Web Security and Commerce

Credit Cards, Encryption, and the Web

Protecting credit card numbers used in online transactions is the most often-cited example of the need for web security. So let’s look at the typical credit card transactions, observe what the risks are, and see how web security makes a difference.

A Typical Transaction

Consider a typical transaction on the Web: buying a CD from an online music store with your credit card (Figure 1.1).

Figure 1-1. Buying a CD with your credit card over the Internet

In this example, a teenager—call her Sonia—sits down at her dad’s computer, finds a music store on the World Wide Web, and browses the company’s catalog. Sonia finds a rare compact disc that she has been looking for desperately—say, a collection of Led Zeppelin songs as performed by Tiny Tim. She creates an order with the store’s electronic shopping cart, types in her name and shipping address, types in her dad’s credit card number, and clicks an onscreen button in her web browser display labeled BUY-IT. Sonia’s CD arrives in the mail soon thereafter. A month later, her dad gets the credit card bill in the mail. He and Sonia then have a little discussion about her allowance and the fact that she isn’t doing enough chores around the house.

Both the credit card holder (Sonia’s dad) and the merchant face risks in this transaction. For the credit card holder, two risks are obvious and well-publicized: