MERCURY CENTER

CyberCash's digital money is
latest system for Net commerce

Published: Oct. 1, 1996

BY SIMSON L. GARFINKEL
Special to the Mercury News

A Redwood City company just made it easier to spend your money on the Internet.

The company, CyberCash, introduced a new kind of digital money on Monday designed for buying things over the Net that cost between 25 cents and $10. Using its ''CyberCoin'' system, it is possible for an online magazine to charge people 25 cents to download each article.

A college student who writes a small program could sell it for $5 per copy from a site on the Web.

To buy something using CyberCoin, both the consumer and the merchant need to have special CyberCash software installed on their computers.

The technology is another in a series of steps taken in recent months that could transform the relatively free information highway into a series of toll roads.

For instance, starting next year, personal-computer users will be able to purchase special keyboards from Microsoft Corp. with built-in readers for credit-card sized smart cards, such as the ones used on a trial basis this summer by Visa at the Olympic Games in Atlanta.

''Within a year, we will begin to see lots and lots of them,'' said Pradyumna K. Misra, a manager at Microsoft's Internet Security Product Union. Misra said Microsoft already has demonstrated a version of its Microsoft keyboard with a reader and that the company already has started licensing the technology to major PC vendors.

The reader should add just a few dollars to the price of a keyboard and may eventually become standard equipment on all new computers that are sold.

That could have a big impact on publishing on the Net. Today, most information available over the Net is free, with many Web sites being supported by advertising. But if it were possible to charge Net users a few cents for downloading a Web page, companies could and probably would start charging for their products.

Similarly, the CyberCoin system allows computer users to make direct consumer-to-merchant purchases. To use CyberCoin, a consumer must have either a credit card or a checking account. Money can be transferred from either of those accounts into the CyberCoin wallet in increments of $20 without incurring a fee, said Larry Gilbert, CyberCash's Vice President and General Manager of CyberCoin.

To make a purchase, a consumer clicks on a Web page; a window appears on the user's screen and asks whether or not the user wishes to make a purchase for a particular amount of money. When the user approves the purchase, money is transferred from the user's CyberCash wallet to the merchant's.

FDIC-insured

''The money is actually stored in a bank,'' said Gilbert. ''We have a ruling from the FDIC that the funds in the system are FDIC-insured.''

CyberCash has made arrangements with several financial institutions to provide the coin service to their customers: Bank of Hawaii, First Data Merchant Services, First Union Corp., First USA Paymentech, PNC Bank, UnifiedMerchant Services (a division of NationsBank), US Bancorp and Wachovia Corp.

CyberCash intends to make its money by charging a transaction fee to banks for processing their electronic payments; those fees will in turn be passed on to merchants who accept payments using the service. It is a system similar to ones used by credit card companies.

''The suggested retail price starts at 8 cents for a 25-cent transaction, and goes to 31 cents for a $10 transaction,'' said Gilbert. ''Transactions over $10 are possible. We have a pricing schedule for those, but our market research indicates that most consumers, once they break the $10 barrier, will probably opt for (making their payment with) credit cards.''

The CyberCash software can also be configured so that charges are approved automatically, without the user's permission each and every time. This might be ideal for people who don't want to be bothered by their computers asking them to approve a 25-cent charge every time they download a Web page.

Encryption algorithm

Both the CyberCash coin and credit-card systems use a sophisticated encryption algorithm to prevent eavesdropping on payment information as it is sent over the Net. Last year, the U.S. government gave CyberCash permission to export its software because it can only be used to encrypt financial transactions.

The CyberCoin isn't the first digital currency to debut on the Net. Since last October, the Mark Twain Bank of St. Louis has been signing up people for its ECash accounts, based on technology invented by software programmer David Chaum, who is widely regarded to be the inventor of digital cash.

Meanwhile, First Virtual Holdings of San Diego has been giving out accounts for its VirtualPIN, a payment system based on credit cards, for nearly two years. Unlike CyberCash, First Virtual does not use encryption and does not require special software to be installed on a consumer's computer.

For more than a year, another CyberCash system for making digital payments has been available on the Internet. There are 74 merchants listed on the company's Web site who accept payments made with the system. By contrast, more than 200 merchants around the world have signed up to use the ECash system.

Daniel M. Eldridge, vice president for digital money at DigiCash, which makes the ECash payment system, said that he welcomes CyberCash to the world of digital money, but wishes that the company had not called its new product a ''coin.'' Unlike the ECash system, CyberCash requires users to provide their bank account numbers and other information so they can transfer money into their CyberCash accounts. The ECash system uses a pre-payment system that does not require users to reveal their names, so it is arguably closer in function to a true ''cash'' transaction.

CyberCoin is ''a debit product, it's not a coin product,'' said Eldridge. ''It lacks the privacy'' of the ECash system.

Audit trail

Gilbert disagrees, saying that the CyberCoin service offers privacy but not anonymity. The system does not tell a CyberCash merchant the name of the person spending the CyberCoin, but there is a detailed audit trail that is kept. A bank sponsoring a CyberCoin service can learn the name of any person who engages in a transaction at any time.

Indeed, the bank needs to know this information in order to move money from the consumer's account to the merchant's account. But banks are expected to keep this information confidential, just as they do with checks.

''It completely preserves privacy under all circumstances, unless you are the target of a law enforcement investigation. And even then, there is a high level of privacy preserved,'' Gilbert said, explaining that the system only records the amount of money spent and not what was purchased.

One problem that neither CyberCash nor other electronic cash systems solve, however, is how to store the secret encryption keys that are required to authorize transactions over the Net.

Currently, both systems store a user's secret codes on the user's own computer. Although the encryption keys are themselves encrypted, they need to be decrypted in order to be used. And the moment they are decrypted, they are vulnerable to attack by computer viruses and other kinds of rogue programs.

Solving this problem requires not software, but hardware.



| Mercury Center Home | Index | Feedback | NewsLibrary |
1996 Mercury Center. The information you receive on-line from Mercury Center is protected by the copyright laws of the United States. The copyright laws prohibit any copying, redistributing, retransmitting, or repurposing of any copyright-protected material.