Quis custodiet ipsos custodes?

Defensoría del Consumidor is the institution that protects consumer rights in commercial transactions. One is able to file a complaint via telephone or by using an online form. The latter will ask for previous registration. It's free! However, it's neither easy nor secure.

As you can see, the online form is composed of various sections. Each one is reachable at any time while filling the form. Some validations are imposed whenever trying to navigate away from some pages.




While it's pretty obvious that an ASP.NET session is being handled (hint: a Sesame Street character crave for these ;-) ), the design during this navigation is flawed. Parameters are passed through simple HTML. I actually typed "meinpassword" as my chosen password in two password-type text fields.




As a user, this imposes a risk if you're in a public computer or network. Your password travels along the network via HTTP (no "S" here, sorry), and it will be saved in the browser's history. The user is never warned of such risk. So, who could prevent identity theft? Is there a public institution that audits these services?

We need protection from the protectors.

Still Here!

Hello, everybody!

It's been a while now. Not too much time for updating. My latest entry will be shown immediately after this one.

Data Leakage from Voting Sites

OK, so I finally got some minutes to publish this "finding".

Some of you may know that on January 18th, 2009, El Salvador had elections for mayors in all districts, and for parliament representatives. Aside from other questionable aspects of operations (personal IDs not being exhaustively checked for falsification, and others), one thing caught my attention: how easy it was to "steal" citizen information from boards near voting booths, where one was supposed to look for one's ID and photo.

I actually took some pictures of some boards with my cell phone. I was expecting to be asked to hand them over, but this was not the case. I just walked away. Here are a couple of photos (the phone camera is actually 2.0 MP, and it doesn't have any image stabilization technology, so no need to defocus or alter them to make data illegible).

 


Government entities that handle this kind of information, should be more cautious about it. Information security does not necessarily refer to IT controls and countermeasures; it really means information governance, as the valuable asset it is. Extortion cases and identity theft are common in some cities in the country, so it should make perfect sense to protect pictures and IDs.

With just a few hours from the beginning of elections, the Tribunal Supremo Electoral website is down. Many citizens who waited for the last minute to check their designated voting booth, will have to recur to other means of knowing where to go tomorrow.



This is just to show how important stress tests are when putting Web services online. Hopefully, this post won't affect any voter's decision for tomorrow.

Internet Transactions... Voidable?

I read today's newspaper. On page 41, there is a paid advertisement for new changes to the Consumer Protection Law (CPL). One of these changes addresses contracts that are established electronically: as long as the transaction occurs with both parts at a considerable distance from each other, a contract could be void within 8 days, at the consumer's will. These includes transactions made over the Internet!

So, how would this affect E-Commerce? Well, it could really boost trust in trade relationships over the Web. For most Web companies, such terms are well-known and accepted, but it's not always the case here. Asides from challenges such as Internet users representing less than 10% of the total population, lack of education in Web technologies, etc., one the current E-Commerce obstacles in the country is the distrust in electronic transactions. Users fear their credit cards will be charged, and no product/service will be delivered. They are also concerned about credit card fraud. Protection from banks and financial institutions could prove enough for most users... Although a first hand, Web company assurance is common for services such as Ebay, and really gives peace of mind to customers.

For companies, it could pose a chance to become more competitive locally, and prepare them for more outside competition. It is very uncommon to see Terms of Service, Service Level Agreements, sufficient and publicly-available policies (return, shipping, etc.) in local stores, and it's even more rare to see them in E-Commerce Web sites. Organizations will move from a product-centered perspective, to a more customer-centered philosophy. Besides, they wouldn't want people ending contracts in a disgusted manner, hurting their relationship with the company.

More to come on changes to the CPL, hopefully from the primary source: the CDC.

Service Level Agreements for the Final User

We recently hired a broadband Internet service from Turbonett. Like most companies here, they hand out a contract which is more liability-oriented, and they force its validity for a year or more, with excessive penalties for the customer if he/she should finish the contract before the specified period. There's a huge flaw in the whole business, nevertheless: there are no service level agreements (SLA).

SLAs for an ISP would include guaranteed uptime, penalties for downtimes that exceed such uptime, technical support levels like response and resolution times, information privacy, penalties for service misuse, etc. It is common sense to even include a contract invalidation statement in the aforementioned document. As with most companies here in El Salvador, this is not the case.

The Turbonett ADSL broadband Internet service contract, includes a statement that implies that the contract could be terminated if a "low quality" has been observed in service delivery. This would be fine if it wasn't so general. At the end (according to the sales representative that handed us the contract), the company would analyze any complaint the customer has regarding service, and, if such is desired, would terminate the contract. With such poor specification of "quality", it just doesn't make sense that liabilities of the service provider are at the sole discretion of it. Service could be poor, but the company wouldn't just want to lose to the customer and damage its position in the market.

We have been with one of the competitors for more than seven years. They didn't specified any SLAs, either, and I bet we could have forced a termination of one-year contracts by solely basing on the quality of the service delivered. In the first year, we experienced lots of downtimes and bandwidth problems.

Mobile and telecommunications companies alike don't usually have SLAs for the non-corporate customer, in any of their services (fixed phone lines, mobile phone lines, VoIP, hosting, etc.). We really need a change of such imposing, one-sided contracts, where the customer is hand-tied and with no options after signing. We are just tired of such bad treatment.

Pollo Campero Improves Customer Service with Wireless Devices

As customers, we always need a nice treatment. We want things fast and concise, because we need to do many things in the day. From fitness to religious activities, there's just not enough hours in the day for everything. So, if customers are in a hurry, and we couldn't hassle them with the ability of self-service (which is also one trend that retail customers are acquiring in some first world countries), why not use technology to help them get what they want as soon as possible?

About three years ago, I attended a Retail's Big Show for the first time. I saw Retelligence's S3 solutions, and what they could do to retail. One way or another, someone had to bring those ideas to El Salvador. I'm not exactly sure if they're the first company to do so, but Pollo Campero's execution of such infrastructure did impress me a few weeks back.

Waiters and waitresses at Pollo Campero restaurants are all equipped with a Symbol portable device. It has a magnetic stripe reader, and it's a fully graphical operative system. As I noticed, some authorization is needed at some point, so the waiter/waitress swipes a unique card. They quickly take the order through the device, which sends it via a wireless network to some terminal in the kitchen area. At the other "endpoint" (the aforementioned terminal), employees in other areas quickly begin preparing the customer's meal. Another waiter/waitress is ready to take products that are readily available, as quick as possible. I was really pleased to see my order of a peach mousse (yum!) and a medium-sized orange juice brought to my table in about 2 minutes…

This is the "front-end"… …and this is the device. No pictures could be taken of the "back-end", though.

Well, something went bad in the whole process: they got me a small-sized orange juice instead! As with all business processes, human interaction is always needed, so this type of small mistakes could be expected. I got another small-sized orange juice to compensate for the error, so I drank even more than I asked for! Service was so fast, I could get to do some other tasks in my laptop after eating… Well, I'll put it to real test, on a I-must-eat-as-fast-as-possible-and-get-out-of-here situation next time. I hear this system has been implemented for about six months now, so someone at the company might have already calculated costs savings, increase in customer satisfaction, and other metrics.

Kudos to the guys at Campero!