4 ms·

> A fascinating set of circumstances led to Internet Explorer’s dominance in Asian markets. First, early browsers had poor support for Unicode and East Asian ch

> A fascinating set of circumstances led to Internet Explorer’s dominance in Asian markets. First, early browsers had poor support for Unicode and East Asian character sets, forcing website developers to build their own text rendering atop native code plugins (ActiveX). South Korea mandated use of a locally-developed cipher (SEED) for banking transactions, and this cipher was not implemented by browser developers… ActiveX again to the rescue. Finally, since all users were using IE, and were accustomed to installing ActiveX controls, malware started running rampant, so banks and other financial institutions started bundling “security solutions” (aka rootkits) into their ActiveX controls. Every user’s browser was a battlefield with warring native code trying to get the upper hand. Wow. That's... a rather unconventional security architecture.

stinky613 7y ago
Reminds me of Sony-BMG installing rootkits to enforce DRM; and Dell and Lenovo pinning their own root certs. https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo... https://en.m.wikipedia.org/wiki/Superfish https://en.m.wikipedia.org/wiki/Superfish https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-breaking-https https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-...
nemonemo 7y ago
Yep. I still have a Windows machine for banking and gov websites in SK. Things got much better lately thanks to mobile apps and relaxed regulations, but I see Windows-dependency is still strong on some websites.
kbumsik 7y ago
I'm Korean so I glad to see someone speaks out this. Actually it was rather inevitable, partially because of the U.S. gov that time. The Korean gov wanted to grow e-commerce/e-banking in 1999 but the American gov did not allow to export cipher higher than 40 bits. As a result the Korean gov had to develop its own 128 bits cipher (SEED). It was even before AES/SSL/TLS were introduced so the whole crypto stack was implemented using ActiveX. I would say it was quite pioneer in 1999 but since then the gov don't even dare to replace the crypto policies. Now we are stuck at this in 2020.
- zamadatix 7y ago
  SSL had been available in IE since version 2 with Windows 95 it was just the high encryption pack that was export blocked and needed for higher bit ciphers until 5.5 released in 2000. I'm just guessing it was easier to do everything through ActiveX than trying to add the cipher to Windows/IE as a 3rd party. That's amazing it's still used per policy, I never would have imagined. Edit: clarification on which parts were blocked and internationally available.
  - kbumsik 7y ago
    > higher bit ciphers required the high encryption pack until 5.5 released in 2000 That thing exactly was export-restricted and was available only in U.S. and Canada: https://jeffpar.github.io/kbarchive/kb/159/Q159709/ https://jeffpar.github.io/kbarchive/kb/159/Q159709/ But it was true that SSL was introduced before 1999. Thanks for the correction.
    - zamadatix 7y ago
      Yes, sorry didn't mean to make that sound like the high encryption pack was available internationally I meant to point out that was the only component of the built in encryption stack export blocked. Updated the comment to clarify.
- bane 7y ago
  What I think is kind of interesting is that South Korea arguably had/has the technical know-how to have built it's own domestic browser with SEED and good Hangul/Hanja language support built into it and ended up with a very siloed alternative web. As an example, I'm thinking of the ubiquity of the Hangul Word Processor over Microsoft Word (which apparently has been around for over 30 years!) which gained near ubiquity in its domestic market. However, I think the present situation is possibly the better one as a siloed, South Korea only web, separate and distinct from the rest of the Web, would end up being a much harder one to eventually migrate to the regular global web ecosystem vs. the current problem of just getting banks to stop using SEED and moving users to modern browsers.

stinky613 7y ago

Reminds me of Sony-BMG installing rootkits to enforce DRM; and Dell and Lenovo pinning their own root certs. https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.m.wikipedia.org/wiki/Sony_BMG_copy_protection_roo... https://en.m.wikipedia.org/wiki/Superfish https://en.m.wikipedia.org/wiki/Superfish https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-breaking-https https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-...

nemonemo 7y ago

Yep. I still have a Windows machine for banking and gov websites in SK. Things got much better lately thanks to mobile apps and relaxed regulations, but I see Windows-dependency is still strong on some websites.

kbumsik 7y ago

I'm Korean so I glad to see someone speaks out this. Actually it was rather inevitable, partially because of the U.S. gov that time. The Korean gov wanted to grow e-commerce/e-banking in 1999 but the American gov did not allow to export cipher higher than 40 bits. As a result the Korean gov had to develop its own 128 bits cipher (SEED). It was even before AES/SSL/TLS were introduced so the whole crypto stack was implemented using ActiveX. I would say it was quite pioneer in 1999 but since then the gov don't even dare to replace the crypto policies. Now we are stuck at this in 2020.

zamadatix 7y ago
SSL had been available in IE since version 2 with Windows 95 it was just the high encryption pack that was export blocked and needed for higher bit ciphers until 5.5 released in 2000. I'm just guessing it was easier to do everything through ActiveX than trying to add the cipher to Windows/IE as a 3rd party. That's amazing it's still used per policy, I never would have imagined. Edit: clarification on which parts were blocked and internationally available.
- kbumsik 7y ago
  > higher bit ciphers required the high encryption pack until 5.5 released in 2000 That thing exactly was export-restricted and was available only in U.S. and Canada: https://jeffpar.github.io/kbarchive/kb/159/Q159709/ https://jeffpar.github.io/kbarchive/kb/159/Q159709/ But it was true that SSL was introduced before 1999. Thanks for the correction.
  - zamadatix 7y ago
    Yes, sorry didn't mean to make that sound like the high encryption pack was available internationally I meant to point out that was the only component of the built in encryption stack export blocked. Updated the comment to clarify.
bane 7y ago
What I think is kind of interesting is that South Korea arguably had/has the technical know-how to have built it's own domestic browser with SEED and good Hangul/Hanja language support built into it and ended up with a very siloed alternative web. As an example, I'm thinking of the ubiquity of the Hangul Word Processor over Microsoft Word (which apparently has been around for over 30 years!) which gained near ubiquity in its domestic market. However, I think the present situation is possibly the better one as a siloed, South Korea only web, separate and distinct from the rest of the Web, would end up being a much harder one to eventually migrate to the regular global web ecosystem vs. the current problem of just getting banks to stop using SEED and moving users to modern browsers.