Official Digital Certificates Exit Today... Complex Programs and Passwords 'Out'

OK with Iris or Fingerprint Instead of Complex Passwords Over 10 Characters
Private Authentication Certificates Available for Financial Services Instead of Complex Programs or Passwords

[Image source=Yonhap News]

[Asia Economy Reporter Park Sun-mi] Starting from the 10th, the amended Electronic Signature Act will come into effect. With the government's removal of the exclusive status previously granted to the public certification authority, the era of verifying identity online solely through certificates issued by the six authorized certification agencies is coming to an end.

Instead of the complicated and cumbersome public certificates that required ActiveX installation, financial transactions will now be possible through simple private company certificates.

According to the Ministry of Science and ICT and the financial sector, the amended Electronic Signature Act will be enforced from this day. The public electronic signature system, which had granted authority only to public certificates issued by six agencies including Korea Information Certificate Authority, will be abolished. Consequently, identity verification can now be done through various private company certification services instead of public certificates.

For banking services, the Financial Certification Service can be used. The Financial Certification Service is a private certification service jointly operated by the Korea Financial Telecommunications & Clearings Institute (KFTC) and the banking sector. The KFTC, which previously managed public certificates, will implement the Financial Certification Service in line with the enforcement of the amended Electronic Signature Act.

The Financial Certification Service issues and stores financial certificates securely in KFTC's cloud, allowing users to access the cloud anytime and anywhere via PC or mobile devices. Once a financial certificate is issued, it can be used at 22 banks and card companies. Based on the full-scale launch in the banking sector on the 10th, KFTC plans to continuously expand the institutions where the service can be used, including Government24, the National Petition Portal, Subscription Home, and Hometax.

The Financial Certification Service is implemented using web standards (HTML5), offering convenience without the need to install separate applications or plugins. Financial certificates are issued after thorough identity verification either face-to-face or non-face-to-face at banks, ensuring the same reliability as public certificates. Additionally, instead of complex passwords of 10 or more characters, biometric information such as iris or fingerprint or simple passwords (PIN) can be used. Financial certificates are encrypted and stored in the cloud, and movement or copying of the certificates is prohibited, enhancing security.

Only one financial certificate is needed regardless of the bank. Public certificates issued before the 10th can also be used together.

There had been criticisms that existing public certificates required annual renewal and were difficult to manage. There were also complaints about difficulties using them on various devices or from abroad. For example, in 2014, the so-called 'Cheon Song-yi Coat' became very popular due to a drama, but foreigners accessing Korean shopping malls could not purchase the coat because they could not obtain a public certificate. Furthermore, the dominant position of public certificates was said to hinder the development of the private electronic certification market.

Only One Certificate Needed Regardless of Bank

With the abolition of public certificates, the variety of usable certificates will increase.

Public institutions and financial institutions will also be able to choose from various private companies' certificates such as KakaoPay, Pass, and NHN Payco. Various private companies including Kakao, Naver, and the three major telecom companies have already launched private certificates. Among them, the Pass certificate jointly launched by the three telecom companies recorded a cumulative issuance of 20 million as of the end of last month. IT companies like Naver and Toss have also entered the electronic signature market by launching private certificates.

The financial sector is actively developing and launching certification services. The competition for leadership in the financial sector to be recognized as the national certificate, emphasizing convenience and security, is becoming increasingly fierce. With the abolition of public certificates after 21 years, consumers' choices are expected to expand significantly.

Among banks, KB Kookmin Bank has so far entered the market relatively quickly. KB Kookmin Bank launched 'KB Mobile Authentication' in July last year, with nearly 5.5 million subscribers reported. Users can log in using biometric or pattern recognition and conduct financial transactions without one-time password generators (OTP) or security cards. It has no expiration date, so renewal is not required.

Hana Bank introduced a face recognition service usable regardless of phone model in August, and NH Nonghyup Bank launched a simple authentication service called 'NH One Pass' earlier this month. IBK Industrial Bank is applying 'IBK Mobile Certificate' to its 'i-ONE Bank' app. Other banks are expected to release new authentication services soon.

The card industry is also pushing to enter the private certification market.

Shinhan Card is developing a private certificate aiming for release in the first quarter of next year. Shinhan Card believes it can secure versatility based on its 26.8 million customers. KB Kookmin Card plans to focus on expanding the authentication service launched by KB Kookmin Bank. Hana Card has a similar strategy. Woori Card currently provides its own authentication services such as biometric authentication and card touch authentication and plans to secure additional authentication services in the future.