Korea Post Office Supports XPCOM Based E-Banking 144
Channy writes "Mozillazine is reporting that the Korean Post Office has decided to support Mozilla Firefox for internet banking and has started the developement project of an XPCOM based internet banking system. From the article: 'In past there were no web browsers for 128 bit encryption except Opera 3.5 for international users when Korea started internet banking services in 1998.'"
Now (Score:2, Interesting)
Also quite the undertaking switching 4700 from windows to linux.
Yay for Korea and Korean memes!
Re:Now (Score:2, Interesting)
Re:Now (Score:1)
Re:Now (Score:5, Insightful)
This is no worse than saying that they should drop support for Safari because it's so sparsely used.
Re:Now (Score:1)
Re:Now (Score:1)
now, 50% of the population is dumber than that...
Re:Now (Score:5, Insightful)
Re:Now (Score:2)
Re:Now (Score:2)
Re:Now (Score:2)
Aww screw it, who are we kidding. You morons would tell someone to ban IE from their website even if it would run them out of business.
Why?
Because you are a bunch of self rightous pricks. Thats it. You get on your high horse and you pontificate on matters which you don't really understand or have any business attempting to infuluence.
But what the hell. This is slashdot. Thrust your hypocritcal ideologies on the shitheap. It doesn't matter. Nobody takes you se
Re: (Score:2)
Re: (Score:2)
Re:Now (Score:2)
Re:Now (Score:2, Interesting)
A better solution, of course, is to have a banking system that is not dependent on the underlying browser architecture.
Re:Now (Score:2)
I can see it now! (Score:5, Interesting)
You: "Well, sir. I think we should block out Internet Explorer users because their browser is unsafe."
Boss: "Is it unsafe for us or them?"
You: "Them. It would'nt really effect us. They are just more likely to become victims of identity theft through a virus."
Boss: "Can they also get the same virus through an email attachment? Or by someone digging through their trash?"
You: "... yes."
Boss: "How many of our customers use IE?"
You: "About 80%"
Boss: "And what is there to prevent them from moving to another bank that DOES support their browser?"
You: "Well, that would be a lot of trouble for them to go through. It's easier to just download a safe browser."
Boss: "And what would we do about the advertisements our competitors would air stating that we don't properly support internet banking because we dropped support for IE? Getting new customers might become difficult."
You: "Well
(Long Pause)
Boss: "While we are at it, why don't we refuse entry to SUVs in the drive-thru ATM because the customer is more likely to scratch his paint and he is wasting the gas he paid for? You should stick to IT, you don't know jack about how a business works. "
Re:I can see it now! (Score:4, Insightful)
Re:Now (Score:2)
Because it is standards-challenged?
Re:Now (Score:2)
You might as well call Firefox 'standards-challenged' because it doesn't support ActiveX*.
* BZZT WRONG THERE IS AN EXTENSION JUST DOWNLOAD AND INSTALL IT AND MAKE SURE NEVER TO UPGRADE FIREFOX WITHOUT CHECKING FOR EXTENSION COMPATIBILITY FIRST
Re:Now (Score:1)
Re:Now (Score:2)
Re:Now (Score:1)
Re:Now (Score:1)
Re:Now (Score:2)
Not that it's unique in that respect.
L
Re:Now (Score:2)
Though they were troubled, they were likely not as troubled as the "Active-x" users.
no need for that (Score:2)
they're not delivering a custom browser or browser content. it's a custom app making good use of Mozilla techs.
Obl. "In Korea ..." (Score:5, Funny)
The kiddies are swapping cvs details over Telnet.
Re:Obl. "In Korea ..." (Score:1)
No Button...anyone persistant and speak Korean?
Great news! (Score:2, Interesting)
Re:Great news! (Score:1)
pouts...
MOD PARENT UP (Score:1, Offtopic)
Microsoft (Score:1, Flamebait)
which korea? (Score:4, Funny)
Re:which korea? (Score:1)
Re:which korea? (Score:3, Interesting)
(You're completely mistaken if you think that North and South Korea would want anything to do with each other. Here's a hint: there's troops on each side of the border between them.)
Re:which korea? (Score:4, Informative)
"It's time for us to put an end to history of dissension, and open an era of national integration. This also means laying the grounds to surmount division, and to ring in a reunified era ruled by peace and prosperity."
- South Korean President Roh Moo-hyun [bbc.co.uk]
Sure, there's some tension there, but I think saying that they want nothing to do with each other is a bit much. That'd be a better characterization for Pakistan and India, where some of the people actually dislike each other. I don't think the North and South Korean people actually dislike each other, but one group just happens to be ruled by a crazy dictator.
Re:which korea? (Score:3, Interesting)
I agree with you there. However, there is the HUGE problem of the North Korean dictator that is know for having pretty bad human rights violations. I doubt many South Koreans would vol
Re:which korea? (Score:1)
Re:which korea? (Score:5, Funny)
Re:which korea? (Score:1)
Re:which korea? (Score:2)
And they have javascript menus that work flawlessly in Opera. I love North Korea!
Re:which korea? (Score:2)
Re:which korea? (Score:1)
Re:which korea? (Score:2)
L
Re:which korea? (Score:2)
p.s. seems i lost karma on my original post due to the combination of funny and overrated
Support for Firefox???? (Score:3, Insightful)
My bank doesn't "support" firefox, but it works great.
Re:Support for Firefox???? (Score:2)
Re:Support for Firefox???? (Score:1)
Don't you just love oxymorans...
SEED? (Score:5, Informative)
Re:SEED? (Score:5, Informative)
Re:SEED? (Score:2)
Not quite following... (Score:5, Interesting)
Because they were unable to use 128bit SSL in 1998, they are going to develop internet banking that is dependent on Mozilla XPCOM, instead of taking a cross platform standard SSL approach now?
While Mozilla is ostensibly a better platform to be locked into than Microsoft, is this really a big benefit?
Someone please translate for the layman (me)
Re:Not quite following... (Score:1)
Re:Not quite following... (Score:1)
Re:Not quite following... (Score:1)
Although they did do that with Google (prefetching, anyone?)
Re:Not quite following... (Score:3, Informative)
This explains it nicely (Score:2, Informative)
Re:Not quite following... (Score:5, Informative)
Just as the article mentions, 128-bit SSL wasn't an option when the internet-based banking started on 1998, so Korea had to develop their own standards. Since there are more than 10 million SEED-based certificates issued on this country, changing the whole infrastructure into SSL would be crazy.
Yes, certficates are issued to everybody who needs an on-line banking account, since itself is used as an authentication method. To get a certificate, you have to visit any bank that you have an account, ask them for on-line banking, and they will give you a one-time password for issuing your certificate (valid for one week).
Everything else is handled on-line. Since the authentication system is a national standard, it works with any bank, any credit card company, and I remember it also works on the stock market. You don't need any offline registration to use it on another bank.
The certificate is password-protected, just like any other certificate. I believe the certificate is node-locked. If you want to export/import the key, you need the password associated with the key.
I'm not sure how many of these kind of features are supported by SSL, but even if IE/Firefox/Opera's SSL has more features, I don't think it's a good idea to replace a system that works well. Yes, I hate ActiveX, but I don't want to see 10+ million Korean citizens visit the bank for re-issuing their certificate.
Re:Not quite following... (Score:2, Interesting)
My personal opinion is, that the existing e-banking system in Korea is substandard. ActiveX requires admin on XP to install and most banks install 2-3 other activ
Re:Not quite following... (Score:2)
Re:Not quite following... (Score:2)
Is there a STANDALONE xpcom release? (Score:2)
Mozilla is quite infamous for bundling everything (and the kitchen sink) into one. Only OpenOffice is worse...
Re:Is there a STANDALONE xpcom release? (Score:4, Informative)
Re:Is there a STANDALONE xpcom release? (Score:2)
I'd like to be able to build and test a modern xpcom independently, so that various mozilla-based browsers and e-mail programs can be built using it instead of each using its own with its own unique set of bugs...
Finally, there is no release of XPCOM standalone -- nothing on the FTP site and the download instructions on the p
Re:Is there a STANDALONE xpcom release? (Score:2)
Especially in the way these programs are packaged now, you cannot upgrade them (and Gecko) independently. Configuration management in a business network has also been made even more complicated.
I like integrated software. Users often like it, too. Especially in the field of open source and non-M$ software, as integration between different programs is often a lot weaker than integration within such a large package.
Post office (Score:5, Interesting)
I don't understand what is meant by this (Score:2)
Secondly unless someone has built a SOAP bridge into Firefox, XPCOM runs strictly in-process. It's quite possible someone has built such a bridge, but XPCOM itself is mostly ignorant.
So if all
People, listen to what you're saying! (Score:2)
The whole point of using a native ActiveX or XPCOM DLL is so you don't have to send your password over the network unencrypted. So why would you use an unencrypted SOAP network service to encrypt data you didn't want to send over the net? What bank in their right mind would do that?
The AJAXian alternative would be to implement the
Re:People, listen to what you're saying! (Score:2)
Either way, ActiveX and plugins should be regarded as the final solution. It is possible to talk SOAP over SSL (if need be), or implement something with basic HTML with a bit of JS. Lots of banks do it and both IE and Firefox
Ok this is what we need (Score:2)
That is why Microsoft have made IE so full of holes isn't it?
Re:Internet explorer (Score:1)
Re:What's the point of the encryption? (Score:2)
Hummmmmm. And what none MS keylogger is there? In fact, what none MS virus/worm is there that is causing any real issue? Not just logged, but actually causing a problem?
the amount of time it takes to decrypt even the newest encryption methods is relatively trivial, so what's the point of encryption for anyone on the planet?
Really? So what solution do you have that allows for 2048 bit key RSA to be solved in this year? In fact, lets make it 128 bit.
Re:What's the point of the encryption? (Score:2, Informative)
I work IT department at a major university. Our servers are probed relentlessly. If we don't stay up on the patches, we will get 0wn3d rather quickly.
I can't tell you how many times some boneheaded student who thinks he is the alpha geek comes to school with his Gentoo or Fedora box, plugs it into his dorm room's ethernet jack, and then proceeds to get owned becuase he doesn't know jack about securing his box. Within a rather sho
Re:What's the point of the encryption? (Score:2, Funny)
Re:What's the point of the encryption? (Score:2)
Re:What's the point of the encryption? (Score:2)
Re:What's the point of the encryption? (Score:2)
Uh, no.
Mod parent up! (Score:2)
128 bit encryption in AJAX?! Mod parents way down. (Score:2)
Are you proposing implementing the encryption on the server side, and sending passwords over the net unencrypted?
Or are you suggesting they implement the 128 bit encryption algorithm in JavaScript?
-Don
Re:128 bit encryption in AJAX?! Mod parents way do (Score:2)
Re:128 bit encryption in AJAX?! Mod parents way do (Score:3, Informative)
Please read (and understand) the article before posting, next time.
By the way, AJAX is not the solution to every problem.
-Don
Re:128 bit encryption in AJAX?! Mod parents way do (Score:2)
In old browsers. My Firefox does support it, and has since there even was a Firefox. And what old browser is going to have xpcom?
If you're going to force them to use a new browser anyway, why lock yourself in more than you have to?
Please read, and understand, and THINK about the article before posting.
Re:128 bit encryption in AJAX?! Mod parents way do (Score:2)
Old browsers didn't support 128 bit encryption, so Korean banks developed their own encryption algorithm (SEED), which all their financial services now use. Firefox does not support SEED, but Internet Explored does support SEED via an ActiveX control.
If Firefox supported ActiveX controls, then Firefox would support SEED, but it doesn't. The 128 bit encryption built into Firefox will not solve their problem, because they need to use S
Re:128 bit encryption in AJAX?! Mod parents way do (Score:2)
They need SEED before 2000, because of restrictions on exporting 128-bit encryption. They don't need it anymore. And I can't believe it's taken them five years to develop an XPCOM app, and nevertheless, it seems to be available for the brand-new Firefox.
Well, true, all TFA says is "128bit enabled browser didn't be exported out of US by US laws before the year of 2000." Yeah, I wonder if a native Korean wrote that? Anyway, there's currently no reason to stick to SEED, unless there are ul
Re:128 bit encryption in AJAX?! Mod parents way do (Score:2)
Yes they do need SEED. No they are not going to switch the entire country of Korea over to SSL and reissue millions of certificates this afternoon because some Firefox evangelist who still lives with his mom thinks they should.
Yes you have certainly missed some obvious facts.
-Don
Mod parent up too! (Score:1)
Re:who cares (Score:3, Insightful)
Perhaps MS should include XPCOM in IE? There's nothing stopping them, really.
Misinformation about ActiveX/DCOM (Score:3, Informative)
The ActiveX Specification [opengroup.org] is freely available for anyone to implement. In case you didn't know, XPCOM is just an open source knock-off of ActiveX, with enough gratuitious changes to make them incompatible in practice. But essentially, they're the same thing.
XPCOM is no more secure than ActiveX. They both have total access to your computer. It's irresponsible of you to spread the misinformation that XPCOM is more secure t
Re:Misinformation about ActiveX/DCOM (Score:1)
Gecko is ment to run on non-windows system aswel as on windows, making use of the windows api in linux is about as good as using POSIX on windows.
To add activeX to gecko's windows codebase would just spilt the userbase.
Re:Misinformation about ActiveX/DCOM (Score:3, Informative)
They are both systems for defining interfaces that hide the way you implement services. ActiveX says nothing about which API you use to implement the interfaces with. The whole point of ActiveX and XPCOM is to separate interface from implementation.
ActiveX runs on MacOS, OS/X, Linux, Unix, without any Win32 api dependencies, and on Windows, where you can develop ActiveX controls with or without Win32 and MFC dependenceis.
I don't
Re:Misinformation about ActiveX/DCOM (Score:2)
Re:Misinformation about ActiveX/DCOM (Score:3, Interesting)
-Don
The Open Group Releases COMsource 1.1 [opengroup.org]
Menlo Park, CA. 10 January 2001 -- The Open Group has just released COMsource version 1.1, an enhanced version of the existing version, COMsource 1.0. COMsource is an open systems implementation of Microsoft's Component Object Model (COM) middleware developed for the Windows TM platform that extends the COM middleware infrastructure to UNIX TM. COMso
Re:who cares (Score:1)
Microsoft could propose a new format the specifications of which they intend
Slashdotters make Microsoft cry (Score:1)
Re: (Score:2)
Re: (Score:2)
Re:who cares (Score:3, Insightful)
Anyone in Korea that cares about cross platform compatibility of their banking and other related applications.
Because as other posters and the article itself pointed out, the banking industry is already standardized on using SEED instead of SSL. Presumably changing that would be a tougher undertaking. Besides, XPCOM could work in any browser and any platform if
Re: (Score:3, Insightful)
Re: (Score:2)
Re:This is suicide (Score:3, Insightful)
Many open standards begin life implemented by only one vendor. Even HTML, for that matter. ^_^
The point is that, when this SEED thing was developed, the Koreans couldn't make use of the already existing standards. So they pretty much had to design and then implement their own standard. It's good that they're adding implementations to multiple platforms.