Exercise 16: Authentication and Encryption systems

1. Visit an e-commerce website and survey the mode of payment allowed.Would you trust the site with your business?


I visited the eBay site of http://www.ebay.co.uk/.

The Mode of payments offered were
- PayPal
- Credit Card
- Personal or Bank cheques
- Money Orders
- Bank Deposit or Bank Deposit Express
- Cash on Delivery.

This is a site I would trust and use for making online purchases because I am a consumer that has bought many items through this site using Paypal and Credit Cards and have not faced any issues at all. All the payments I have made have been secure and trusted.


2. What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?


Trust is key in any relationship or operation. Nothing can function or coexist without it and it stems from the home to business.In the world of e-commerce, earning and providing trust to its all stakeholders especially to its customers is the first step to good business. It takes a life time to forge and can be lost as easy a mouse click.

The following measures can help the customer verify the trustworthiness of a website or business
- Digital certificates from a trusted source.
- Website reviews from trusted sources
- Providing encryption
- Customer reviews from frequent users
- Undisputed and Uninterrupted customer care.
- Provision of contact information or other details that can be used to verify that the seller is authentic.
- Industry membership.


3. Visit the Verisign web site-what solutions does it offer for e-commerce?

What is Verisign?

VeriSign is the leading Secure Sockets Layer (SSL) Certificate Authority enabling secure e-commerce, communications, and interactions for Web sites, intranets, and extranets.

Versign provides SSL certification for authentication. The certification is used to certify the identity of the individuals and website. By using the PKI infrastructure, it is possible to authenticate the website and individual through the certificate and the three way hand-share mechanism.


4. Visit the TRUST web site. Describe what services and solutions are offered.


The TRUSTe web site provides online privacy services for the Businesses such as Enterprises, Small business and for Consumers. They have helped thousands of website and millions of users for protecting their privacy.

Web Privacy Seal Marks companies that adhere to TRUSTe’s strict privacy principles and comply with the TRUSTe Watchdog Dispute Resolution System.

EUSafe Harbor Seal Certifies compliance with the EU Directive on Data Protection, specifically the Safe Harbor Framework, to avoid trade disruptions resulting from international privacy laws.

Email Privacy Seal Reinforces companies’ commitments to good email practices by certifying email disclosures, reputation, and unsubscribe policies.

Trusted Download Program Provides market incentives for ad-ware and other software companies to clearly and unavoidably communicate key functions and obtain informed consumer consent prior to download.

Site Reputation Services Reduces the risk of attack by using technology to scan user-generated or third-party content for potential malicious content before it’s uploaded to a Web site"



5. Get the latest PGP software from http://web.mit.edu/network/pgp.html;install it on two machines and encrypt a message on one machine and decrypt it on the other. Report your findings.


This software is out of date and no longer available.

6. The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft. What others exist?


Some of the validation tools that can be used include:

Wildcard SSL certificate

Authentication logon with a secure USB authentication token

Basic authentication where a username and password is provided for each realm

Digest authentication which is based on challenge – response. This involves the user making a request without any credentials. The server then responds with a WWW-Authenticate header requesting credentials. Instead of sending the clear text credentials, the user sends the Message Digest (MD5) version of their credentials.

NTLM is Microsoft’s own NT LAN Manager authentication algorithm over HTTP. It is similar to MD5 in the way that it works.

Certificate authentication is stronger than other methods. it involves the use of public and private keys to encrypt and decrypt data.

Microsoft passport and other passport methods involve the use of a single set of credentials to sign in to any of the sites that use these passports.

Forms based authentication uses cookies to allow validated users to access parts of a website.