I just started a course in web security, and I was just wondering quickly if SET in any way would use SSL? I noticed it was developed in part by Netscape. But all I can find is comparisons between the two. People are saying that SSL is a more general while SET would have been just for e-commerce, but then they mean that SET would handle everything itself and not use SSL for the link?
$\begingroup$
$\endgroup$
8
-
$\begingroup$ The question's SET seems to stand for Secure Electronic Transaction. $\endgroup$– fgrieu ♦Commented Nov 20, 2019 at 12:43
-
$\begingroup$ When I read the Wiki page about the standard it seems that the protocol is not relying on transport security and uses a separate PKI infrastructure. The protocol itself also seems to minimize the information send between the parties. Of course, a merchant would do well by protecting the browsing experience of the customer regardless, and using SSL is always a good default. $\endgroup$– Maarten Bodewes ♦Commented Nov 20, 2019 at 13:20
-
$\begingroup$ By the way, the SET standard seems to be 22 years old. Commercial cryptography was only really started with the advent of modern computing, say around 1975 when DES was released. So SET is actually closer to the start of commercial crypto than the current day, and seems never to gained any foothold. In other words, that course seems to be completely outdated. The fact that it speaks about SSL rather than TLS is another hint. $\endgroup$– Maarten Bodewes ♦Commented Nov 20, 2019 at 13:44
-
$\begingroup$ The course is fine, he mentiones himself that it is outdated and never really gained any traction. He mentioned it because it's a good concept, and does address some issues we still seem to have today about sharing card information with the merchant aswell. But it was to much work to set up, both for the customer and the merchant. $\endgroup$– PatchingMatchingCommented Nov 20, 2019 at 13:51
-
$\begingroup$ What I found is that SET needs something to supply it with a safe way to transfer it's messages, and while that something isn't required to be TLS/SSL, it's probably the best alternative if it was to be used. $\endgroup$– PatchingMatchingCommented Nov 20, 2019 at 13:52
|
Show 3 more comments