Help Net Security talks with an IT expert about what makes a strong password. They conclude that it should be no shorter than 86 symbols. So the way I see it, we have two choices.



1. Create your 86 character password now. Here's an example:



3sqk3hvo9xa

wk3n4ffsiUfxk

wpx92skgnns

w1qQ2hdMjLg

^9T%dsqwdK2

6aZdgvo95d02

kfoeNsPsWau

Us4J3S

2. Eighty-Six (Eliminate) Passwords Completely

That's the one that gets my vote. Think keyloggers care if they have to cut and paste 4 digits or 86? We need to "get smart"...we need to swipe, encrypt, transmit.



From HNS: What makes a strong password?



In 1948 an American mathematician and engineer Claude Shannon entered information entropy term (measurement of uncertainty) in his work "A Mathematical Theory of Communication". If we take, for example, English text, it takes 8 bit (one byte) to represent one symbol. Eight bit allow encoding 256 different symbols. However, there are only 26 characters in English alphabet and they can be easily represented by five bit (32 possible combinations). Consequently, uncertainty of one symbol of an English text makes not 8, but less than 5 bit.



In addition, some symbols and combinations are considerably more frequently used than others. A letter “E” is encountered hundred times more frequently than “Z”, and “U” always follows “Q”. Such peculiarities allow reducing uncertainty even more. According to mathematicians’ evaluation it makes around 1.5 bit per symbol for texts in English.

This means that if information is protected by encryption with 128-bit encryption key, and a password will be an English phrase (without space characters, punctuation marks, and in one register), a really strong password (an oxymoron) should be no shorter than 128/1.5 = 86 symbols.



Speaking about the Internet in general - we won’t escape from passwords in the nearest future. They are habitual and their usage doesn’t require special equipment.



Editors Note: That may be true when it comes to accessing email, but when it comes to securing financial transactions, we can't afford to be messing around with passwords...anymore.

Especially when our device costs less than most "useless" bank promos.

BTW: Did you know that the "P" in Passwords is silent?

Keep It Smart, Swipe!

"However, in business segment passwords will continue to get substituted by two-factor authentication (e.g. smart card/USB Token + password/PIN code).

Though such means of authentication require financial expenditures, they should be paid. (they can afford it...vs. the alternative)

They will guarantee a significantly higher security level

than the one provided by using only passwords."

Is Online Shopping Safe for the Holiday Season?

• Beware of shoulder surfers. Protect credit cards, driver’s licenses and checks from wandering eyes.


• Beware of skimmers. Skimming occurs when a clerk slides your credit card through a second machine to download its information onto a counterfeit card. Remember to keep your eyes on your cards at all times.


• Be aware of your surroundings. Pay extra attention in crowded malls, as pickpocketing numbers noticeably increase during the holidays.


• Minimize purse/wallet contents. Carry only the cards you know you will use.


• Secure your cards. Never leave your purse/backpack/bag unzipped, and keep a hand on it when in crowded stores.


• Use your online shopping smarts. Keep printouts of information detailing your Web purchases. Use a credit card instead of a debit card if possible, and make sure the company’s Website is on a secure server.


• Visit trusted sites. Shopping at trusted Websites or those recommended via secure comparison shopping sites, such as PriceGrabber.com^®, can be a good way to reduce online shopping risks.


• Be careful with personal items when shopping. Don’t leave your laptop; purse; or any item with credit cards, checks, driver’s license or Social Security numbers visible in your car.

• Seventy-six percent of the tech-savvy age 18 to 24 demographic expect to do their holiday shopping in-store.


• A noteworthy 74 percent of respondents age 55 to 64 feel that in-store shopping is safer than purchasing online.


• More than half of individuals age 18 to 24 and older than 65 claim to know someone who has been a victim of identity theft. Forty-four percent of overall respondents make the same assertion.


• Overall, nearly two in 10 people surveyed have personally been victims of identity theft.

This virus is designed to steal online banking passwords and scrape the user's SMS messages. It is basically a phishing attack whereby it dupes iPhone users visiting their online banking website with a "phoney" look-alike to steal their passwords. There have been confirmed reports of this happening in the Netherlands with users accessing ING online banking from their phones.



While these viruses have only targeted the small percentage of iPhones...it does highlight the risks that smartphones will face more and more as they become the tool of choice for consumers to stay connected online. This should not be overlooked by the mobile financial services community and it would be wise for the leaders in this space to begin to offer solutions towards thwarting these types of threats before they become a reality.



Read the Entire Article

British shoppers spend £4.2 billion online in October



Growth in e-retail sales was down by 7% over two weeks, due to postal strikes, according to IMRG Capgemini e-Retail Sales Index.  However, the index saw 11.8% increase year on year and 8.4% month on month in e-retail sales. British shoppers spend £4.2 billion online in October. 



According to the index, delivery concerns had a noticeable impact on online clothing sales with 13.2% growth, which fell short from the average of 27% for the month of October in previous years.  Overall,the Postal Strikes caused a £53m Drop In Online Sales.  (see related article below)



Read Entire Article

SAN JOSE -- Black Friday was a big day for San Jose-based eBay's PayPal division. The payment processing company announced that it 20% more productive this year than it was for Black Friday 2008.



While the company did not release its total payment volume, it claimed that its Payflow Gateway system handles about 25% of e-commerce and its direct sales account for 12% of all e-commerce.



In addition, PayPal noted that one of the main differences from last year was that there was about 140% more transactions made on mobile devices this year.

Interchange fees

Published: November 29 2009 18:50 | Last updated: November 30 2009 09:28

The way retailers pay banks when customers spend on plastic is peculiar. Fees are split: the processing bank takes some, with the bulk going to the bank that issued the card. The large networks – Visa and MasterCard, which handle almost three-quarters of US card purchases – do not make revenues from so-called interchange directly. They instead charge banks individually negotiated licence and processing fees. But it is the networks that set the interchange fee, typically between 1.5 and 2 per cent of a transaction’s value. 



The article goes on to say that the recent GAO Report supports V/MC and refutes the retailers arguments regarding Interchange.  It also points out that meddling governments should stay out of this fight based on the fact that the last time they stepped in, (Australia) it backfired. (see related articles)



Continue Reading (subscription required)

India may soon have a domestic payment card system — a rival to multinational card associations like Visa and MasterCard. The Reserve Bank of India (RBI) is looking into the potential possibility of a domestic payment card which would handle credit and debit card transactions inside that country. This project is strongly supported by Indian banking Association (IBI) which is the leader in Indian Banking.  Here's the report, along with a sampling:



Payments Systems in India - Vision 2009-12



7. New Projects / Major Initiatives

7.1 Major projects intended to be pursued would include -



• India MoneyLine – A 24x7 system for one-to-one funds transfers – The existing NEFT system operates during weekdays from 9 am to 5 pm and on Saturdays from 9 am to 12 noon. The Bank would pursue the suggestion to consider the need to extend NEFT to function on a 24x7 basis or to develop a



Payment Systems in India – Vision 2009-12



• India Card – A domestic card initiative – The concept of a domestic payment card (India Card) and a PoS switch network for issuance and acceptance of payment cards would be looked into. The need for such a system arises from two major considerations (a) the high cost borne by the Indian banks for affiliation with international card associations in the absence of a domestic price setter (b) the connection with international card associations resulting in the need for routing even domestic transactions, which account for more than 90% of the total, through a switch located outside the country.



• Redesigning ECS to function as a true Automated Clearing House (ACH) for bulk transactions – Currently, Local ECS (to facilitate bulk electronic transactions with one-to-many and many-to-one variants) is operational at 76 centres. Centralisation of this process is already underway with the launch of credit variant of NECS at Mumbai (and RECS on a pilot basis). The debit variant is also being planned for implementation. The ECS / NECS solution is internally developed and has been in use since long and the need for building a technology and feature-rich ACH network by totally redesigning the existing ECS to provide end-to-end processing in a straight-through manner would be examined.



• Mobile payments settlement network – Mobile phones are expected to emerge as an important channel for transmission of payment instructions. Efficient mobile payments would require real time transfer of funds with adequate security. Currently all inter-bank mobile transfers are payment instructions for settling funds through existing payment systems. This would require building a national infrastructure for facilitating real time mobile payments.

• The average dollar value that consumers spent per online order rose 35.0 percent year over year, led by apparel retailers.


• Consumers are buying more items per order than they did last year -- by 18.3 percent.


• Consumers are spending considerably less time browsing retailers' sites, suggesting they had done their research prior to Black Friday and that they are shopping from lists.


• Browsing sessions were down by 5.4 percent


• The number of people who left a site after viewing only one page (also known as a "bounce" rate) was up by 39.4 percent


• Page views per session declined by 30.4 percent

• Apparel retailers and jewelry retailers reported the biggest jumps in the average dollar amount consumers spent per online order, up 28.6 percent and nearly 25 percent respectively.


• Department stores did a phenomenal job of attracting new consumers to their sites, reporting a 151.7 percent jump. However, the average dollar amount consumers spent per online order actually decreased by 7.2 percent, suggesting that shoppers may be sitting on the sidelines waiting for more discounts and special offers.


• Sports Gear and Apparel retailers also reported a rise of 54.6 percent in the number of new consumers visiting their sites and a 61.3 percent jump in the number of sessions in which consumers completed an order. But the average dollar amount consumers spent per online order declined slightly by 3.1 percent.

• For the 24 hours of Thanksgiving Day 2009, Mercent reports overall same-seller online retail GMV grew 33% relative to Thanksgiving Day 2008.


• For the 24 hours of Black Friday 2009, Mercent reports overall same- seller online retail GMV grew 41% on Black Friday relative to 2008.


• On Thanksgiving Day, same-seller GMV of Mercent clients participating in Amazon's "Selling on Amazon" third-party marketplace program increased by 78% relative to Thanksgiving Day 2008.


• On Black Friday, same-seller GMV of Mercent clients participating in Amazon's "Selling on Amazon" third-party marketplace program increased by 56% on Black Friday relative to 2008.