Re: LYNX-DEV Do SureTrade, e.Schwab, or Wells Fargo Online work with SSL?

[William Fulmor]

On Sun, 15 Mar 1998, David Woolley wrote:

> > I can't speak to Schwab or WFO specifically, but Ameritrade works with
> > lynxssl (or did in Dec).  Unfortunately, my new ISP hasn't yet added the
> > ssl.  <sigh>
> 
> Two problems here.  One is that you are not protecting the second most
> vulnerable stage of the connection (the most vulnerable is probably the
> destination), and the second is that this would be commercial use++,
> which would be a breach of the RSAREF licence and/or the RSA patent.
> On the first point, I think you would bear all the financial risk in
> case of fraud, as they could argue that you were not taking reasonable
> precautions.  It would be more honest to request permission to use a
> non-SSL connection.

Since I use it *only* to review my account, and *never* to make
transactions, I did, in fact, request non-SSL connection.  But they are
interested in keeping the general public away from 'members only'
research, etc and declined to implement a more open link.  But I take your
point.

> ++I think it is unambiguously commercial use.  Any use to access a bank is
> commercial use, but it is possible that the copyright owners** have a more
> restrictive definition and probable that it would be counterproductive to
> sue individuals, but this would be use by the ISP, presumably a commercial
> organisation.

Do you mean that *my* use is commercial, and that *I* would be violating
the copyright, or do you mean my ISP, by providing an SSL enabled lynx,
and charging me a fee for access including the use of the SSL enabled lynx
would be violating copyright?  Or both? Emphasis added to stress different
entities, not to reflect umbrage.

If my individual use is a violation, then so too would my use of SSL
enabled lynx to sign up with the WSJ have been a violation.  (I don't
need SSL to *read* the on-line edition, but I did need SSL to sign up, and
I believe I need it to reconfigure some of the customized features).  If
that is the case, what is the value of SSL to any but experimenters?

If it is the use by my ISP which is the violation, would it be possible
for me to maintain the SSL part in my account workspace, for my own
exclusive use.  I have no idea how this could be acomplished technically,
but would it remedy the legal problem?
  
> **(I can't remember whether it is RSA Data Security Inc, or Public Key Data
> Systems who own the patent and copyright, although they are probably related
> companies, anyway.)