5 ms·

This is the (not-so) fun downside of government getting too engrossed in business transactions. Most "good" laws in this area would specify the desired outcome

by scott_w 15y ago

This is the (not-so) fun downside of government getting too engrossed in business transactions. Most "good" laws in this area would specify the desired outcome (secure online transactions), and let people devise their own methods. An analogy: this is like the Korean government mandating banks use a specific model of vault door (Securico 2000), where the rest of the world merely state "banks must ensure vaults are secured to a reasonable standard". If a fault exists in the Securico 2000, most banks will (eventually) update, lest they be sued for negligence in event of someone breaking into the bank and stealing valuable property. Korean banks would be perfectly safe from legal recourse, since they are following state law. Of course, this is not unique to government-mandated technology. Monopoly groups can cause the same distortion e.g. Verified by Visa.

_delirium 15y ago
Downside to government getting involved in business transactions poorly, at least. Denmark has quasi-standardized on a two-factor online security solution, NemID, which works fairly well, and is now used for login to most government services and most banks. Previous to the government getting involved, there were some truly horrid ActiveX and Java plugin solutions in use at most banks. The actual technology is developed by a private company, though; it was selected for implementation by the government, but not developed in-house.
- driax 15y ago
  But let us not forget that it took the Danish Government two tries to get it right. First they tried to push digital signatures on everyone, with the idea that people should use their personal certificate to login to banks and government systems. However the banks would have none of it, because of the bad user interface (ever tried to use client-side certificates in any browser). They then adopted a system that was a mix of systems already in use by a number of banks. Key-cards to be distributed by snail-mail and entered trough a Java plugin. Why they didn't go for a Javascript solutions is sad, but I would guess that some banks (such as Danske Bank) would have trouble adjusting. So the lesson is probably that (some) governments are good at standardizing already (good) practices. PS: Also note that some Companies (like Telmore, one of the largest online shops), who offered the old system (client-side certificates), won't use the new because of the absurd cost associated. (They have to pay per registered user, not by how much each user is using the system)
brazzy 15y ago
> Most "good" laws in this area would specify the desired outcome (secure online transactions), and let people devise their own methods. And anyone who manages to get their method entrenched can grow a de facto monopoly, with pretty much the same result as in this case. At the very least, a "good" law should provide a standard interface and mandate interoperability.

by scott_w 15y ago

_delirium 15y ago

Downside to government getting involved in business transactions poorly, at least. Denmark has quasi-standardized on a two-factor online security solution, NemID, which works fairly well, and is now used for login to most government services and most banks. Previous to the government getting involved, there were some truly horrid ActiveX and Java plugin solutions in use at most banks. The actual technology is developed by a private company, though; it was selected for implementation by the government, but not developed in-house.

driax 15y ago
But let us not forget that it took the Danish Government two tries to get it right. First they tried to push digital signatures on everyone, with the idea that people should use their personal certificate to login to banks and government systems. However the banks would have none of it, because of the bad user interface (ever tried to use client-side certificates in any browser). They then adopted a system that was a mix of systems already in use by a number of banks. Key-cards to be distributed by snail-mail and entered trough a Java plugin. Why they didn't go for a Javascript solutions is sad, but I would guess that some banks (such as Danske Bank) would have trouble adjusting. So the lesson is probably that (some) governments are good at standardizing already (good) practices. PS: Also note that some Companies (like Telmore, one of the largest online shops), who offered the old system (client-side certificates), won't use the new because of the absurd cost associated. (They have to pay per registered user, not by how much each user is using the system)

brazzy 15y ago

> Most "good" laws in this area would specify the desired outcome (secure online transactions), and let people devise their own methods. And anyone who manages to get their method entrenched can grow a de facto monopoly, with pretty much the same result as in this case. At the very least, a "good" law should provide a standard interface and mandate interoperability.