Mind the gap in Wap security

Concern is growing among users and analysts over the security and compatibility offered by wireless application protocol (Wap) services.

"In an ideal world, we'd wait nine to 12 months, but the carriers are pushing Wap. We have to give customers what they demand," said Jonathan Etheridge, head of e-futures at First Direct, which is launching a Wap banking service in July.

First Direct was able to overcome its security problems only by working closely with BT Cellnet.

Wap traffic is encrypted between the handset and the Wap gateway, and then decrypted at the gateway to find out where to direct the traffic.

It is then re-encrypted and delivered. "Wap 1.1 does not offer end-to-end security, and there is potential for weakness. Most companies haven't realised the security problems," said Etheridge.

"We have a security hole at the Wap gateway. If you are a corporate and own the gateway, that's fine, but the operator wants to hold on to the gateway. We will have an interesting war over this in future, because the corporates are a bit suspicious of the service providers," added Paul Turton, head of advanced telecoms at Computer Sciences.

In addition, some phones rely on users to set settings, further reducing security.

"As we see it, Wap is not a usable platform in its current form. However, it is a good way for content providers to experiment before the arrival of GPRS (general packet radio service) and UTMS-based systems," noted Andy Butler, research director at analyst GartnerGroup.

Prudential has launched a listing of its services on Wap. "This is the first step to giving customers access. Security is not an issue at the moment. But if we were going to offer account details, we would have to make sure there was no security issue at all," said Andy Lucas, ecommerce manager at Prudential.

"For any sort of mobile ecommerce transaction, it is best to wait until Wap 1.2 is deployed - probably in the middle of next year," added IDC analyst Tim Sheedy.

Backward-compatibility with existing phones is unlikely because of the need for additional memory, and is likely to cause additional complications, said Sheedy.

"A lot of it is about mindshare at the moment. BT Cellnet is positioning itself as a mobile Internet company. So, if you want to be known in the same way, you should be building your profile now."