Please enable JavaScript.

Coggle requires JavaScript to display documents.

Payment Mechanisms and Security Aspects - Coggle Diagram

- - - - In summary:
        • There are no guarantees.
        • The transition from traditional commerce supported by paper and agreements sealed with handwritten signatures, towards Electronic Commerce with electronically supported transactions, paper replaced by binary codes and signature by mathematical algorithm, is not easy.
        • Trust must be built.
        
        In advance, at least the following must be ensured:
        • Authenticity
        • Integrity •
        Non-repudiation (you cannot deny that you did the hiring)
        • Confidentiality
        
        Evolution of plastics
        • Payment gateways. (When I buy on the Internet, they give me payment alternatives (plastic), there they send me to the issuer, to the bank or operator, encrypted as SSL, despite this, I can deny the contract).
        • The Electronic Signature, Digital Certificates and Trusted Third Parties.
        • Digital certificates
        
        Electronic Money
        • Plastics operate electronic transactions, on "non-electronic" money.
        • Definition of electronic money (it is information, from paper to electronic (binary) support, it is certified, secure information)
        • Representation of money
        • Characteristic
        • Storage
        
        Characteristic:
        • That which is created, used and spent electronically.
        • The origin of money must be changed to bits.
        • It is prepaid (it is debited from my account).
        • Saved to a hard drive or smart card.
        • It is bought at a Bank and sent to my hard drive or smart card, always as bits.
        
        Electronic Wallet:
        • Safe and effective means for low value purchases, it is a smart card with a chip that has electronic money, which is spent.
        • The bank sells it for real money.
        • I can load the smart card at POS, special ATMs for electronic money, or at traditional ones when they have the service.
        • I can buy in stores, at dispensers and I can pay online.
        
        1 more item...
- - - - Is there an age range to make the purchase?
        In Panama the legal minimum age is 18 years. The usual thing is that if this is not the case, request that the minor have the permission or authorization of their parents or guardians. Please note that one of them will be responsible for their actions on the site. Especially on those sites that are aimed at minors.
        
        What is the product shopping list and how do I make it?
        The personal list is a tool designed to facilitate and speed up the purchase. The way you can create your list is by clicking on the "Add to my list" icon, which you will usually find next to the description of each product that is for sale. Once you have created your list, you will be able to choose the products of your interest, pointing to them with your cart or shopping bag one by one.
        If you wish, you can add your entire list to the cart or shopping bag by clicking on the "ADD ALL LIST TO CAR".
        
        Before finalizing my purchase, can I know what I have added and what is the amount?
        Yes, when you finish selecting the items or services you wish to purchase or contract, the characteristics of each one are shown and specified, and the company will show you a breakdown of your account, specifying the total amount to be paid. Likewise, at this time the supplier will also offer the option of being able to cancel the purchase if you wish.
        
        How do I know that my shopping list was received and accepted?
        At the end of your purchase you will receive a confirmation message or a call from the Customer Service Center to personally confirm your order and personal data. When confirming and verifying your data, you are assigned a number, which was provided via email by the Customer Service Center, which will serve as a guide to know where your purchase is.
        
        How can I track my orders and verify my purchase?
        In the event that your product must be delivered by parcel, the user will be able to track their purchases by typing their tracking number in the search or tracking section. By pressing "accept", a page of the parcel company will appear that will show you the exact route that your order has followed.
        Knowing the status of your order is very simple. In the same way, within this option you will be able to know the following data related to your purchases: date and time of purchase, purchase order number and total amount of the purchase.
        
        If I live in another country, can I buy online to receive the merchandise in my place of residence? Does this merchandise have any extra charge for customs expenses?
        Yes, you can buy from another country, although the online provider is not responsible for customs charges generated by shipments abroad. Such charges may vary from country to country and are the responsibility of the recipient of the product. Make sure that the provider presents at least your location data such as physical address, telephone, fax. It is also suggested to verify the country of origin of the site where you are buying, since there are territorial codes (example: http://www.xxxxx.com.ar which means Argentina), another characteristic that you must verify is that a center is offered where to direct your claim in the event of any problem.
        
        Can I buy from another country to give to someone who lives in Mexico?
        Yes, as long as there is a physical address, as well as a person responsible for receiving the product(s).
        
        Can I return the product I bought?
        Yes, only restrictions apply (depending on the product and delivery status).
        
        In the case of purchases between individuals and/or auctions: what precautions should I observe and who is responsible for the operation?
        You should look at the sales history of the person you are buying from and the comments made by some of the previous buyers.
- - - - Generation of an electronic receipt: This is the next step to follow after verifying the payment online is confirmation of the order through a receipt that can be printed by the customer.
        
        Reception and delivery of orders: Generally, an alert is programmed, which indicates to the owner of the site at the moment that a client makes an electronic purchase so that it can be dispatched as soon as possible.
        
        Order tracking: This step is required to offer customers an additional service that allows you to see how the order process is going (tracking) and to know when you will receive your order.
        
        Special needs of electronic businesses Electronic commerce is the definition of a process, however electronic businesses are successful above all thanks to the attention, services, relationships and work of real people, who collaborate in different steps of the sale electronics.
        
        Payments by email
        This system allows the user to register only once with their bank account or credit card and later order payments anonymously charged to that account or card. These subscriptions are simply ordered by supplying an email address of the firm or person you want to receive the money. The intermediary is responsible for notifying the beneficiary by sending a message over the Internet.
        The drawback is the need for the buyer to have previously opened an account in the system. Almost always it will also be necessary for the person who is going to receive the money to also register in the system.
        The best known of these systems is PayPal [ http://www.paypal.com/ ] which is part of the eBay group and is therefore widely used by customers of this auction system and, in general, for transactions between individuals. (P2P, person to person). PayPal boasts of having more than 40 million users.
- - - - They are useful in B2B.
        An example are: CHEXpedite, Western Union MoneyZap.
        Electronic bill presentment and payment systems
        Systems used to pay routine monthly bills that allow users to electronically view their bills and pay them by electronic fund transfers from bank accounts or credit cards.
        These services support payment for purchases of goods and services online and in physical stores after the purchases have been made.
        Some of these services, like CheckFree, consolidate subscribers' bills from multiple sources so that they are paid in one lump sum.
- - - - Is Internet Commerce Safe?
        One of the issues that is unavoidable to comment on today when talking about the Internet, and the possibility of conducting business on the network, is the issue of security. Popular knowledge indicates that the Internet is "insecure", but little or no explanation has been given as to why.
        First of all, it is important to explain what are the security aspects that need to be considered when entering the "virtual" world of the Internet.
        A fact commonly forgotten by Internet detractors is that the use of a credit card in a "traditional" purchase sometimes implies a risk, since the employee of the bookstore, in this case, the restaurant or other business in other cases , you can write down our name, credit card number and expiration date, copying it from the "voucher", once we have left the establishment.
- - - - USER OBLIGATIONS:
        The user's obligations derived from this contract are the following:
        
        The obligation to use the website, only to make legitimate purchases or reservations and for personal use and enjoyment or that of a third party that has expressly authorized it, not speculative, false or fraudulent reservations, nor any reservation in advance. of demand.
        
        The obligation to be financially responsible for the use of the website.
        
        The obligation to cover all charges, fees, rates and impositions that arise as a direct or indirect consequence of the use of this website.
        
        The obligation not to assign, transmit, transfer, assign, license or sub-license in any way the rights arising from the use of this website.
        
        The user acknowledges the copyright as the absolute and exclusive owner of the entire content of this website, as well as the brands advertised and/or used in it.
- - - - On the other hand, public key encryption methods or asymmetric codes consist of the creation of two related keys for each user. One will be kept private and the other is placed in a public area.
        When a user wants to send a confidential message to another user, they encrypt the message with the recipient's public key, and then the recipient decrypts the message with their private key. Messages encrypted with a public key can only be decrypted with a private key.
        
        Data Encryption
        Encryption can be understood as the fact of keeping something valuable inside a locked safe. Sensitive data is encrypted with an encryption algorithm and key that makes it unreadable if the key is not known. The data encryption keys are determined at the time of making the connection between the computers. The use of data encryption can be initiated on your computer or on the server you connect to.
        Network Connections supports two types of encryption:
        
        Microsoft MPPE, which uses RSA RC4 encryption.
        
        An implementation of Internet Protocol Security (IPSec) that uses Data Encryption Standard (DES) encryption.
        
        La norma de cifrado de datos DES (Data Encryption Standart) es un esquema de cifrado de claves privadas desarrollado por IBM en los años 70, que fue adoptado por la Oficina Nacional de Normalización, actualmente conocida con el nombre de NIST (Instituto Nacional de Normalización y Tecnología). Esta norma se ha evaluado durante muchos años y había sido considerada sólida, hasta que fue roto en dos ocasiones durante 1997, con lo cual, sus días parecen ya contados. El propósito de cualquier programa de cifrado es asegurar la comunicación privada.
        
        The need to hide the meaning of a message so that only the recipient can understand it is very old. It is an elementary military necessity. There is news of its use more than three thousand years ago in Egypt and some elementary systems used by Julius Caesar are well documented. We will use the expressions encrypt, codify and encrypt interchangeably to refer to the process of hiding the information that is going to be transmitted so that only the recipient can understand it.
- - - - The certification process is carried out as follows:
        The certification server obtains the keys of all the clients and the application servers, as well as the passwords to be able to start the sessions.
        When a session is started in the system, the certification server requests an identification and a password that authenticate the user.
        
        To access a server, it is enough to connect to it, but, in the background, there is a process that requests a certificate from the certification server. This in turn builds a certificate to access the application server and sends it in an encrypted message with the key of said server; said encrypted message is encrypted a second time with the user's public key. This ensures that the transmission of the user's access certificate is secure.
        
        Integrity services and digital signatures
        Digital signatures and Message Authentication Codes (MACs) provide a means of authenticating the origin of a message and ensuring that the content of the message has not been altered during transmission.
        A MAC is a mechanism that calculates a single value from the content of the message, somewhat similar to parity codes. Both the sender and the receiver must be able to perform the same calculation and obtain the same result, otherwise the message is corrupted. To ensure security, the sender's and receiver's private keys are used in the calculation.
        
        Digital signatures are based on the fact that two groups can authenticate each other for the secure exchange of documents, but the relationship between them is not based on complete trust. They are possible when using public key encryption scheme.
        An algorithm is used to generate a hash value (the most used are MD5 or SHA-1) from the information of a part of the message and then this value is encrypted using the sender's private key, in order to obtain the digital signature. To verify the message, the receiver must run the same hash algorithm and the result is compared to the decrypted digital signature.
        The receiver uses the sender's public key to decrypt the signature.
        
        Private Enhanced Mail (PEM)
        PEM (Privacy Enhanced Mail) is an Internet standard designed to include digital signatures in email.
        This allows the use of electronic messaging on the Internet. Private and public encryption techniques can be used to ensure the integrity of messages and add digital signatures to them.
- - - - The browser, without the user's intervention or necessarily being aware of what is happening, encrypts this data using a symmetric key. The data digest function and the symmetric key are encrypted with the public key you just received from the vendor. The result of these operations is sent to the seller. In this way, the data entered by the user travels through the Internet encrypted so that only the virtual store can interpret them.
        
        SSL and SHTTP systems have the great advantage of absolute transparency for the user who does not need any type of preparation or prior knowledge. The identity of the seller is fully guaranteed and that only he will receive the data. On the other hand, they present the serious drawback that the identity of the buyer is not guaranteed, which is why the problem of repudiation may appear.
        
        To install the SSL system on your server, you can use the services of companies such as Thawte or Verisign. These companies will also provide you with an SSL Security Certificate, which will allow visitors or customers of your website to access the following information about your company:
        
        The domain to which the SSL Security Certificate was granted. In this way, visitors to your website will be able to verify that your domain (url) really has a valid security certificate.
        
        The owner of the certificate. This verification notably increases the user's confidence in your website, since they can know at any time with which real person or company they are doing business.
        
        The geographical location of the owner of the domain and the website, an extremely important factor when carrying out economic transactions or data transmissions through the network.
        
        The validity of the certificate, which will show at all times if the certificate is currently valid.
        
        SET is a protocol developed at the initiative of VISA and MasterCard that was initially adhered to by a large number of large banks and software companies around the world. It was expected that its use would be generalized in a short time, but, several years after its launch, we observe that its use is still not generalized and the experts do not see it as likely to be used in the future.
        
        In principle, the SET system is similar to PGP. The main difference with respect to the PGP system is that in the SET system each public key is associated with a certificate of authenticity issued by a certification authority (CA). Certificates of authenticity, also called digital certificates and electronic credentials, are digital documents that attest to the relationship between a public key and an individual or entity. CAs take responsibility for ensuring that accredited individuals or institutions are in fact who they say they are.
        
        The CAs, in turn, are certified by a higher authority, thus forming a hierarchy of SET certification authorities. The hierarchy is made up of the root (SET Root CA) which has issued certificates only to a few higher level authorities called SET Brands among which are the following: American Express Company, Cyber-COMM, JCB Company Limited, Maestro, MasterCard International , Nippon Shinpan Company Limited, PBS International A/S/Dankort, and Visa International.
        
        1 more item...