Category Archives: Security

More Phones than Bank Accounts

What does a bank do if 75 million out of 149 million people (50%) have mobile phones, but only 19 million people (13%) have bank accounts? Monitise says the Central Bank of Nigeria has given the green light to start payments by mobile phone.

Monitise’s technology enables users to securely manage their money on their mobile phones and take advantage of a number of services including:

– Adding money to their handset’s mobile wallet or making withdrawals at a countrywide network of processing agents
– Transferring money to other people or organisations over the handset
– Obtaining their balances via SMS text alerts
– Future services will include savings, insurance and pensions

No word yet on the ability to manage multiple accounts for Advanced Fee Fraud messages. Just kidding.

Telecom growth in the developing world is calling. Aside from the fact that just about anyone can deploy a cellular service in just about any environment (OpenBTS), price/performance of mobile handsets has made them a reasonable investment. There are more users in the developing world now than the developed world, and they have brought a new set of security issues, as I’ve mentioned before.

Mobile banking will likely run into a new issues as well. How will the mobile payment systems handle a one-to-many user ratio for a mobile? A device that is shared among a family, for example, would have to be capable of multi-user account management. Likewise, a single mobile that is offered as a service to a whole village (one mobile owner allowing others to use the mobile for a fee) would have to be well-secured for multi-user data confidentiality and integrity. Mobile manufacturers and developers have been reluctant to address this in the past; they have argued it is easier/better to find a way to push more handsets into the market rather than figure out secure multi-user solutions. That may have to change as high value assets — financial account information — become common in markets with higher one-to-many user ratios.

I imagine a mobile device could be mounted in a box on the street, much like the classic British red box. Village users could step into the box and use it to do their (mobile) banking. That model certainly worked for the developed world as it developed telecommunications. Remember the party line?

Google’s Chrome OS (Not Yet)Viable

Webmonkey has a pleasing write-up on Google’s Chrome OS

Google CEO Eric Schmidt showed up at Tuesday’s event to drive home his belief the time is right to release Chrome OS.

“We finally have a viable third choice for an operating system on the desktop,” he said.

I guess what he is trying to say is that Google is now ready to officially support a Linux distribution — their own? Maybe this does not matter. Apple does not say they officially support a BSD distribution. It is just OS X. I guess what I really find amusing is that the CEO calls it “finally” viable, yet soon after in the same article…

Google admits there is still much work to be done on Chrome OS, and the bug tracking page shows numerous stability problems and hardware shortcomings.

“We’ve made amazing progress but we still have a lot of work to do,” [Product Management VP] Pichia said.

If you want to try it out today, you can join Google’s developer program and install Chrome OS on a wide range of hardware. But as Google VP of engineering Linus Upson said Tuesday, the process is still rather hairy for non-geeks.

“The question is, how comfortable are you compiling from source,” he joked.

Finally!

An unstable operating system with limited hardware support that has to be compiled by source.

Yes, finally, Google has another (not yet) viable Linux distribution. I guess viability is in the eye of the beholder. Does an OS get a higher viability rating based primarily on the number of Chrome applications supported?

When I read Pichia’s statements on this project, relative to the claim of a viable desktop option, for some reason I am reminded Colin Powell presenting to the United Nations on Iraq’s weapons of mass destruction.

In other words, the press release might have more accurately said Google is now purported, or alleged, to be working on a distribution of Linux. Evidence has not yet been found that this OS actually exists as a stable and usable release for desktops.

On the other hand, it could say that the Sun network computing model is finally viable because it now is connected to the Chrome Web Store that has launched already where you can download skins and plug-ins for your browser…err, I mean you can download applications for your browser. I mean operating system. I mean a store that makes your network computing OS viable. You can read the New York Times, for example. Finally.

All that being said, I do have to give the Google credit for forcing *.google.com certificates and secure pages on the Chrome Web Store. Nice touch; it could be a sign of changes to come. Wonder if and when encrypted Google search, etc. will be forced.

PCI Mobile Payment Application Security Standard

The PCI Security Standards Council has released an official statement on mobile payment applications — look for something from them next year. Nothing will be approved before then, but on the other hand they did not say mobile payment applications are prohibited.

The PCI SSC is committed to an ongoing evaluation of emerging payment technologies. The impact of mobile payment technology on the security of cardholder data will be a key focus for the Council in 2011.

Until such time that it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape, the Council will not approve or list mobile payment applications used by merchants to accept and process payment for goods and services as validated PADSS applications unless all requirements can be satisfied as stated.

The payment cards themselves are running pilot programs with mobile payments, as I’ve mentioned before, so expect more updates in the near future.

The Compliance of Bagels

A New York Times review of Bagel articles brings to light a rich history of compliance.

The definition of a bagel is an obvious start.

A bagel is a round bread, with a hole in the middle, made of simple ingredients: high-gluten flour, salt, water, yeast and malt. Its dough is boiled, then baked, and the result should be a rich caramel color; it should not be pale and blond. A bagel should weigh four ounces or less and should make a slight cracking sound when you bite into it. A bagel should be eaten warm and, ideally, should be no more than four or five hours old when consumed. All else is not a bagel.

I dare you to find a specimen that meets even a few of these seven rules of bagel-ness. A true bagel is few and far between. I further dare you to put on a QBA (Qualified Bagel Assessor) hat and ask a bakery….

But wait, there is more. The first reference to a bagel, by Jews living in Poland, also came from compliance.

It is found…in regulations issued in Yiddish in 1610 by the Jewish Council of Krakow outlining how much Jewish households were permitted to spend in celebrating the circumcision of a baby boy — “to avoid making gentile neighbors envious, and also to make sure poorer Jews weren’t living above their means.”

Thou shalt not covet thy neighbor’s bagels.

And last, but not least, fast forward to the American bagel. It was tightly regulated by a union of New York bakers.

The rise of the bagel in New York is inextricably tied to that of a trade union, specifically Bagel Bakers Local 338, a federation of nearly 300 bagel craftsmen formed in Manhattan in the early 1900s.

Local 338 was by all accounts a tough and unswerving union, set up according to strict rules that limited new membership to the sons of current members.

Something tells me that a rule of hereditary bagel-making is not related to the quality of the bagel. Even if it was, it obviously did not work; today’s bagels do not comply with that or any of the above regulations.