Week 12 April 11 e-commerce What's the deal with online viagra sales? That there is no f2f contact with a physician. Is that bad? *Probably*, but this is one of the things that the online world lets us experiment with. What about online pharmaceuticals generally? Potential issues: 1. Age of person placing the order 2. Whether prescription is valid 3. Are drugs legit How has the internet affected these? You can't ask for a conventional ID, so #1 is an issue. But #2 is the real issue. There are ways of handling that. As for #3, in PRINCIPLE the issue is exactly the same for brick-and-mortar drugstores. But it's much easier to get away with scams on the Internet. That bears repeating: It is much easier to get away with scams on the internet. Startup costs can be < $100! ============================================ online gambling overseas credit-card billing Alcohol Tobacco Firearms Can't buy online, EXCEPT from the government Well, you can order a firearm online and have it shipped to a licensed dealer Tobacco: discountcheapcigarettes.com Note "5,2%", with a comma cigoutlet.net All orders are processed and shipped from out of the US. Therefore We don't report tax or customer information to any government agency or other entity. ============================================ How do you trust online stores? Do you? Trust is really a social mechanism. Most of us now recognize the reality of amazon.com, etc. But once upon a time it was "risky". eBay model: trust is built up. buyers provide FEEDBACK, +1/0/-1 sellers' scores are computed using these. One registered user cannot affect a score by more than +/- 1 Buyer trick: register multiple times Seller tricks: * use fake buyers to boost reputation * build an initial reputation, then cash in (this is also a realworld problem!) * How do you trust: brick-and-mortar stores conventional mail order (catalogues + phone lines) store v mail order v phone order v website * will merch be shipped * will quality be as expected * shipping cost * spam * privacy issues * HACKERS GETTING YOUR CREDIT CARD NUMBER ==================================== Technological issues & trust: Old-style PGP (Pretty Good Privacy) trust: You need to verify people's public keys (that the key matches the person). Otherwise you can get a bad key, write them, and be victim of a man-in-the-middle attack. How to do this: Alice needs Bob's key. 1. She can meet Bob at a key-signing party. Bob can give her his key hash. 2. She can ask Chuck. Chuck says Bob's online keyhash is legit. 3. She can NOT trust Chuck, at least about Bob, and ask Dora instead. Dora has never met Bob, but got Bob's keyhash from Ernie, who has. 4. She can ask someone who has a large group of signed verifications of keys. Three of them are signed verifications of Bob's key. SSL certificates (TLS certificates) SSL = secure socket layer, old name TLS = transport-layer security, new name Any pair of entities can negotiate a session key: * each gets others public key * each chooses some bits at random, encrypts with others' public key * exchange these; other side decrypts * now pick one key, or xor them, or concatenate them, or whatever. BUT: how do you know you're not about to give your credit card to a bad guy with whom you've just created a session key? ask landsend.com for cert get it. It includes signatures by well-known CAs. It also includes DNS name. CHECK it by using known public key from one of the CAs. prevents man-in-the-middle attacks won't help if router or DNS is hacked their SSL server uses public-key encryption to sign something with the current date/time; replay isn't feasible either. What does this have to do with TRUST? Do you trust the CAs listed in your browser? Huh? ================================================== Note this is powerless against phishing attacks ================================================== ================================================== Trust: Nissenbaum Trusting your credit card number Trusting the seller How does e-bay deal with trust? E-bay CEO: [most amazing thing is that we've shown N million people] they can trust one another. who do you trust? what do you trust them *with*? plumber => pipes babysitter => kids fear of hackers v insider risks spyware, addins, sony 78% of murder victims know their attacker but most of us make effort to avoid attacks by STRANGERS online "shrinks the range of cues that an act as triggers of trust" Is this true? In practice? If you meet someone online, can you trust that they are who they say they are? Is your risk greater than with f2f meetings? What if you allow more time? Are there "enforceable social norms" (ie enforced by society) against online misrepresentation? To trust is to agree to expose yourself to risk. ===================================================== Jurisdicton online jurisdictional issues: where did the sale take place? This one is big! lawsuit jurisdiction Traditional three rules: * purposeful availment: did defendant receive any benefit from the laws of the jurisdiction? If you're in South Dakota and you sell to someone in California, the laws of California would protect you if the buyer tried to cheat you. * where act was done * whether the defendant has a reasonable expectation of being subject to that jurisdiction ================== sales trademarks libel/defamation criminal law ================================== laws governing sale: seller can sue in his home state/country This is more or less universal. ================================== laws governing trademarks: Trademark scope blue note cafe: NYC The Blue Note, St Louis St Louis blue note won; NY agreed its court did NOT have jurisdiction. St Louis club had a purely passive web site, although it did sell online tickets.