Half of shoppers abandon online trolleys over security fears

Over of half of online shopping trolley are abandoned before checkout because of security fears, according to Verisign.

Speaking at a round table debate on e-commerce, Andrew Horbury, Secure Socket Layer product manager for VeriSign said that research carried out by his company found that 54 per cent of online shoppers fail to complete transactions as people become more concerned over where their personal details might go after giving them out online.

"Most people don't know what might happen when they go shopping online," said Horbury. "They are mainly worried that their credit card details or identity might be stolen."

Others are more encouraged by the figures.

"This is promising, people are beginning to think about how secure the site they are visiting actually is," said Simon Heron, technical director of managed network security firm Network Box. "Obviously there needs to be more information and education about how to know if the site is safe but at least some people are stopping if they are unsure."

Others think that online shoppers should not be too concerned about going internet shopping this Christmas.

"Shoppers should not be worried about the security of online shopping sites as the vast majority of sites are legitimate," said James Scott, UK SME manager of e-commerce software vendor ChannelAdvisor. "However, they should be aware that no online transaction is without risk and, as one would do when shopping offline, take simple precautions if they feel suspicious about the purchase they are about to make."

He said that customer should look for a telephone number or physical address for the company they are buying from. "If they can't find it on the website, Google it or check Yell.com," said Scott.

One security company warned over one flaw for online retailers.

"Retailer log-on procedures are one area of weakness," said Ken Munro, managing director of penetration testing company SecureTest. "For example, the error message on the log-in form should always be generic. Don't distinguish between a valid/invalid username and valid/invalid password as this can provide an attacker with enough ammunition to launch an enumeration attack."

Munro said that this type of attack allowed the hacker to compare these feedback messages and use a brute force attack to crack the username and password separately.

"'Incorrect credentials entered' is a more than adequate response," said Munro.

Email to a friend

Print this page

Social Bookmark this article: What is this?

Digg

Delicious

Reddit

StumbleUpon

Slashdot

Google

Facebook