South Korea is stuck with Internet Explorer for online shopping
washingtonpost.com
washingtonpost.com
To perform financial transactions online in Korea, you would need a plethora of software (often one from each party you would deal with) that revolved around security certificates that were issued by the banks that would store a hard copy of the certificate locally on your computer. Often it didn't work at all, not even getting into the security implications of the system. Bank hacking is so common in Korea, it's really disturbing. There is absolutely no accountability where the attempts at security do exist.
Also, you need to use your Citizen Number (basically a Social Security Number) to register for ANY service in Korea, even common websites. So everything you do can be traced via that single number. For foreigners, registering for common sites is usually impossible because our alien numbers are stored wherever normal citizen numbers are, so unless the site has a separate process for foreigners, you'd be out of luck. It's quite a mess. I can't say enough bad things.
On the bright side, start ups like Vingle in Seoul are doing a lot of tip the scales for the younger generation by only supporting modern browser versions (IE8+, not the most modern, but definitely a step up from IE6, which has a huge market share still, too), but it's a slow change.
Since 2011, websites cannot ask or store resident registration numbers (that's the official name) for non-financial purposes. Sadly, it happened after a major incident which exposed RRNs of more than 70% of Koreans. [1] It is a common estimate that every Korean person have his/her RRN hacked at least twice due to frequent incidents.
The Korean government endorses i-PIN nowadays, which is basically... uh... redundant aliases to the unique RRN. This is obviously stupid, you can hack i-PIN instead of RRN and you have the same credential. Well, at least i-PIN is random. (RRN had very low entropy, and even shallow information about the target may limit possible RRNs to only hundreds.)
[1] https://en.wikipedia.org/wiki/Resident_registration_number#O... for the 2011 incident.
Just the birthday and sex will severely limit the RRN list, yep. I've once read that public trust in Korea is one of the lowest in the world, but I've found it to be completely the opposite. Public trust is so high that people seem completely oblivious to how insecure their system infrastructures can be.
Israel has an "ID number" system, which you use when interfacing with e.g. health providers, or when applying to an academic institute. However, it is not assumed to be secret, and any action that would require positive identification will have it done with a physical government issued ID (national ID card, national driver's license, or passport) - knowing the number is not enough.
The system is far from perfect - there is a lot of information leakage, but identity theft requires forgery of physical artifacts, and more often than not - appearance in person - so it is not as common as e.g. in the US.
Citation needed. There are government mandated monopolies but you can also achieve a monopoly using purely free market tools and simply lock up all supply and/or distribution via aggressive investments.
You seem to imply government-induced monopolies > free market monopolies, but provide no evidence or even an argument that this is indeed true. You just state it as a universally recognized fact, when that is obviously not the case.
But I don't see the claim of government monopolies > free market monopolies you reference.
Any real economist.
Inevitably, if any industry is profitable, competition will arise. Government regulation (often through corruption) is the only mechanism which ensures a lack of competition. This can be observed in any industry throughout the last 100 years.
You're right that companies can lock up the vast majority of a market by out-competing others, but this generally doesn't last very long (typically a decade or less).
An industry can be profitable for the existing market participants and still have a high enough cost of entry as to have a negative expected profit over any meaningful timeframe for a prospective new entrant.
In practice, this is likely to change due to changing external conditions (e.g., technological progress that lowers the cost of entry or creates previously-impossible substitutes) but there is no theoretical reason why this must be the case.
Yet it has always turned out to be the case anyway...
Even in the world of offshore drilling (which probably has a higher cost of entry than any other business you could possibly enter) there are tons of start-ups, joint ventures, etc... Of course, the oil business is also very susceptible to corruption, but wherever land rights are auctioned fairly, you see good competition.
1) Property. If you have a monopoly on the property in a given area you can charge whatever you want for rent, and no competition will be around to add competition.
2) Vertical monopolies. If your company buys out not just the competition, but the entire supply chain, and there is a high cost of entry to being able to enter the market -- say automobiles -- then you can quash competition as it arises.
3) Coal mines. If the only job you can get is in a coal mine, and the operator of said mine owns all the mines in your geographic region, you don't have much of a choice. This is especially true if you are working 12+ hours a day 7 days a week for a pittance, or are a minor child.
4) This is libertarian fantasy and rightfully deserves the scorn and ridicule it has so far received in this thread.
There are many, many ways to abuse the market to the detriment of the workers, both with and without regulation.
1) If rent is too high then renters will leave.
2) If an automobile is too expensive then consumers will use mass transit or carpool.
3) If there is a coal shortage due to labor conditions then consumers will use natural gas or other alternative sources of energy.
Your hypothesis doesn't take into account the complexities of people's lives which often overwhelm simple economic models.
1. 26.4% of all US renters spend over 50% their income on rent. The most commonly agreed-upon sustainable percentages are between 25-33%.
2. Sadly, there doesn't appear to be much correlation between the cost of transportation (car purchase, gasoline, car maintenance) and mass transit/car pooling increases. In North America, the idea of status being linked to the automobile is a strong counterincentive to mass transit/car pooling. People would rather be poorer than to be thought as too poor to drive.
3. Switching from one fuel to another is not a simple choice for homeowners, you need to switch your furnace (which may be tied to a long-term contract with the fuel supplier), you need to have a local supplier, and you will inevitably face the fact that as demand in the new fuel increases, so will its price.
1) Rent is too high, where do I go? Do I leave my job to live in the country side without one?
2) Public transportation has to exist to be an alternative to the automobile, and often requires public intervention to be viable.
3) Did someone build the pipelines necessary for gas to reach my house? Does the same company own both coal and gas supplies? How do I keep from freezing to death this winter?
2) There is more than public transit such as van pools, bicycles, motorcycles, and trains.
3) There are several way to produce energy to heat a house (electricity, natural gas, wood burning stove).
2) You must live in a first-world country.
3) I know this first hand living in Beijing, part of the reason we have seriously bad pollution in the winter is because all the farmers in the surrounding Hebei country side burning whatever to stay warm.
Then people can move elsewhere. People won't tolerate it forever. This can be seen in the real estate market in the city I live in. Several downtown blocks in prime locations have a single owner. She charged outrageous rents, and now half of these (prime) locations are empty, and new businesses have cropped up in the neighborhoods around the downtown core.
> 2) Vertical monopolies. If your company buys out not just the competition, but the entire supply chain, and there is a high cost of entry to being able to enter the market -- say automobiles -- then you can quash competition as it arises.
While this is possible in theory, it hasn't happened in a free market.
> 3) Coal mines. If the only job you can get is in a coal mine, and the operator of said mine owns all the mines in your geographic region, you don't have much of a choice. This is especially true if you are working 12+ hours a day 7 days a week for a pittance, or are a minor child.
I live in a country where people will travel 4000 KM for a job. People will move if they perceive economic conditions to be unfavourable. If enough people do this, the mine owner will be forced to raise wages or face a shortage of labour.
> 4) This is libertarian fantasy and rightfully deserves the scorn and ridicule it has so far received in this thread.
Only Americans would make an accusation of political bias in a discussion such as this, using such terms (libertarian).
Fact is, the study of economics is the same whether you're in a market economy or a controlled economy (and likewise whether you vote right, left, or centre). And most economies are mixed BTW.
Are you referring to emigration? Ya, that happens for particularly bad governments, who don't have a monopoly on power in the world. Of course, moving can be tough, you might have to slug it out in a boat to reach Australia.
> While this is possible in theory, it hasn't happened in a free market.
Of course it has. Pre-sherman anti-trust act it happened all the time.
> I live in a country where people will travel 4000 KM for a job. People will move if they perceive economic conditions to be unfavourable. If enough people do this, the mine owner will be forced to raise wages or face a shortage of labour.
I live in a communist country where people will do the same. They might even move out of country.
> Only Americans would make an accusation of political bias in a discussion such as this, using such terms (libertarian). Fact is, the study of economics is the same whether you're in a market economy or a controlled economy (and likewise whether you vote right, left, or centre). And most economies are mixed BTW.
Your opinions do not match the universal truths of an economist, of which I know many (of different nationalities). Libercrazians like to pretend that they are supported by economists, most of whom (barring the Austrians) think they are whackos.
Most of the sources for this aren't entirely convincing. A small example: http://www.investopedia.com/articles/economics/08/hammer-ant...
A monopoly by definition must include a condition that there is no competition, not just that the market is dominated by 1 entity. The frequency that this happens due solely to market forces (ie. no coercion, violence, corruption, etc...) is low to nil.
> Your opinions do not match the universal truths of an economist, of which I know many (of different nationalities). Libercrazians like to pretend that they are supported by economists, most of whom (barring the Austrians) think they are whackos.
First, I'm hardly a libertarian (at least not of the American variety), nor do I find the pop-economic theories of 'Austrians' convincing. In fact, in all the economics I've studied (not my major, but took quite a few courses) the 'Austrian' school was hardly mentioned. I've seen it mentioned more on HN than I ever had before... BTW, my views would probably fall more in line with neoclassical economics, though I don't work in the field, I do make a living investing in stock markets.
There are also places on earth where you cannot easily get to another sufficiently richer country, so you don't even have the incentive to spare some money, just to go through the hard life of being an immigrant and then either adapt or come back with nothing.
People do choose this options, do struggle for visas etc, but usually to do that you have to be strongly motivated. The system often is kept somewhat balanced by this, but this doesn't means it's favourable to workers/consumers.
Any real economist can cite many monoplies that arise through market forces alone.
> Inevitably, if any industry is profitable, competition will arise.
This is not true. There are many different definitions of "profit", and there are many cases where an industry that makes a real business profit will not support a competitor that makes an economic profit. The obvious example is markets with very large economies of scale [1].
> Government regulation (often through corruption) is the only mechanism which ensures a lack of competition. This can be observed in any industry throughout the last 100 years.
I'm interpreting this to mean "only through government intervention can we ensure a lack of competition". Again, this is not true. Any party that can make a massive capital investment (which already vastly reduces the pool of competition) can enter a space and make any future entrance by a competitor completely unprofitable.
To see an example of this, lets go a century back in time to the day of Standard Oil. Standard Oil was notorious for leveraging its massive capital advantage to destroy its competitors. It would enter a new market and lower its prices (leveraging its massive war chest). Once its competitors left business, it would raise prices again to screw over consumers. After many people caught wind of this blatant market manipulation, it turned to deceptive practices and things like tying agreements [2].
What government policy led to the dominant monopoly of Standard Oil?
> You're right that companies can lock up the vast majority of a market by out-competing others, but this generally doesn't last very long (typically a decade or less).
Standard Oil was supreme for over thirty years. If only we could invent a time machine, to hear the gales of laughter from the businessmen of the day at the notion that Rockefeller became the king of oil by "out-competing" others.
He became dominant through backroom deals and anti-competitive practices. Government intervention was what finally ended the Standard Oil monopoly. It was also likely the only thing (barring the death of Rockefeller or some kind of market shift) that ever would.
1. http://en.wikipedia.org/wiki/Economies_of_scale 2. http://en.wikipedia.org/wiki/Standard_oil#Monopoly_charges_a...
Backroom deals AKA corruption. Corruption and regulation are two sides of the same coin. Had the market been perfectly competitive (ie. state governments not succumbing to corruption) the monopoly likely would not have formed and lasted.
Your only example merely proves my point.
Try to find a monopoly that has arisen in an open market, free from government 'intervention' (either regulation OR corruption).
> Backroom deals AKA corruption. Corruption and regulation are two sides of the same coin.
You seem to labor under some obtuse notion that the state governments were the subject of the backroom deals. Let me dispel that for you, by quoting from the article cited that you apparently couldn't be bothered to read:
> In a seminal deal, in 1868, the Lake Shore Railroad, a part of the New York Central, gave Rockefeller's firm a going rate of one cent a gallon or forty-two cents a barrel, an effective 71 percent discount from its listed rates in return for a promise to ship at least 60 carloads of oil daily and to handle the loading and unloading on its own
> Rebates, preferences, and other discriminatory practices in favor of the combination by railroad companies; restraint and monopolization by control of pipe lines, and unfair practices against competing pipe lines; contracts with competitors in restraint of trade; unfair methods of competition, such as local price cutting at the points where necessary to suppress competition; [and] espionage of the business of competitors, the operation of bogus independent companies, and payment of rebates on oil, with the like intent.
> The general result of the investigation has been to disclose the existence of numerous and flagrant discriminations by the railroads in behalf of the Standard Oil Co. and its affiliated corporations. With comparatively few exceptions, mainly of other large concerns in California, the Standard has been the sole beneficiary of such discriminations. In almost every section of the country that company has been found to enjoy some unfair advantages over its competitors, and some of these discriminations affect enormous areas.
> Almost everywhere the rates from the shipping points used exclusively, or almost exclusively, by the Standard are relatively lower than the rates from the shipping points of its competitors. Rates have been made low to let the Standard into markets, or they have been made high to keep its competitors out of markets. Trifling differences in distances are made an excuse for large differences in rates favorable to the Standard Oil Co., while large differences in distances are ignored where they are against the Standard. Sometimes connecting roads prorate on oil—that is, make through rates which are lower than the combination of local rates; sometimes they refuse to prorate; but in either case the result of their policy is to favor the Standard Oil Co. Different methods are used in different places and under different conditions, but the net result is that from Maine to California the general arrangement of open rates on petroleum oil is such as to give the Standard an unreasonable advantage over its competitors
> The evidence is, in fact, absolutely conclusive that the Standard Oil Co. charges altogether excessive prices where it meets no competition, and particularly where there is little likelihood of competitors entering the field, and that, on the other hand, where competition is active, it frequently cuts prices to a point which leaves even the Standard little or no profit, and which more often leaves no profit to the competitor, whose costs are ordinarily somewhat higher
Note that the word "government" appears nowhere in any of these allegations. All of these backroom deals existed with other market participants.
If you redefine "corruption" to mean "not involving the government whatsoever" then your points are indeed true, but you are then proving the exact opposite of your initial assertion that "only governments can create monopolies".
Anyway, it's not clear if you're a troll or ignorant at this point, and I doubt that further effort to dispel your quaint notions will be worth my invested time.
http://www.pagetutor.com/standard/chapter13_part1.html
The whole text. http://www.pagetutor.com/standard/toc.html
It does seem as though they (mostly) legitimately competed, and given the historic oil price throughout their reign (which fell drastically, http://www.pagetutor.com/standard/chapter16_part1.html) it doesn't seem as though they exercised monopoly power (at least not nation-wide).
How about you cite an example of an open market that is free from government intervention?
Where did their mineral rights come from?
Or are you arguing that the right to own private property comes from the government? What then, is the proposed alternative? Dispel property rights? Because history indicates this is likely to make the problem of monopolies worse instead of better.
Anyone who pretends that economists agree on anything is not worth taking seriously.
Free market monopolies are only allowed to last a decade or less BECAUSE of government intervention; otherwise they would last much longer. Your 100 year time line horizon corresponds to about the time when governments began regulating and dismantling monopolies.
Also, a private-sector monopoly, no matter how seemingly entrenched, is always vulnerable to disruption (when was the last time you used a PC manufactured by IBM? Or were forced to use IE against your will, for that matter? And yet those were both at one time monopolies that came very close to being broken up by the justice department because people claimed the free market could never topple them). That's why that "distopian future scenario" the OP referenced didn't come about in most of the world. Other browsers came about that users liked better and despite the big advantage IE gets from being bundled with most PCs others have had success in the market. Contrast that with the difficulty in breaking a government-enforced monopoly like the one referenced in the article.
That can be pretty bad if the "good" you are going without is food, shelter, a necessary medical procedure, or some other fundamental requirement.
I suspect we need a new term for what we want. "Capitalism" is too sullied by use.
No nation is pure, of course. But we can look at examples of crony policies within otherwise capitalist-ish nations and compare to less crony-ish policies within those same nations.
It all gets a bit muddy real quick, but I guess we have to do the best with what we've got.
You don't know Singapore or HK very well. They are very good at being a transparent government, but guanxi is still needed to get things done.
First, there is a great deal of overlap among the leadership of government, the military, education, and business. As in, the same dude is CEO of a large company and a Colonel in the army and last year he was minister for something-or-another. When he gets tired of this company he'll teach at NUS for a bit. If you're on track to slide into that top echelon when you're still in your twenties, you're golden, otherwise your prospects are more limited.
To a seemingly greater extent than is true even in USA, the government is involved in everything. Fortunately, the bureaucrats seem to make generally good decisions, but they're still making decisions. The genuinely competitive industries are export-focused, which I guess is OK for a small nation for which exports are so important.
Everyone has heard about the fairly severe punishments Singapore has for various crimes, but perhaps not how much enforcement varies based on the identity of the criminal. Even before you get to the punishment stage, law enforcement and related surveillance pervades society, and affects different classes of people in wildly different ways. This isn't an economic effect per se, but the choices people make as a reaction to this have economic consequences. Also, I can't get over the fact that for 34 of its 48 years, Singapore's PM has been LKY or his son.
(All of these are well known, well documented examples a little over a century old. For a more modern alternative, consider the many people who have a single provider for internet access – they can either pay or give up on significant participation in the modern economy.)
> Also, a private-sector monopoly, no matter how seemingly entrenched, is always vulnerable to disruption (when was the last time you used a PC manufactured by IBM? Or were forced to use IE against your will, for that matter?
Amusingly, both of your examples are cases where the monopoly was disrupted under the treat of government action. The reason those other browsers had a chance is that Microsoft couldn't lock down the PC market as much as they wanted to while the DOJ was investigating. Similarly, look at IBM's history – do you think the PC market would be as open if they hadn't had to worry about a replay of the 1969 antitrust settlement?
1) Monopolies can and do happen in the absence of regulation. Indeed, it is frequently only through regulation or direct governmental action that competition can be encouraged. (The breakup of the AT&T monopoly comes to mind.)
2) The simple fact of the matter is that government and economic policy go hand-in-hand. Governments create the currency and enforce contracts. They also set the rules for the market. Without those rules -- laws -- markets descend quickly into chaos similar to what you see today in Somalia or Afghanistan: societies driven by tribal loyalties, inefficient, brutal, cruel, and repressive.
There are no monopolies in Somalia because there is no system in place for establishing corporate charters or enforcing contracts. This requires a strong government to serve as arbiter between disputing economic interests.
Eh, you might reserve that tone for posts in which you're mostly correct.
Ma Bell was not in any real sense broken up at any point in time. Presumably you're referring to the consent decree that took effect in 1984, but it's also possible you've been fooled by the fig-leaf Comm Act of '96. The result of all that mummery is that right now we have 2.5 phone companies in the USA (which organizations operate the exact same way they did it before the "breakup"), and various tiny morsels the two big daughters haven't yet consumed and excreted. The main outcome has been that telecom executives have extracted vast fortunes from investors, which was probably the point in the first place. That's not even to mention the fact that it was the original Comm Act of '34 that gave Bell its ironclad, FCC-enforced monopoly initially.
There is hope, however, because eventually the consumer will only need an ISP, rather than the Frankenstein's monster that is "the phone company". ISPs connect, directly or indirectly, with backbone providers, and there is a functioning market of those. As long as the FCC doesn't outlaw ISPs, sanity will prevail in communications, someday.
It's funny that you mention Somalia, because it's a direct refutation of the point you're attempting to make (i.e., no government -> monopoly). It's as if Somalia is such a favorite hobbyhorse of the corporatists that they can't actually talk about how great corporatism is without mentioning it.
Capitalism is not a system of capital ownership that encourages competition directly, it is a system of capital ownership that encourages greedy[1] people to greedily control capital in a way that most benefits themselves, and by proxy, their company, and by proxy, the economy. There is no competition inherent in private capital ownership, but it can exist as a side effect of greedy people attempting to best steer their capital successfully.
[1] I use "greed" often, but this is Greed Motivation. That's what this system is. It's not an insult, rather just a descriptor of the motivations we exploit for our economic success.
His examples may have been poor but industrialization is full of examples of Capitalism run wild in a regulatory environment that was non-existent.
Would you like to defend the purely Capitalistic actions of Rockefeller and Carnegie, and perhaps rationalize the almost complete lack of a middle class during that heyday of nearly unregulated Capitalism or the incredibly poor conditions that large swaths of people were subjected to so that the richest Americans of all time (by a massive, shocking, so-much-more-than-Bill-Gates margin)could get even more wealthy?
I'm always shocked when people automatically assume that Capitalism = Competition, when competition is really a side-effect of Capitalism, and one which is often minimized by firms who control capital and believe that their best interest is not in competing aggressively (expensively) but in dominating cheaply (rent-seeking).
While you may be absolutely factually correct, which you are not, such argument form is not doing good for the cause you promote. If you really want to spread information about the negative aspects of capitalism, you should try doing that without diatribes and name-calling.
I think what you've done is a basic against-the-man attack where you "discredit" what I said by inventing fake attacks against me. You're welcome to invent whatever rationalization you need to ignore me, but don't pretend it's anything more than ignorance in action, buddy.
You seemed to be calling me a capitalist, but I'll accept your apology if you clarify that.
The idea that we can't blame Capitalism for its corruption is laughable. The greed motivation of Capitalism is WHY that corruption exists! Because they want personal success MORE than they want success for all, so they make a decision that benefits themselves/their investment at the cost of society.
The outcome of Capitalism without strong regulation in that era was a corruption of weak regulators, corruption of government, and a destruction of competition.
I guess you could argue "but what about Capitalism in absence of government entirely" but that sounds too much like the Communists and their "but but TRUE communism, without a state, would TOTALLY work, I SWEAR!"
Which is why the socialist critics of the dominant economic system of the developed world of the early-mid 19th Century coined the name "capitalism" for the system they were criticizing.
In GP, "capitalist" -- and I would have thought this was crystal clear from context -- was used in the sense of "member of the class deriving sustenance principally through ownership of capital" (e.g., as would be opposed to "labor") not in the sense of "proponent of the economic system known as capitalism" (e.g., as would be opposed to "socialist".)
Unless you labor under the delusion that capital is not owned by a very small number of people, I do not know how that definition caused you to think the exact opposite of the definition.
Also, I am not wielding "greedy" as an insult, as I clarified immediately after using it. This is a greed motivated system. It is what it is. It is not an insult, it is a description. I apologize if you disagree but I am not really interested in debating if water is wet.
It would harness greed to produce social good rather than assuming greed will naturally produce social good. Note that you actually see many elements of this alternative to capitalism in most modern developed economies, which are mixed economies that specifically adopted elements of alternatives to capitalism (largely, specifically drawn from the universe of socialist thought) to mitigate the harms of capitalism identified by 19th Century socialist critics.
Of course it does. In fact, if you want an even better line: if it's a greed motivated system and we work against greed, we're directly disincentivizing economic activity.
It's absolutely a fine line to draw. History has examples of the economic noose of overregulation just as surely as it does the industrial dystopia of underregulation.
It's a lot like medicinal drugs (medicine). The difference between a poison and a cure is dosage. Too much or too little and you can hurt someone instead of helping them. Or the interaction of multiple different treatments create new and possibly terrible outcomes.
Regulation (greed control) to me is very similar. The difference between good regulation and bad regulation is very minor, it's dosage. A good policy applied the wrong way is just as bad as a bad policy. Multiple policies of regulation may interact in new and crazy ways.
So to me the proper regulation of Capitalism is like trying to dose a new drug. It's extremely difficult and nuanced to do well. And even if done well, as you pointed out, there is always the incentive to cheat, and always the fallout of the disincentivization our actions cause.
Right. Its called capitalism because its a system driven by serving the interests of capital.
So I called your attempt silly, insinuated your understanding of Capitalism was flawed and provided many more examples of Capitalism without regulation running amok, which was his original argument.
Holy crap that's some egg on my face. There must be some Latin name for that particular brand of rhetorical gaffe, "attacking the arguments".
It's interesting, however, that you invented a new context for my words that has no basis in the words themselves, and then used that as your reply instead of engaging on merits.
In fact, I believe there is some Latin name for that particular brand of rhetorical gaffe.
In fact, you BEGAN your post calling the OP entirely wrong:
>Eh, you might reserve that tone for posts in which you're mostly correct.
And finished with:
>It's funny that you mention Somalia, because it's a direct refutation of the point you're attempting to make (i.e., no government -> monopoly). It's as if Somalia is such a favorite hobbyhorse of the corporatists that they can't actually talk about how great corporatism is without mentioning it.
Yep, nothing but a simple correction about the telecom industry, nothing more.
It's obvious you have no interest in talking, so feel free to just walk away. Your continued sarcastic response is strange, considering that no one is forcing you to reply.
I'm quite sure Microsoft had something to do with the experts that consulted for the South Korean government when they arrived to this brilliant solution.
My blog post was heavily covered in Boing Boing, Slashdot, Salon, etc. at the time.
Ugly boasting.
Truth be told, I never actually managed to buy anything online when I was there. It's like everything was designed to keep me from buying. What didn't help was that I was on Visitor status, meaning you don't get your national ID, which is required on a vast number of SK sites. Without ID, you just become some kind of virtual hobo.
It's a shame considering the amazing infrastructure there is over there. Anyone who's ever visited SK websites will tell you how poorly put together they are, both technically and visually. I've rarely seen such disparity between the underlying infrastructure and its use anywhere else.
Some more background http://en.wikipedia.org/wiki/SEED and http://kanai.net/weblog/archive/2007/01/26/00h53m55s
There was some hope last presidential election cycle that this would become a topic for the new administration to tackle [1], but that candidate (Ahn Cheol-soo) lost the election and it seems to have fallen off the table for now.
1 - http://www.theregister.co.uk/2012/11/14/ahn_lab_internet_exp...
What happened was, the US had banned export of 128bit encryption software. The Korean government said screw that and created browser plugins - for BOTH Netscape and IE - to use 128bit encryption for online transactions. Netscape died and IE remained. I guess their implementation is proprietary enough that nobody else has managed to implement it on other browsers.
NPAPI is supported in most browsers, so the SEED implementation had to have been pretty tied to Netscape Navigator/Communicator implementation as it existed pre-Firefox
If the government implementations are the de facto standards and the Korean government has only maintained an ActiveX version for the last 10 years, I can't see how you can interpret it as anything other than an IE mandate.
Because the government is not mandating IE? The public overwhelmingly used IE over Netscape which caused the government to go "okay since nobody is using netscape we're going to only maintain one plugin". I think its a pretty important distinction to make. Anyway, we disagree. No biggie :)
Yes, it originated in the days when SSL was 40-bits, and yes there was once a Netscape plugin. However the world changed, and for the next decade the law remained the same. The spirit of the article is absolutely correct, despite minor discrepencies: Long after far superior alternatives were available, the law mandated the use of Internet Explorer, which is an inertia that carries the country today.
The law does not mandate IE. The government would have maintained both plugins if people would have continued to use netscape. They didn't.
How is the situation today any different than if Netscape never existed?
It is really important to look through the dry definitions. e.g., the super rich -- like the super poor -- are forbidden from panhandling. But effectively, it's a law that only applies to the poor; The wording does not matter.
So what's the actual barrier to doing that? (also, why doesn't FF solve the issue since https://bugzilla.mozilla.org/show_bug.cgi?id=478839 was fixed? - it looks like guys from KISA are actually cooperating to implement the needed ciphers)
Is the auth protocol completely unknown? Is the activex control obfuscated more than is possible to reverse-engineer?
Firefox is designed to be secure and sand-boxed, especially its plugin architecture.
So the question is, if you are willing to ignore their activex and run your own custom JS instead, could these websites be made to work?
And guess what happened?
Major credit card companies pulled out one by one, because they "cannot ensure" that a page without Active-X is secure enough. Of course nobody's pulling any strings, no government officials are receiving unknown gifts, and nothing can be ever proved. So, there. You work for months to provide users with modern browsing experience, and those banking powers-that-be just pull the plug.
The whole system is corrupt beyond imagination.
Citation (sorry, in Korean): http://www.hankyung.com/news/app/newsview.php?aid=2013091203... http://www.leejeonghwan.com/media/archives/002331.html
Noone should be able to shut it down, because it's on the client side, rather than the service provider, so the retailer shouldn't be blamed.
A few years ago (when I was still in Korea), it was usually impossible to open two different bank's pages at the same time: I'd assume that's still the case now. As far as I know, the reason is that both banks will force you to install "anti-hacking" plugins, which hooks directly into your Windows Kernel and makes sure nobody else snoops on what you type. Yes, these webpages try to establish a direct connection between your keyboard and the website, completely bypassing every layer. Now imagine the fun when two such plugins try to run at the same time.
And of course without these plugins you can't use the site. Hell, sometimes these sites spontaneously break just because you're accessing it from the US, because nobody had thought to test them from a client with ping time > 200ms.
Now try emulating that in client. (I don't know if I should laugh or weep.)
EDIT: Besides, if you seriously try to make a platform that can emulate these "security" plugins, sooner or later you will be arrested for making tools to circumvent security measures, and people will be reminded that they should never install anything from "suspicious" sites. (But of course install everything from banking sites.) As a bonus, some news media will claim you were paid by North Korea, and many will believe that.
Depending on the difficulty of working around the issue though, I wonder if it's a business opportunity: offer a web proxy which is transparent for all purposes, apart from the activex part - it would replace them with something that's either pretending to run the verification itself, or provides some replacement script. If you ran the company outside of Korea that took subscription money to bypass a number of the most popular services' auth, it would be hard to shut down. (but it would become a cat and mouse game of updating the algorithm until one side got bored...)
Unfortunately this would have to be written in some interesting way that guarantees the passwords / tokens / sessions are never captured by this system, otherwise noone would use it. But that's a technical problem - should be doable in some way.
There's a reason Mozilla's addon repository has a review process.
What makes addons better than ActiveX controls is that they're understood to extend the browser for the user's benefit, not merely make a crappy website work. Fewer people would buy that a bank website needs to install a Firefox extension before you can log in.
http://www.adamlock.com/mozilla/plugin.htm
One could guess that it was never included by default because Mozilla did not want to encourage the use of ActiveX controls.
What I meant is either reverse-engineering the algorithm and reimplementing it in FF chrome in clean JS like jlgreco mentioned below, or including just the kernel of the important logic, the way ndiswrapper uses windows driver for communicating to the network cards without actually implementing whole windows kernel.
Also, I'm not sure why my post was dinged, but Firefox extensions/addons/plugins can call into native code and can do pretty much anything an ActiveX control can do. There is no "sandbox" as someone else implied.
It's worked extremely well. There are a couple competing systems. Some use smartchip ID cards, some use smartphone two factor auth, and others use a certificate file on the computer. The most popular system is run by a consortium of banks and uses a certificate file, and supports Windows, Mac and Ubuntu Linux through a browser plugin. Most government services like filing taxes, address change, student loans, etc support 3-4 different systems.
1. Technically, the law doesn't require that you use Internet Explorer. The law merely requires that you use a bunch of technologies, ranging from 128-bit encryption to government-issued client certificates to government-mandated antivirus to (craziest of all) an anti-keylogger utility. Conveniently, the spec was written with Windows & IE in mind, so it's very difficult to write alternative implementations for other platforms.
2. This is not a matter of being stuck with older versions of IE like many corporate intranets in the West. In fact, most banks in Korea work perfectly well in IE11 as long as you don't try to use the Modern UI (Metro) version. Because this is not so much about IE as it is about the WIN32 environment.
3. The proliferation of phones and tablets has motivated banks and payment gateways to write iOS and Android implementations of the spec. This was the first time anybody tried to implement the spec outside of Windows & IE. But once you have one alternative implementation, it's much easier to port it to other platforms like Mac, Linux, and FF/Chrome on Windows. This is happening slowly.
4. Despite the appearance of these alternative implementations, the spec itself is still very problematic. For example, the antivirus and anti-keylogger requirements cannot be met unless the programs in question have root privileges on your device. It feels insane when you browse to a bank's home page in Linux and it tells you to download a bunch of apps and execute them as root. And of course those apps are only designed for specific versions of specific Linux distributions, so they break as soon as a new Ubuntu release comes out. No thanks! Even in Windows, the Firefox & Chrome plugins are not packaged as proper extensions, but as standalone programs that integrate loosely with the browser like Flash and Java, Because you can't meet the spec within the confines of a browser's sandbox.
5. Okay so why not just run Windows in a VM? Actually that's exactly what I do. But it's not a perfect solution. Some of the Korean "security" apps have begun to detect when the user is in a VM, and refuse to work in a VM. There is no technical reason for this policy, they just don't like people getting around the rules. My bank refuses to whitelist my VM as a trusted device. I've encountered at least one government agency that won't offer online services to a VM. The last time I bought a bus ticket online, the e-ticket wouldn't print because the printer port was virtualized and therefore could be used to produce duplicates or whatever.
6. Even mobile apps, which the article mentions, are very pesky about their environment. The app for my bank won't run on my phone because it's rooted and therefore can't be trusted. Fuck that shit. This affects everyone who uses CyanogenMod. (What's even more ridiculous is that the same bank requires root on my PC.)
7. Therefore, porting the spec to non-IE platforms and/or writing compatibility layers is not the answer. The spec needs to be fixed, period. No website should have the right to demand the use of any software other than a standards-compliant web browser. No website should require root, or even want to know anything about the environment (virtualized or not, rooted or not) in which it is being visited, except what the browser exposes to it by default.
8. Of course this isn't going to happen any time soon, because removing even one of the requirements on the current spec will be seen as a decrease of security, and nobody wants to take the blame the next time 10 million people get their account information stolen. Wait a second, every Korean citizen has had his or her personal information stolen multiple times in the last several years anyway. All the banks and merchants have desensitized users to the point that anytime any website ask them to install some app and run it as Administrator, they do. All the security theater of the last 14 years has done is to decrease the security of the entire country. It has also hurt the rest of the Web. Because it's so much more convenient to write a Windows Forms app than to write a website that works in both IE6 and IE11, lots of interactive and media-heavy websites in Korea (especially gaming and file-sharing websites) have become mere landing pages where you download the actual app. After all, the banks are doing it, so why shouldn't everyone else do the same?
9. One move in the right direction is that since this September, every large (over ~$3000) online transaction requires two-factor authentication. They've been handing out one-time password generators like candy lately. The ubiquity of mobile phones also means that you can even choose to use three-factor authentication (login + one-time password + SMS token) for certain types of transactions. Hopefully this will eliminate the justification for the anti-keylogger utility, since the passwords and SMS tokens can't be reused anyway.
[Edit] 10. Another positive development is that the Korean government has finally begun to pay attention to accessibility on the Internet. At the moment, among Korean web developers, accessibility is an even hotter topic than standards compliance, because lack of accessibility can get you into nasty lawsuits and hefty fines. Everyone's busy adding "alt" attributes to <img> tags. But hopefully, in the long term, focusing on accessibility will also bring people to care about standards compliance.
I'm still confused about why the government needed to create any sort of web site since they are just marketing private insurance plans (which meet the ACA standards) and these companies have been and continue to market their insurance plans on their own web sites. And hasn't anyone in the federal government heard about 'independent insurance agents'? I guess not since they had to dream up a new job title of 'navigator'.
I do support some of the policy goals of ACA, but it seems like almost any other implementation would have been better than the convoluted-rube-goldbergish mechanisms created by the ACA.
Could they not get a free VM and then download an image from modern.ie?
I suppose in a sense it becomes a bit of a worry if you run too lightweight on the VM which after all will have to contain your banking credentials (sort of the opposite of firing up a VM when you're doing something that feels too sketchy to run on the main system).
Boot Camp is of course free, but only permits rebooting a Mac into Windows. For $70 one could purchase VMware Fusion or Parallels Desktop, and run Windows side by side with OS X. The author of the Washington Post piece does not make this clear.
Calling Boot Camp a "secret weapon" suggests that most people aren't aware that Apple computers can run Windows. This may be true in the wider world, although any Apple employee in a retail store could inform customers otherwise.
Expecting a writer not focused on technology to discuss gratis tools like VirtualBox and modern.ie is probably asking too much (although these would be well within the reach of Hacker News readers).
There are a few things that leak presence of a virtual machine to running code (even in userspace).
There are the easy signs, e.g. that the virtualbox guest kernel-modules or utility programs for clipboard exchange are running. Or that your harddisk controller has a PCI ID identifying it as a Oracle Virtualbox AHCI device.
But on a hardware-virtualized machine there are also numerous inconsistencies to be observed which are not influencing the correct execution of "normal" code, but leak the existance of the hypervisor to the guest OS (and sometimes even to non-privileged user-code in the guest OS).
Google for "Red Pill VM detection", unfortunately currently invisiblethings.org (the site of the author) seems to be unavailable.
That phrasing made me cringe and shows the lack of technical understanding of the author of this article. ActiveX is a technology, not a piece of software or a plugin in itself.
The salesman was probably talking about Parallels Desktop or VMware Fusion. of course, one can just as easily use Virtualbox. Or if you only need IE, you can use a WINE layer like CrossOver.
And the conservativeness of the Korean majority elected conservative major party, and the party - of course - has no will to change it at all. And actually they enforces old rules to keep their existing benefits.
So Korea has no hope to change this before replace major party. In last president election, there was a candidate promised fixing this issue, but finally defeated to candidate from conservative party.
And they need to wait all the old McCarthyists - who are main supporters of conservative party - disappears.
Anyway, it's so bad that my (technophobe) wife refuses to shop online anymore because she is forced to use IE (and vastly prefers to use Chrome)
So then, 10 or 20 years ago, when the NSA needed a secret laboratory to experiment in, where they could blunder away at trial and error, perhaps a huge wind tunnel to test the aerodynamics of this bird, well South Korea sounds pretty good. Let's see if the pentagon can get them to agree to a few absurd pre-requisites and static global variables, while we bootstrap this absolutely enourmous program we're shoe-horning into place.
However, as I've learned from doing tech support, I find hardcore gamers are more computer illiterate. They know enough about computers to turn them on and play their game, but because they play for so many hours they don't do anything else on the computer.
Basically you get a nation of computer illiterate users, who use Windows because they don't know any better. Most probably don't even know what Firefox or Chrome are.
> But those with Apple computers — for which IE isn’t available — have it harder. Some go to Internet cafes. Some rely on their office desktops. Some dash into hotel business centers. Some hold on to their old computers and boot them up when it’s time to make purchases. Still others depend on a secret weapon called Boot Camp, a software program that allows a Mac to run Windows.
Your bar code is your laptop.
IE8, for example, is going to be around for a while. However, if enough developers stop supporting it now, the conversation will begin. Otherwise, it's gonna be 2020 and ie8 will still have significant market share.
Like I said, certain organizations will change when they absolutely have to. In South Korea's case, it's going to be costly so they are probably going to be the last.