Mind the gap in Wap security

Concern is growing among users and analysts over the security and compatibility offered by Wap services.

Jonathan Etheridge, head of e-futures at First Direct, which is launching a Wap banking service in July, said: "In an ideal world, we'd wait nine to 12 months, but the carriers are pushing Wap. We have to give customers what they demand."

First Direct was able to overcome its security problems only by working closely with BT Cellnet.

Wap traffic is encrypted between the handset and the Wap gateway, and then decrypted at the gateway to find out where to direct the traffic. It is then re-encrypted and delivered. "Wap 1.1 does not offer end-to-end security, and there is potential for weakness. Most companies haven't realised the security problems," said Etheridge.

Paul Turton, head of advanced telecoms at Computer Sciences, said: "We have a security hole at the Wap gateway. If you are a corporate and own the gateway, that's fine, but the operator wants to hold on to the gateway. We will have an interesting war over this in future, because the corporates are a bit suspicious of the service providers."

In addition, some phones rely on users to set settings, further reducing security.

Andy Butler, research director at analyst Gartner, said: "As we see it, Wap is not a usable platform in its current form. However, it is a good way for content providers to experiment before the arrival of GPRS [general packet radio service] and UTMS-based systems."

Prudential has launched a listing of its services on Wap. Andy Lucas, ecommerce manager at Prudential, said: "This is the first step to giving customers access. Security is not an issue at the moment. But if we were going to offer account details, we would have to make sure there was no security issue at all." IDC analyst Tim Sheedy added: "For any sort of mobile ecommerce transaction, it is best to wait until Wap 1.2 is deployed - probably in the middle of next year."

Backward-compatibility with existing phones is unlikely because of the need for additional memory, and is likely to cause additional complications, said Sheedy.

"A lot of it is about mindshare at the moment. BT Cellnet is positioning itself as a mobile internet company. So, if you want to be known in the same way, you should be building your profile now," he added.

This story has been republished from the 6 April issue of Computing