Schneier on Security

Clive Robonson • December 30, 2025 9:33 AM

@ ALL,

The wired article is reproduced from an earlier article about the Chinese online ecommerce scams.

Toward’s the end it notes that the scams started with retailers and then the purchasers.

Which is actually not that surprising as “honesty in marketing” legislation is generally quite low in most countries as online retailing is only a recent phenomenon from this century. Where as purchasers are legislated against more thoroughly by legislation on “theft and fraud” that often pre-dates not just ecommerce but goes back two or three centuries.

At the bottom of the article we find,

”But really, these trends are two sides of the same problem: Ecommerce relies heavily on trust, and widespread availability of AI is making it increasingly difficult to operate under the assumption that the majority of people are honest actors.”

AI easily breaks “trust and honesty” but all to often does not suffer reputational harm. And even where AI has broken the rules on “honesty and trust” the nature of the ecommerce markets, are that they are so separated out. That reputational harm is unlikely to be known to either party in a transaction.

This was an issue Prof Ross j Anderson had considered but came up with little to resolve it.

In fact the notion of ensuring trust in ecommerce is almost ridiculous because of the distance between retailers and purchases.

The normal suggestion is to insert a third party into the system to act as an observer. However it does not take long to realise that that will not resolve the issue.

Back last century was the Vesa-Mastercard system called “Secure Electronic Transactions”(SET) which was a horrific set of ASN.1 rules, but it failed. Mostly because perchasers did not want the level of security given.