On the Security of Internet Banking in South Korea { a lesson in how not to regulate security
Hyoungshick Kim, Jun Ho, Huh Ross Anderson · 2011
South Korean Internet banking systems provide an interesting natural experiment. Having been concerned at restrictions on crypto key length during the 1990s, the Korean government set up a closed security system for online banking. Users are obliged to install proprietary security software – ActiveX plugins that implement a bundle of protection mechanisms in the user’s browser. In consequence, almost everyone in Korea uses Internet Explorer rather than other browsers. We conducted a survey of bank customers who use both Korean and other banking services, and found that the Korean mechanisms impose significant usability penalties. Usability here is correlated with compatibility: Korean users have become stuck in an isolated backwater, and have not benefited from all the advances in mainstream browser and security technology. Also, the proprietary mechanisms fail to provide a trustworthy platform. We conclude that Korea should rejoin the mainstream. 1