don't arrive
or are defective (and returned, in the case of physical goods).
The Melody Shop uses the default security features for
your Melody Shop password and your credit card numbers
so that these secret items do not appear in the clear on the Internet.
The Melody Shop does not keep credit card numbers on any Internet
connected machine after processing.
You are protected against unauthorized use of
the card numbers by the credit card company and federal credit regulations
limiting liability.
If you are still concerned about credit card security, leave the
credit card space blank.
Then, after placing your order, call The Melody Shop at
your number here
A real person there will
take your credit card information over the phone, along with
something unique with which you will identify your order.
And The Melody Shop might just give you a call to see if
everything is satisfactory. The Melody Shop insists on happy customers.
Digital Solutions
Suppose we want to send card numbers over the net and
feel good about it?
After all, it's quite convenient.
Commercial WWW servers use sophisticated
techniques to provide
both encryption and authentication.
The vendor is assured that
your order is undeniable, you are assured that packet sniffers
don't see your card numbers and that you are really ordering
something from the ones who are selling.
In financial transactions where
the consumer has limited liability for fraudulent orders anyway, the
advantage to such encrypted transactions is mostly to the vendor,
with little impact on the consumer.
Other solutions
Another option is for you to call the vendor and supply
your sensitive information by voice or fax.
This assumes that fax and voice transmissions are
better hidden from criminals than IP packets.
The vendor can get you to supply a physical address
so that delivery
can be traced (in the case of physical goods) and you cannot deny that you ordered or received the goods.
Similarly, you might get the vendor to supply
a listed telephone number for you to call to make sure
you're giving your card number to someone who's selling what you're buying.
This assumes that the phone company is not in collusion with the bad guys.