PayPal CTO: Security, mobility to spur growth
472080
(InfoWorld) - PayPal's Chief Technology Officer, Scott Thompson, is a prime example of what might be called the "payments geek." It's a label that Thompson earned the hard way, with stints at Coopers and Lybrand delivering IT solutions to financial services clients, then as CIO at Barclays Global Investors, before becoming Executive Vice President of Technology Solutions at Inovant, Visa's IT subsidiary, where he was in charge of that company's global payment system. At a company like PayPal, which prides itself on its geek culture and stringent hiring standards, being a "geek" about whatever topic you own is something that carries a lot of weight. Thompson seems right at home. But he's the first to admit that PayPal is a unique place, and that his prior payments industry experiences only prepared him so much for his current job. One of the first online payment vendors, PayPal today serves 143 million accounts spread across 190 countries. And, as parent company eBay expands its reach through the labors of its independent developer community, PayPal is planning to follow suit: releasing APIs this week that make its payments platform easier to integrate with Web-based and mobile applications, and launching a developer certification program to encourage more software developers to begin expanding on the company's platform. That makes Thompson -- who oversees PayPal's IT, product development and architecture -- a busy man. When he sat down with InfoWorld at the recent eBay Developer's Conference in Boston, Thompson said that tapping the creativity of developers is nothing new in the payments industry, and that PayPal's traditional strengths in security and online transactions will soon position the company to play with the big boys in the years to come. "Most people think Visa solved the problem of end to end payments, but it didn't. It only solved a small problem. It was others, like First Data, who arguably are the developers who extended it and added to it and make it what it is today," he said. PayPal still only handles a fraction of the payments of companies like Visa, American Express and MasterCard, Thompson noted, but its origins in the online realm give it a competitive edge against those companies, and will become increasingly valuable as the Internet becomes the default platform for transactions of all kinds, Thompson said. "We know where the Internet is today, but the question is where will the Internet be tomorrow and the day after that? If you believe that our payment system goes naturally where the Internet is, you have to believe there are more markets where our payments will naturally fit in," he said. Thompson says those markets include both e-commerce, and traditional brick and mortar stores, where retail point of sale (POS) terminals could soon be connected to the Internet and use standards like TCP/IP to communicate. Mobile payments are another area where PayPal is placing its bets. The company on Monday released new Mobile Checkout APIs that allow merchants to conduct transactions through PayPal on the "mobile Web." PayPal plans to follow the release of APIs with news, next week, that between 10 and 12 leading online merchants will use the new APIs to allow customers to do two-click purchases from mobile devices, according to Amanda Pires, PayPal's director of corporate communications. However, Thompson acknowledged that merchant adoption of mobile payment technology still lags. "The technology on the merchant side has not appeared in any numbers, though you have to believe that it will," he said. Still, with the spread of the Internet and the persistent problem of online fraud, PayPal is perfectly situated to take advantage of the explosion in online and mobile transactions. Existing magnetic stripe technology only contains a small amount of information about the card holder and his or her relationship with the card's issuing bank. However, the burgeoning world of online payments demands much more information about both buyer and seller to make sure that transactions are legitimate, Thompson notes. "You want to know who the person is on the other side of the transaction and how good the business is, and should we be extending this exchange of value to the person," he said. PayPal, more than other payments vendors, is prepared to wade into that world. The company experience in online payments and sophisticated fraud detection capabilities that rival those of companies like Visa and MasterCard. "Our system is a closed loop. We have deep information about parties on both sides -- the merchant and the buyer," he said. PayPal's flexible payments infrastructure also helps. The company built its systems from the ground up using low cost hardware and open source software. PayPal also bakes in security, with a blanket data encryption policy that covers customer information from one edge of its network to the other. Thompson credits PayPal's early founders with making the decision to go with open source and robust data encryption, and says that, almost a decade after the company was founded; those investments are paying off in a big way. For example, the company was recently able to expand operations from 103 to 190 countries without significant investments in hardware and software. The company's core systems, which run Red Hat Enterprise Linux on commodity hardware, were able to handle the change without a hiccup. "(Open source) gives us a strategic advantage in the cost of global infrastructure compared with other payments companies. It's just phenomenal," Thompson said. At the same time, PayPal's blanket customer data encryption policy has simplified security planning compared with legacy payments firms, which came of age before online payments and have had to retrofit security onto aging applications and infrastructure, Thompson said. "One thing I don't think the guys who started this really fully contemplated is that when have that type of (security) posture, it's easier to do what we do, because there are no exceptions. If it's customer data, it's fully encrypted. If it's an application that needs to access that data, then the application has to be fully secured and have its privileges monitored," he said. Still, Thompson admits that there's still much work to be done. Despite advancements in technology that can detect fraud and phishing attacks, PayPal still hasn't "turned the corner" in its fight against online crime, he admitted. While eBay and PayPal now digitally signs each of the six billion e-mails they send out each year, Thompson said he couldn't point to evidence of a slowdown in phishing attacks. PayPal customers have shown an interest in so-called "second factor" authentication devices, such as VeriSign one-time password generators, part of a deal with VeriSign in October, 2005. After a beta test and initial marketing in Germany, PayPal has issued thousands of the secure token devices and has had to increase orders to VeriSign to keep up with demand, Thompson said. "The uptake was really surprising," he said. Thompson was less sanguine about the effects of e-mail authentication regimes like Microsoft's Sender ID. eBay and PayPal are testing e-mail blocking based on signatures with two ISPs and, in the coming months, plan to talk with more ISPs about their findings, and suggest that they also look at implementing blocking of non-signed messages from eBay and PayPal. The company is planning an announcement with large ISPs in the coming months that will "get them on board" with e-mail authentication and make the use of authentication and e-mail blocking for non-authenticated messages a priority, said Pires. But most of the real innovation will come from outside PayPal, Thompson admits, thanks to the efforts of the thousands of developers and entrepreneurs who jammed Boston's Convention Center this week for eBay's Developer Conference. "I don't want them thinking in a confined way about what developer can do â¦You can take the payments system we have and the other properties of eBay that we have and do some next-generation thinking," he said. "There's no shortage of innovation and creativity and flat-out great ideas that this group of people has," Thompson said. "It just expands your mind to hear what these guys think about and what they're working on -- not just in the U.S. but all kinds of places. It's just fantastic."ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
683258
Paypal security chief Michael Barrett says that his company is slowly turning the tide against phishing.
672085
(InfoWorld) - At next week's RSA Conference in San Francisco smart card vendor GemaltoÂ will introduce new technology designed to give online shoppers an easy way to log on to their accounts using a smart card device that plugs into any PC. Gemalto, based in Amsterdam, is already a major provider of smart cards to government and the enterprise, but the company hopes that its new system, called the Network Identity Manager, will be easy enough to use that it will appeal to consumers. The USB devices will not require any specialized software and will work with standard browsers and use the same Transport Layer Security (TLS) mechanisms already used by Web sites. Network Identity Manager will also use a "token management system" that will sort out which credentials need to be supplied to different Web sites, and will support Verisign's VIP Network Identity federation framework, according to Gemalto's Web site. Because the user has to have the smart card device plugged into the PC before logging onto an online bank or e-commerce site, the device willÂ thwart many common identity theft tacticsÂ including phishing or keylogging, according to Amol Deshmukh, a marketing manager with Gemalto. "It can create a much stronger link with whatever back-end you're trying to connect with," he said. Gemalto may face a tough sell, according to Avivah Litan, a GartnerÂ analyst. While, products like the Network Identity Manager will provide protection from many types of attacks, but so far U.S. banks have not been clamoring for this kind of USB device, she said. Still, as phishing losses continue to rise, U.S. financial institutions have been offering their customersÂ more secure ways to log onÂ to their Web portals. In 2005 ETrade Financial began giving customers RSA Security's SecurID tokens, which generate a random numerical identification number that users must enter in order to log onto the ETrade network. EBay's PayPal plans to introduce a similar system to its customers in the coming months. But the USB device vendors said that consumers will not be willing to lug around too many of these devices. "It seems very complicated," said Ron LaPedis, a product manager with Sandisk. "Users don't want a plethora of tokens." Like Gemalto, Sandisk will be promoting USB products that can be used to simplify key management at next week's show, but the Sandisk products will have more of an enterprise focus. "We're going to be introducing a product that can centrally manage and secure Sandisk USB flash drives and enable secure remote access to the enterprise," LaPedis said. Sandisk already sells a USB smart card product called the mToken, but unlike Gemalto's Network Identity Manager, the Sandisk device uses flash memory to store applications on the USB device. Sandisk acquired the mToken technology as part of its November purchase of Msystems and the RSA Conference will give the flash memory maker its first opportunity to discuss what it plans to do following the $1.5 billion acquisition. Â
408052
The Zend Developer Zone has a nwe post that announces the release of the first version of an API created to interface your PHP scripts with the Website Payments Pro API from Paypal - phpPaypalPro.   It is a framework developed in PHP5 that integrates easily with the Website Payments Pro API from Paypal. Currently it supports 4 major operations available from the Website Payments Pro SOAP 1.1 API. It has taken advantage of the built-in SOAP extension available natively in PHP5 to generate the requests and interprets the responses to and from the Website Payments Pro SOAP-based web service.   Current operations supported include: DoDirectPayment, SetExpressCheckout, GetExpressCheckoutDetails and DoExpressCheckoutPayment and you can get more information about other functionality from the project's documentation. Be sure to check out the sample script and the full SourceForge page for even more Paypal interface goodness.
274882
OCTOBER 13, 2004  - Four days after its online payment Web site was slowed and only intermittently available to users due to a coding problem, PayPal.
489691
Paypal has long held the inauspicious title of the Web's most frequently spoofed phishing target, but it says it is now seeing some success in stemming the tide with user education programs and pertnership with large ISPs, and Web mail services.
672420
By MAY WONG    SAN JOSE, Calif.  -- Most members of the online payment service Paypal should be able to log on to the Web site after five days of intermittent service outages and furious repair efforts, the company said...
384334
E-commerce gets a boost with emerging interactive apps and other new online technology.
667187
Big companies exploring ways to verify identities online
72279
EBay&#39;s online payments division, PayPal, will pay $169 million for an Israeli security company specializing in detecting online fraud, the companies said Monday. The deal should close within 30 days.Fraud Sciences, a private company, has developed technology designed to differentiate between real and fraudulent transactions. That technology will be folded into&#160;PayPal&#39;s antifraud systems, which will be &quot;significantly&quot; improved this year, eBay said.Fraud Sciences&#39; Chief Operating Officer, Yossi Barak, and founders Shvat Shaked and Saar Wilf will move to PayPal&#39;s technology and fraud management teams.PayPal lets two users exchange money online via e-mail addresses. The ease at which people can transfer money has also made it one of the most highly targeted brands for phishing scams, where fraudulent Web sites mimicking real sites are set up in order to steal people&#39;s log-in details.PayPal has taken other steps to shore up its defenses. Early last year, it began offering a keychain with a one-time numeric passcode that users enter in addition to their log-in and password. The passcode expires after 30-seconds, which greatly reduces a hacker&#39;s window of opportunity to get access to someone&#39;s account.PayPal has also pushed for free e-mail providers to&#160;block e-mail sent without digital signatures. That would potentially mean fewer scam e-mails would land in people&#39;s inboxes, reducing the chance of fraud, although providers have yet to make a unified commitment.&#160;
739603
Payment system Paypal announces a tie-up with Apple's iTunes as it continues to secure new business with online retailers.
303210
InfoWorld - EBay has big plans to provide more programming tools like new SDKs and APIs to its community of about 45,000 third-party developers.
726894
Meg Whitman describes how eBay, Paypal are combating phony e-mails and Web sites that may ensnare unsuspecting users--and drive away customers.
700759
PayPal, the popular payment method on auction site eBay Inc., said Wednesday the technical problems that left many users unable to access their accounts or conduct business appear to over.
327479
iTunes signs on PayPal, just in time for the holidays.
372882
WholeSecurity Inc has released technology that the firm says can be used to block web users from inadvertently accessing phishing web sites. The company has signed eBay Inc as a flagship customer, and has the software on millions of desktops.
234112
(InfoWorld) - EBay has big plans to provide more programming tools like new SDKs and APIs to its community of about 45,000 third-party developers. The goal is to help external developers increase the volume and variety of applications they create for the company's marketplace and in particular to increase applications for eBay buyers. Max Mancini, the recently appointed senior director of platform and innovation at eBay, spoke to IDG News Service about these developer plans and about another group he heads called the Disruptive Innovation team, started last year. What follows is an edited transcript of the interview. IDG News Service: What does the Disruptive Innovation team do at eBay? Max Mancini: If we look at the evolution of innovation on eBay, it started with innovating around consumer-to-consumer commerce and the auction format online. Then over the last 5 or 6 years, eBay has had to innovate around technology just to keep up from scale and growth perspectives. So it has been focused on scalability, performance, and also search. In that sense, many of our investments and efforts around innovation have been focused on building up the platform. Now, as the company has gotten up to about 12,000 employees, what we need to do is make sure that we continue to innovate around new business and feature ideas. We have teams for each of the major eBay areas like our Buyer team, Seller team, and eBay Express team. Each team works on its own innovations, which are focused on keeping up with the customer demands and, as the market evolves, on what comes next. That's part of their normal product road maps. But my team is looking 12 to 18 months out to identify trends that we think are relevant to our business. We're creating a more structured innovation program so that when people come up with ideas, they can submit them to a database and an environment that we review on a regular basis, usually weekly or bi-weekly. And if things are pretty interesting, we're able to bring people into a rotation on an innovation team to work on their ideas. My Disruptive Innovation team is part of this. IDGNS: You head both the Disruptive Innovation team and the Developers Program. Why? Mancini: We feel that, organizationally, it made sense to combine the Developers Program and the Disruptive Innovation team because the Developers Program and Web services are things that enable us to innovate on top of eBay's marketplace platform. IDGNS: Are there any specific projects currently ongoing at the Disruptive Innovation team? Mancini: Yes. As part of our 2007 strategic planning for the company, the innovation team identified what we felt were the two most important areas for us to invest our time in: buyer experience and social commerce. Overall buyer experience is very important to us as a business, but independent of that, it's one of those areas we need to invest in because from a technology trend perspective, there's a fundamental shift in the way people expect to interact on the Internet, and we need to get ahead of that. Internet users are evolving past just going through page flows, in other words, clicking on five links to get something done: filling out a form here and going to the next page and so on. They're going to more of a rich media, interactive experience that we have traditionally seen on desktop applications but that can be delivered to the Web. Think AJAX and Flash. So we're spending a fair amount of time investing in buyer experience, specifically around rich media experiences delivered via the Web. Regarding social commerce, it's not social networking. If you look at things like LinkedIn, Plaxo, your Skype client, your AOL client, your Yahoo address book, your e-mail, all of these things define relationships you have. But no one is looking at how these relationship definitions affect trust relationships in commerce. Let's say you have tickets for sale for a local sporting event but don't want to go through the hassle of listing them. You know you have friends who might be interested in the tickets but you don't want to spam all your friends. Making those tickets available to your buddies in your IM buddy list or your address book, and letting them discover what's available out there is an interesting model. The other piece is if you're going to transact with somebody and you don't have a relationship with that person. The fact that people are comfortable sharing and defining their relationships online makes that a potential disruptor to a reputation system [like eBay's feedback system]. So it's very important from my perspective to explore and understand how these trust definitions can affect an online reputation system. IDGNS: Would this be taking eBay's feedback system to the next level? Mancini: Yes, absolutely, but it's a different angle on it. Our feedback system is based on transactions, as opposed to determining whether I can trust this person through some other relationship other than a transaction. We need to stay on top of this trend. IDGNS: A developer told me he's happy with the eBay Developers Program but that sometimes when you make changes to APIs, it forces him to adjust things on his application. Is this issue something you keep in mind when tweaking APIs? Mancini: Change management is very important to developers because they have to react and update their applications. So one of the first things I did at the Developers Program was staff up our product managers so that things don't slip by. This has happened in the past because we've had very limited product management support on APIs, and that's changing now. I've got a good team focused on that. Our general direction is that anytime we release a feature on the site, that feature should be API/Web services-enabled because our [external] developers can innovate more than we can because there are 45,000 of them and 12,000 eBay employees. So there are definitely great advantages to having a robust developer program, and we want to make sure those developers aren't getting left behind. Developers also want us to help them market their products to buyers and sellers. They invest money, time, and effort to create applications that work on top of eBay and they want some help reaching eBay users, so we're bringing aboard a full-time person to focus on nothing but helping our third-party developers market their tools to eBay users. Â