Moderator (MDR): MDR-ErikaStuart

Guest-Speaker (SPK): SPK-Ted Goldstein

MDR-ErikaStuart: Hello, and welcome to the Java Developer Connection "Java Live." Today we have members of the Java Electronic Commerce Framework with us. Feel free to send in your questions as we get the team members connected.

uomini: Looks like the chat interface changed...how do I talk to the group?

MDR-ErikaStuart: This is a moderated forum, which means that you can send comments to me, and I'll forward them to the room.

We are experiencing a bit of delay while we get the JECF members onto machines for today's forum. It should only be a few minutes. And now we have our first JECF member on with us!

SPK-Ted Goldstein: Hello Java Developers!

MDR-ErikaStuart: Hi Ted. We have a few comments that have come in, as well as a question.

qazwsxed: My name is Scott, by the way, and I work at Triumphant Enterprises

MDR-ErikaStuart: Ted, would you like to describe the JECF project (briefly) to give a summary to the JDC members?

SPK-Ted Goldstein: JECF is a new platform for commerce. Think of it as an operating system for applications that deal with money. Our goal is to allow users to spend and receive money as easily as it is to click on a web page.

We want to provide a way for application developers from different companies to cooperate in creating trusted applications.

MDR-ErikaStuart: Great, thanks Ted. Here's our first question.

qazwsxed: When will the CardAPI and others like it be available to program with?

SPK-Ted Goldstein: Scott, you raise a good point about smart cards. There
are two separate APIs: one is for programming on browsers to access smart cards; the other is Java Card, which is Java actually running on the smart card. The first Java Card implementation will be shipped by Schlumberger second quarter of next year. Of course, you should start writing applications for it right away. The interface from Java browsers to smart cards will be released very soon (in the next four weeks or so).

francoisdeza: When will the first implementation of JECF be released?

SPK-Ted Goldstein: Alpha will be available to the public first quarter of 1997. But we are dependent upon the JDK1.1 release as well.

uomini: Does JECF allow for cross-currency/cross-country commerce?

SPK-Ted Goldstein: Yes and no. JECF is designed to be an international product. But the payment instruments that JECF provides access to often have restrictions. These restrictions are based on business rules, cross company policies, and governmental regulations. For example, currency exchange via credit card and debit card payments over the Internet will be much like what it is in the physical world. This is not ideal. Visa and MasterCard don't give you an exchange rate until settlement occurs. That is often two or three days after the transaction. Of course, this is a business opportunity for new payment mechanisms that can do immediate currency exchange. Smart cards are very interesting technology (VisaCash, Mondex, Proton). These will lead to currency exchange web sites. Interested?

uomini: Yes...keep talking! I'm getting ideas.

francoisdeza: Will JDC members have access to it earlier?

MDR-ErikaStuart: We are working on getting early releases for JDC members. If there's a product ready to go, we will try and get it. A more formal program will be in place soon.

SPK-Ted Goldstein: There is also a Cassette Partners program designed for payment company providers. We are plowing the ground for application developers. The banks have to be open for business first.

I'd like to talk a little bit about the roles in JECF. There are three kinds of developers. Merchant applet developers. Payment Cassette Developers. Service Cassette Developers. Most people will be Merchant applet developers. They are building tools to provide product to accept money. Product an be either information content or phsyical world stuff. Payment Cassette providers are credit card companies and other "bank" like institutions. CyberCash, First Virtual, Digicash, Visa, Mondex, MasterCard are all examples of these. The third category of Service Cassette providers are folks who build financial applications. These include home banking, tax reporting, brokerage, and financial advisor software. But it also should include medical and pycho-social applications that need the same kind of security and privacy infrastructure.

uomini: This currency exchange web site idea is intriguing, but I'm not sure how it would work. For example, would I connect to the site, give it my card number and amount to convert, and then have the converted funds
kept in some online account somewhere? Or would the funds get downloaded to
the card for immediate spending?

SPK-Ted Goldstein: Let me say a little bit about smart cards. Smart cards are computer chips that are tamper resistant (not tamper proof). Banks are willing to store money on the chip. Some cards can hold more than one kind of currency. So I can go to a website and exchange $20 in U.S. dollars for some number of Yen. The money would be transfered over the net in both directions back to me. Another way is that the web site might serve as a proxy for the transaction, and would allow a three party payment scheme. Having an intermediary would also serve as a way to maintain privacy and achieve escrow.

qazwsxed: How can one get the Java Card Implementation to interface with the smart card?

SPK-Ted Goldstein: Java on the smart card will speak a protocol called ISO7816-4. This is also the protocol that the JECF package java.commerce.smartcard speaks. That package will be available with the JECF. It handles coping with the smart card reader and device management. (Similar in spirit to PCSC).

qazwsxed: Who are payment company providers? Banks that give merchant accounts?

SPK-Ted Goldstein: Yes. All of the card associations (Visa and MasterCard) and their member banks. There is also a lot of private label cards. The smartcard companies see the Internet as a golden opportunity. Companies like CyberCash and First Virtual are really front-end businesses for the credit card companies. There is also a big opportunity for private label currencies for internal company use. For example, we want to pay for the Sun computer network time with "Sun bucks." That way we can "bid" for better bandwidth and service. This will be a way to get better response time both inside the Intranet and across the worldwide Internet. (Has anyone noticed that we could use this right now?)

JohnEng: How does JECF handle security? Does it tie in with the new security APIs of JDK 1.1?

SPK-Ted Goldstein: Yes. We build upon the signed code and signed Jar file of JDK1.1. We use the signatures in a slightly different way. We allow the application code to test to see if the caller has been signed with a given signature. For the full story see the web page at http://java.sun.com/commerce. The model is called "The Gateway." It is an extension to the JDK 1.1 that allows Java objects to be used for something called Capabilities.

francoisdeza: Does JECF rely in any way on the difficulty of decompiling bytecode?

calvin: Won't a Java API in a smart card be worth attacking by a hacker? I mean the code is pretty much decompilable and is a well documented language.

SPK-Ted Goldstein: We never depend upon "Security through Obscurity." In other words, we assume that even a junior hacker will be able to read the byte codes and figure out the algorithms that are used in any security system. The secret that is worth protecting are private digital keys. These private keys are never transmitted in the clear over the network. They are even kept hidden in the JECF encrypted database. We expect hackers to attack the system by decompiling the byte code. In fact, we want people to read the source code of the JECF and vette it. We will pay people in net.fame for any security bugs. We will give it out gold stars, coffee cups and a line on the lucky individuals resume. ;-)

ACharles: How do U.S. import/export restrictions play into the picture? For that matter, do any countries have import/export rules?

SPK-Ted Goldstein: Good question. Its a big pain for encryption. Fortunately, financial crypto using applications can qualify for export of strong crypto. Consult an attorney for more details.

qazwsxed: What is Ted Goldstein's role on the JECF team?

SPK-Ted Goldstein: I run the place.

MDR-ErikaStuart: Ted is the Chief Java Commerce Officer, by the way.

aurora: Is JavaWallet going to be a direct competitor of other online payment strategies like Cybercash, or do you see it more as a complimentary technology?

SPK-Ted Goldstein: CyberCash and other wallet makers are our partners. They like the idea of getting out of the software distribution business. CyberCash just sent out a press release today talking about their role in helping us create the Java Wallet and their endorsement of the technology.

MDR-ErikaStuart: I'd like to take the opportunity to thank Ted Goldstein and Jon Ziegler (who was also participating in the answers). This has been a very interesting forum. As always, the transcripts will be posted on the JDC website.

SPK-Ted Goldstein: Thank you everyone. Please send email to commerce@java.sun.com and please indicate that you are a JDC member. Thanks!!! Ted & Jon.

MDR-ErikaStuart: See you next week!