NOCA Snake Oil

by Kugutsumen - Jakarta, 12 February 2009.

TL;DR Techcrunch recently published an article entitled "Is NOCA the next Paypal?". The article puts NOCA in the spotlight as a more secure and cheaper alternative to Paypal. In comments, JP, a NOCA employee, claims that his payment system is more secure because it uses ACH transactions:

"On the consumer side, Noca assures security and prevention of identity theft because the transaction avoids credit cards and uses debit transactions instead, where the money goes directly from the buyer’s checking/savings account to the merchant."

NOCA Snake Oil

"If you are an online consumer, Noca offers a new way to shop online that combines complete ease of use with unparalleled security, almost eliminating identity theft."

Does NOCA know what is identity theft?

"Noca stores all production data in a physically secure offsite data center. While PCI (Payments Card Industry Standard) compliance is not necessary since Noca is not storing any credit card information Noca will strive to be at a PCI compliant data center."

This is just silly, having NOCA applications hosted at a PCI compliant data center doesn't make you magically secure.

ACH fraud is a lot more dangerous than credit card fraud.

Most credit cards come with a Zero Liability Fraud Protection, so you don't have to worry too much about fraud. If you have a problem with a charge on your credit card you just complaint to your credit card company and you won't have to pay anything. Incident closed!

That's not the same with debit or ACH fraud, your money is gone! and it might take a long time before your bank acknowledges the fraud and refunds your cash. You'll have to go through a lengthy procedure. According to the Electronic Fund Transfer Act, your maximum liability is 50$ per transaction if you give notice within 60 days or up to 500$ otherwise.

JP@NOCA replied:
"Fraud in checks/ACH is substantionally less than fraud in credit cards. The reason is simple - credit cards don’t require “two way” identification. Doing an ACH transaction requires both transacting entities to have bank level verification as opposed to credit cards. If I have somebody’s credit card info I can commit virtually unlimited fraud. Having somebody check/bank account number doesn’t give me that ability."

Again this is misleading. ACH fraud is easier than credit card fraud, the only thing you need is a checking account number and a bank routing number. ACH doesn't have any security at all.

"Zero cost payment system for Merchants has arrived "

I wouldn't recommend NOCA to merchants; whereas consumers have 60 days to return unauthorized ACH entries, businesses have only 24 hours. The potential for loss is also bigger for the merchants because higher balances are retained in their accounts.

JP@NOCA replied:

"@Kugutsumen I agree with you. Our system is for consumers for now. They get 60 days to dispute any un-authorized transactions."

It would be fun to do a proper security assessment of NOCA.

Grugq > check FTC Kills Dirty Online Check Processing Outfit, more proof that checks + online == bad :

"The Federal Trade Commission today got a US District Court to stop permanently what it called the illegal operations of an Internet-based check creation and delivery service, and to require the group to give up over half a million dollars in ill-gotten gains. According to the FTC, Qchex.com created and sent checks drawn on any bank account that a Qchex user identified, but did not verify whether the user had authority to draw checks on that account. As a result, fraudsters worldwide used the Qchex service to draw thousands of checks on bank accounts that belonged to unwitting third parties. 'The evidence shows that the launch of Qchex.com was a "dinner bell" for fraudsters and resulted in a high number of accounts frozen for fraud...' said District Court Judge Janis Sammartino."

References:

FDIC Law, Regulations, Related Acts

XKCD on Security

" Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)"

Trust issues with iPhone IM Apps

Apple doesn't allow applications to run in the background. A push API will probably be released later this year but in the meantime, if you have an iPhone and you want to use yahoo, msn, google, aim, etc. without logging in and out all the time from Safari either you jailbreak your iPhone and load an open SDK application or you use an IM proxy client such as Beejive, Palringo, Fring, etc.

I have a problem with most of these IM clients. They proxy your connection to Yahoo, MSN, Google Talk, etc. and to do so they keep a copy of your usernames and passwords. They promise you can trust them but there is no guaranty that they won't be hacked. Twitter admin tools were hacked recently and many high profile accounts were compromised. Do they have an information security management system in place? who knows?

This is really wrong! Especially when Google, for example, offers an authentication service for third party applications and services. In a perfect world, IM clients should authenticate with the IM provider directly and then pass the cookie to the third party server. This would prevent companies like Beejive and Palringo from keeping a copy of your credentials, plus it should be possible to authorise their servers to access IM services only -- nothing else. They shouldn't be able to access your e-mail inbox and other sensitive services such as adwords, google checkout, etc. etc.

Another thing that is really annoying with companies like Palringo and Fring is that they seem to hide who they are! When you visit the Palringo website, it doesn't even say which country they are incorporated in, or who they are, but still you are expected to trust them with your usernames and passwords! Nothing on their about page or contact page; extensive digging in the Palringo press centre blog suggests that the company is based in the U.K. where legal requirements have effectively eradicated privacy.

Fring is another company that goes to lengths to obscure their real identity. They hide the fact that they are from Israel. They know people aren't going to read their terms of use and notice that it is governed by the laws of the State of Israel. Some of my friends were shocked when I told them -- they stopped using Fring services and changed their Skype passwords.

In France, we have an informal policy not to trust the UK, Israel and other countries that have a long history of spying on their allies. Recently, French government officials have been banned from using Blackberries because RIM's push e-mail servers in the US & UK keep a copy of everyone e-mail credentials and messages. For similar reasons, most countries discourage the use of Checkpoint Firewall in government and military networks because it's also from Israel.

Palringo and Fring are free to use, yet I chose Beejive, they are based in California, one of the few states in America where privacy law is respected and enforced. Beejive isn't free, at 15$, it's actually expensive for an iPhone app but at least I know they make money. They don't need to sell their users data to some spook agency or some marketing firm to meet their financial targets.

Here are a few recommendation to minimise the risks of using IM proxying services such as Beejive and Palringo.

1/ Never use your main free (google, msn, yahoo...) e-mail account for IM on your mobile phone. You're probably using that account for paypal, amazon, domain registration and many other sensitive services and you don't want that account to be compromised. You should also have a unique password for that e-mail address and never reuse it for other web sites and services.

2/ Create new IM accounts that you will use on your mobile phone and only add the people you want to talk to. You probably have a hundreds of buddies on your main IM account and they will generate a lot of traffic every time their status is updated. This will also optimise your usage if you are not on an unlimited plan.

3/ If your IM client supports OTR, activate it to encrypt communications with your peers and if OTR isn't supported you should harass your vendor to implement it.

4/ This is obvious but you should always assume IM and VoIP are insecure communication channels. If you need real security and confidentiality on your mobile phone, use CellCrypt. It's been developed by competent people and their crypto engine is open source and well documented [snake-oil free].

Kugutsumen