On the Security of Internet Banking in South Korea – a lesson in how not to regulate security

South Korean Internet banking systems provide an interesting natural experiment. Having been concerned at restrictions on crypto key length during the 1990s, the Korean government set up a closed security system for online banking. Users are obliged to install proprietary security software – ActiveX plugins that implement a bundle of protection mechanisms in the user’s browser. In consequence, almost everyone in Korea uses Internet Explorer rather than other browsers. We conducted a survey of bank customers who use both Korean and other banking services, and found that the Korean mechanisms impose significant usability penalties. Usability here is correlated with compatibility: Korean users have become stuck in an isolated backwater, and have not benefited from all the advances in mainstream browser and security technology. Also, the proprietary mechanisms fail to provide a trustworthy platform. We conclude that Korea should rejoin the mainstream.