Category Archives: Korea

Why South Korea is really an internet dinosaur

The Economist explains: Why South Korea is really an internet dinosaur

Last year Freedom House, an American NGO, ranked South Korea’s internet as only “partly free”. Reporters without Borders has placed it on a list of countries “under surveillance”, alongside Egypt, Thailand and Russia, in its report on “Enemies of the Internet”. Is forward-looking South Korea actually rather backward?

2012 update to the 2007 Cost of Monoculture in Korea

Back in 2007, I published the cost of monoculture, a blog post that was the first English-language explanation of the situation in South Korea where a series of independent decisions created a de facto monopoly for Microsoft Internet Explorer. The blog post was widely covered in 2007, in Salon, Slashdot, Boing Boing, etc.
Fast forward 5+ years to the late part of 2012 and basically nothing has changed. In fact, things are so bad in Korea that a candidate for the President of Korea, Ahn Cheol-soo, has taken the position that if he were voted in, he would abolish the laws that have locked Korea to Microsoft Internet Explorer.

Ahn Pledges To Wipe Out South Korea’s Outdated Internet Encryption Rule – Korea Real Time – WSJ

Internet Explorer becomes Korean election issue • The Register

Sure this candidate is from the IT/software field, but the fact that his platform has this position says that this is still a painful issue for most people in Korea today. It’s stunning that the Korean government has not proactively moved away from Active-X plugins when Microsoft themselves are deprecating this technology in Windows 8 and Internet Explorer 10.

 

browser competition in Korea in 2012

The Korea Times has a new article on the popularity of Google Chrome in Korea.

In Korea, though Internet Explorer is still overwhelming other top browsers such as Firefox, Safari and Maxthon, Chrome is beginning to emerge as a possible contender.

In April 2011, 91.93 percent of Korean users used Internet Explorer, while only 4.33 percent used Chrome. Some had never even heard of others browsers used overseas.

In April this year, Chrome accounted for 13.88 percent of domestic users, the only browser to reach the double digits to challenge Internet Explorer’s 78 percent.

Chrome gaining fast against Explorer

While it’s encouraging to see that browser competition in Korea is changing, I don’t understand this comment about “toolbars.”

Another downside of Internet Explorer, besides the need to agree to an authorized certificate for monetary transactions is the need to install toolbars. To access popular Web portals such as Naver or Daum, users are required to install provided toolbars, which are now considered cumbersome by those who have other new options open to them.

Chrome has the advantage of not needing tool bars, unlike Internet Explorer and Firefox, among others.

I don’t understand the requirement to download a toolbar in order to access a website. Is this a real requirement or just an attempt by the portal to push their toolbar onto the user? Maybe my Korean readers can help explain this?

 

Mozilla at Future Web Forum 2010 – Korea

Just a quick note to those who might be in Seoul this week that Mozilla will be co-sponsoring the Future Web Forum 2010 event on HTML 5 on November 3rd.  Mitchell Baker and I spoke at this event in 2008 with Vint Cerf.  Channy Yun, who leads the Mozilla Korea community will be speaking about the HTML5 support in Firefox 4.  This is the premier event covering the web browser space in Korea and we are glad to see a focus on HTML5 in Korea.

Korean banks starting cross-browser services

Just a quick note to those who are interested in a status update from Korea. Kim Tong-hyung writes in the Korea Times that a number of major Korean banks are moving towards e-banking systems that will be cross-browser compatible vs. what is available today, which is IE.

The short story is that online banking with Firefox or Chrome is still a long-way off, but we can now foresee such a future, whereas before the changes by the Korea Communication Commission (KCC), such a future was impossible to consider.

“There have been complaints from computer users with non-IE browsers and our goal is to provide our Internet banking services to those with any browser,’’ said an IBK [Industrial Bank of Korea] official.

Existing local regulations require all encrypted online communications to be based on electronic signatures that are enabled through public-key infrastructures. And since the fall of Netscape in the early 2000s, Microsoft’s Active-X technology, used on its Internet Explorer (IE) Web browsers, remains the only plug-in tool used to download public-key certificates onto computers.

This prevented users of non-Microsoft browsers such as Firefox and Chrome from banking and purchasing products online. And computer security experts have also claimed that public-key certificates don’t add anything to security beyond a simple password gateway, which make them worse than useless as they create the illusion of safety where there is none.

and

Pressured by the calls to provide more flexibility in Internet security technologies, the Korea Communication Commission (KCC) announced it would allow other verification methods besides public-key certificates for protecting encrypted communication, which motivated companies like Woori Bank to differentiate.

Woori Bank’s new Internet banking system appears to be well-received, with the bank garnering 40,000 new customers just a month into the changes. And with a variety of banks, including IBK, Shinhan, Kookmin and SC First Bank, already providing non-Microsoft online banking services for smartphones, the transition toward an open Internet banking structure appears to be gaining pace.

Online banking wiggles out of Microsoft chokehold (The Korea Times)

quick update on Korea

Kim Tong-hyung, staff reporter for the Korea Times, is the only reporter providing English-language coverage of the news on the Microsoft monopoly in S. Korea.

I wanted to share two recent articles from Kim Tong-hyung, one covering the event that Mozilla’s Lucas Adamski attended at the end of April and another covering the “anti-virus” industry in Korea, which is one of the incumbent industries that would be significantly negatively affected if the Korean government moved away from the current PKI-based encryption architecture.

Experts Say Specific Tech Mandates Make [Korean] Internet Banking Vulnerable

“There is danger in relying on technology too much, and specific technology in that,” Schneier said, stressing that the government should be commanding “results,” rather than technologies, from banks and credit-card companies in their efforts to provide better user protection.

“Once a law mandates specific technologies such as protocol, applications or software, innovation stops. Companies know they will be okay as long as they do everything that the law says, and they will not figure out ways to make things more secure.

and

Lucas Adamski, who heads the software security team at Mozilla, which backs the Firefox Web browser, said online banking and e-commerce providers should consider redesigning their Web pages to support HTTPS, or HTTP Secure.

“Supporting HTTPS comes with many benefits. The server is authenticated to ensure the user is talking to the server they think are talking to, before any content is sent or received,” Adamski said.

“The browser will not normally send or receive any content from a Web site with an invalid or expired certificate or if the certificate does not match the server name. This means that there is no opportunity for a man-in-the-middle (MITM) injection attack to happen in the first place.”

Is AhnLab to blame for online banking mess?

Kim Kee-chang, a Korea University law professor who had led a series of unsuccessful lawsuits against the government over the overwhelming Active-X use, is absolutely merciless when describing the role of AhnLab and other anti-virus firms in the whole mess.

“Anti-virus firms are the only ones who are benefiting from the current Internet banking structure, which itself happens to be the biggest fraud of all. This system is all about creating an illusion of security that essentially does nothing other than allowing these software makers to make easy money off aging technology,” Kim said in a recent interview with The Korea Times.

“It’s depressing to see these so-called Internet technology experts sinking so low, sacrificing their morality to the last ounce in pursuit of profit. They have government officials in their pockets, as nobody ever accuses bureaucrats of having a bright understanding of technology,” he said, emphasizing that it was the anti-virus firms that chose plug-ins as the method to provide the required security programs to banks and computer users.

the Security of Internet Banking in South Korea in 2010

For those of you who have followed my blog, you know that it has been 3 years since I first reported on the fact that Korea does not use SSL for secure transactions over the Interent but instead a PKI mechanism that limits users to the Windows OS and Internet Explorer as a browser. Nothing fundamentally has changed but there are new pressures on the status quo that may break open South Korean for competition in the browser market in the future.

In fact, one of the new pressures on the status quo has been the popularity of the iPhone in South Korea, which wasn’t available officially until late 2009 due to a different Korean software middle-ware requirement, WIPI, which has since been deprecated. With WIPI dead and buried, Apple released the iPhone to great fanfare in the Korean market and Blackberry has also launched in the Korean market.

Another pressure on the status quo was a recent report out from 3 researchers (Hyoungshick Kim, Jun Ho Huh and Ross Anderson) from the University of Oxford’s Computing Laboratory, “On the Security of Internet Banking in South Korea.

South Korean Internet banking systems have a unique way of enforcing security controls. Users are obliged to install proprietary security software – typically an ActiveX plugin that implements a bundle of protection mechanisms in the user’s browser. The banks and their software suppliers claim that this provides trustworthy user platforms. One side-effect is that almost everyone in Korea uses IE rather than other browsers.

We conducted a survey of bank customers who use both Korean and other banking services, and found that the Korean banks’ proprietary mechanisms impose significant usability penalties. Usability here is strongly correlated with compatability: Korean users have become stuck in an isolated backwater, and have not benefited from all the advances in mainstream browser and security technology. The proprietary mechanisms fail to provide a trustworthy platform; what’s more, alternative strategies based on trustworthy computing techniques are quite likely to suffer from the same usability problems. We conclude that transaction authentication may be the least bad of the available options.

The popularity of the iPhone (the press claims 500,000 units sold in the few months since it was released) resurfaced the issue that only Windows and IE can be used to make secure transactions with Korean Internet services. iPhone/Blackberry/Android users in Korea (not to mention Firefox/Opera/Safari/Chrome users) cannot bank online or purchase items online or do any secure transaction with the smartphone browser because Korean services only support the PKI mechanism that only works with Active-X in IE and Windows.

Dr. Keechang Kim of Korea University has been working tirelessly for many years to try to change the status quo in Korea around browsers and the reliance on a PKI mechanism that is tied to one platform. With concern being raised by different parts of the Korean government, including the Korean Communications Commission as well as the Office of the President of Korea, Keechang has gathered a very interesting panel of presentations for April 29th in Seoul.  The panelists will be addressing the (Korean) Financial Supervisory Service (FSS) which is the regulatory body in Korea that is currently mandating the PKI mechanism that is in place today (which requires Active-X, etc.)  Unless the FSS relaxes or changes their regulations, Korean banks cannot offer other mechanisms for Korean users to bank online, etc.  In short, unless the FSS changes their stance, nothing will change in Korea.

Security Issues of Online Banking & Payment in Korea” is an open public meeting (registration recommended) starting at 10 AM on April 29th at COEX Conference Hall E1 and will feature:

  • Bruce Schneier (Chief Security Technology Officer, BT) on “Security: What Works, What Doesn’t, and Why”
  • Hyoungshick Kim, Jun Ho Huh (Univ. of Oxford) “What’s the danger of mandating proprietary security solutions?”
  • Lucas Adamski (Dir. Security Engineering, Mozilla) on “Securing Browser Interactions”

Again this meeting is open to the public. Anyone is welcome to attend.

While I have no illusions that one meeting will get the key Korean government entities to do a 180 from their current stance, I do think this will be an important opportunity to bring external, Korean and non-Korean security expertise to Korea to discuss the current state of affairs and show that a PKI-based security architecture is only as secure as the computers that those certificates are used on.  If the computers are compromised, and at least one security services provider, Network Box, claims that S. Korea is the largest source for malware in the world, (Korea reigns as king of malware threats) then there is no way to be sure that the person in control of those personal certificates is the legitimate owner.

The deletion of the requirement for WIPI in Korean mobile phones opened the Korean market to the iPhone and the Blackberry and Android phones from outside of Korea.  Korean users of these new smartphones realized that they could not bank online, buy online, etc. and are now pressuring the Korean government to change the current laws which mandate a PKI-based mechanism that has been implemented with Active-X.  As the popularity of smartphones that cannot make use of the current PKI-based architecture for encryption/authentication grows in Korea, the pressure for the government to change their regulations will only mount.  The key question for Mozilla is whether the Korean government will open up to a point where Firefox and Fennec can be used in the future for secure transactions in Korea.

Thank you to Keechang and everyone in the OpenWeb.or.kr community for your tireless efforts to try to break open the Korean market. Thank you also to Channy Yun who has put aside his own schedule in order to participate and guide Lucas in Seoul.  There is still a long road to walk to an open, competitive market in S. Korea for browsers, but I am starting to see the light at the end of the tunnel.

most powerful voice in open source – Channy Yun

Channy Yun, Mozilla’s community leader in Korea and the Korean Firefox localization leader has been selected as a Mindtouch “Most Powerful Voice” in open source.  Congrats to Channy for his tireless efforts to push web standards, the open web, and promote open source in both Korea and the world.

No choice of browser in South Korea

UPDATE: Marcis has kindly provided a Belorussian translation of this post – НЯМА магчымасці выбіраць браўзар У ПАЎНОЧНАЙ КАРЭІ

As has been in the news this week and mentioned on many Mozilla blogs, the European Commission is working with Microsoft and other browser manufacturers, including Mozilla of course, to launch the web browser ballot in the EC.

To those critics of the browser ballot who would rather the free market be left completely to Adam Smith’s invisible hand, I would present to you the example of South Korea. In short, South Korea is a sad example of a Microsoft monoculture where the course of history and the lack of anti-monopoly oversight have created a nation where every computer user is a Windows user and banking or ecommerce or any secure transaction on the Internet with South Korean entities must be done with Internet Explorer on a Windows OS.

The situation in South Korea has gotten markedly worse since the government, bowing to pressure from the citizens who wanted to use the smart phones that were sold elsewhere in the world, relaxed a rule that previously required a Korea-specific middleware called WIPI, that was never going to be implemented by smart phone makers outside of Korea. Now that the WIPI requirement was gone, manufacturers like RIM and Apple can now sell Blackberries in Korea and iPhones in Korea.

But as I suspected last fall when the iPhone’s official sales in Korea was announced, the browsers in these new smart phones (be it the browser in the iPhone, the Blackberry, or the Android devices that are on sale in Korea) can’t interoperate with the Active-X based security requirements that Korean banks and ecommerce stores require. So it’s not surprising to me at all that the news from Korea since the launch of these smart phones has been universally negative regarding the requirement to use Active-X for secure web transactions in Korea.

Here’s a selection of quotes from 3 recent articles in the Korea Times:

Korea Paying Price for Microsoft Monoculture (09-23-2009)

But the land of ubiquitous broadband, feature-happy “smart” phones and ultra-cool computing devices doubles as a crusty regime where Linux, Firefox, Chrome and Opera users can’t bank or purchase products online, and where Mac users buy Windows CDs to prevent their devices being reduced to fashion items.The bizarre coexistence of advanced hardware and an outdated user environment is a result of the country’s overreliance on the technology of Microsoft, the U.S. software giant that owns the Korean computing experience like a fat kid does a cookie jar.

It is estimated that around 99 percent of Korean computers run on Microsoft’s Windows operating system, and a similar rate of Internet users rely on the company’s Internet Explorer (IE) Web browser to connect to cyberspace.

Mobile Banking Monoculture? 01-10-2010

At the center of the controversy is the [Korean] Financial Supervisory Service’s (FSS) guidelines on the safety of financial services provided on smartphones, which were finalized and announced last week.The new rules can be summarized simply ― all financial transactions on these advanced handsets will be subject to the same security requirements that control online transactions on personal computers.

The problem with this, according to critics, is that the existing legal framework was precisely what allowed Microsoft to establish a virtual monopoly in computer operating systems and Web browsers here, which is now blamed for having computer users stuck with outdated technologies and exposed to larger security risks.

Rigid Regulations Retard Mobile Wallet Era 02-10-2010

In essence, the current law states that all encrypted online communications on computers require the use of electronic signatures based on public-key certificates. And since the fall of Netscape in the early 2000s, Microsoft’s Active-X controls on its Internet Explorer (IE) Web browsers remain as the only plug-in tool to download public-key certificates to computers.

So we can see in Korea today that the lack of choice of web browser (not to mention the lack of choice of computer operating system), indeed the lack of interoperability of Korea’s secure transaction protocol on the web, means that the smart phones of today, that don’t support ActiveX, are useless in Korea for secure transactions. That means if you are an iPhone/Blackberry/Android user in Korea, you cannot bank online with a Korean bank, you cannot trade stocks on the Korean markets, you cannot shop online with a Korean Internet site. You can’t do many of the key things that these smart phones were designed to do.

So when people ask you, “why is the choice of a web browser important?” tell them that in South Korea, people don’t get a choice of what operating system to use or what web browser to use.  After you explain to them that a place without choice is South Korea, ask them again if they’d like to not have a choice and why the choice of a web browser is important.

I hope to have better news from South Korea soon.  Please watch my blog for updates on this issue and other issues facing Mozilla and the open web in Asia.

In the meantime, please be sure to visit Open To Choice.org where Mozilla’s Chair, Mitchell Baker and Mozilla’s CEO, John Lilly, explain why we at Mozilla believe that the choice of browser is a critical right for all Internet users worldwide.

opentochoice.org

Here’s a list of things that the Mozilla community is doing and which we encourage everybody to do:

• Comment on the open letter at opentochoice.org;
• Follow @opentochoice on Twitter;
• Write a post on your blog;
• Use your favorite social network to spread the word;
• Write to bloggers that you know, to local media
• Start a thread in technology and OSS related forums and mailing lists about the browser choice screen;
• Offer to localize the open letter (send an email to contact -at- opentochoice.org)
• Are you participating in local events where you can talk about choice? Do a talk, organize a booth, distribute flyers in the welcome pack, put a banner on the event page;
• Become a browser choice screen watcher: did you see the browser choice screen pop-up on your screen? send us an email, post it on your blog, Tweet about it. Give details (country, time of day, choice of browser).

TEDx Seoul – Korea Internet Galapagos

Changwon Kim, a friend of mine and a talented Internet entrepreneur who sold his blog service startup to Google in 2008 (and currently works at Google Korea), recently did a great presentation on the Korean Internet at TEDx Seoul. Changwon covers the fact that due to early broadband infrastructure and the geography of Korea, Korean companies were leading in innovations around virtual worlds, mobile Internet and social networks way before the global Internet brands that are world-wide today.  However, recently there has been less Korean innovation which has been concerning to technologists and entrepreneurs.

The video from his presentation is now online (in Windows Media) and covers some of the challenges facing the Korean Internet, including two mentions of the Microsoft browser monopoly in Korea.

TEDxSeoul Talks – [Changwon Kim] Korea Internet Galapagos