You are placing an order with an online retailer. To complete a purchase, your w

Question

You are placing an order with an online retailer. To complete a purchase, your web browser sends a single encrypted, authenticated message to the web site, consisting only of the following information: a) your credit card information, b) the item number and quantity being ordered.

Say an adversary is sitting between you and the retailer, with the ability to intercept traffic and send messages. Describe an attack the adversary could carry out to “max out” your credit card. What type of attack is this?

What could the retailer do to prevent this attack, simply by changing what data is sent in the single encrypted, authenticated message?

Explanation / Answer

It’s expected that online retail spending will spike during the holiday season, but did you know that 3rd quarter online retail spending increased by 13% in 2011? It’s fitting, then, that as we begin the 3rd quarter of 2012, we recap on e-commerce. Last summer, I wrote an article on ten things you should definitely know about e-commerce, and in the spirit of summer sequels, here’s part two.

Have you ever stopped to consider what makes an e-commerce website successful? Is it good planning? Investment? Good user interface design and consideration of usability? Security? I think it’s a combination of all of these things and more. Beginning with investment and working our way through checkout, I’d like to go through the essential issues that make good e-commerce possible. It’s going to take some time, though, so find comfortable spot and let’s get started, or feel free to hop around the topics as you see fit.

Investment

To do e-commerce well, you need to expect to make a significant investment — in time and money.

As far as time is concerned, a general principle that applies to just about any web development project is that it will probably take more time than you plan for. The more complex a project is, the more unforseens are likely to arise. While the exact timeline will depend upon many factors unique to you — the nature of your business, the size and complexity of your development project, the team you’ve assembled, etc. — I can tell you exactly how long e-commerce projects take for us. A typical website project without e-commerce will take 3-4 months from start to launch, assuming no delays or interruptions. But an e-commerce website project could take that entire time just to prototype. In fact, of the e-commerce projects we’ve worked on in the last year, the quickest prototyping phase was two months and the longest was just shy of four! But despite the range in the prototyping time, in the end, both of those projects took over a year to fully complete.

E-commerce is also expensive. But then, why shouldn’t it be? Aside from the additional operational costs that e-commerce requires, e-commerce development requires significantly more technical expertise to properly plan and implement than development of a typical website. More time + more people + more technical complexity and programming = more cost. But, anything that you expect to makemoney should be expected to take money, too.

Planning…for the Invisible Things

This is a warning, of sorts: I feel a moral obligation to begin this article with some of the fundamental financial, security, and legal matters that are unavoidable and necessary to doing business online. These are the invisible things that make e-commerce possible. They’re not exciting. They’re rife with detail. They’re boring. But you must be familiar with them. That being said, I’m only skimming the surface of these particular issues. Much more could (and should) be said about them — particularly their legal implications — but I am in no position to offer anything even resembling legal advice. I will repeat this later.

If this first section doesn’t contain the sort of info you thought you were getting when you clicked to read this article, fair enough. Go ahead and skip down to “Designing the Right Store.” But promise me you’ll bookmark and come back to this other stuff at some point, or at least look into it on your own. It’s important!

Related Questions

Navigate

• Browse (All)
• Browse Y
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.