Korea's bizarre reliance on Microsoft's Active-X

Yesterday I attempted to book a KTX ticket from Incheon to Busan online and was surprised to see that Korail, among other public organizations, continues to require the download and installation of a Microsoft Active-X control in order to complete the transaction.   At that point, I gave up my attempt to book the ticket, not wanting to expose my PC to the security risk that use of Active-X entails.
The problem of Active-X has been apparent for many years, as illustrated by these prior posts.   Three years ago, then- President Park Geun-hye assembled a large group of business leaders at the Blue House and implored them to stop using Active-X.   Today it is truly amazing that this issue continues to hamper Korea's online commerce.   It is a subject of media attention again, now that the new administration of President Moon Jae-In has promised to rid the country of its reliance on Active X.  See, for example, this article in The Investor.

Part of the problem is the continued widespread use of Microsoft's old Internet Explorer browser in Korea.   As shown in the first graphic (click for a full size version) the Chrome browser overtook Explorer in early 2012 on a worldwide basis.  In sharp contrast, according to Statcounter, usage of Chrome only overtook Internet Explorer in Korea as of early 2016, a full four years later. (click on the second graphic for a full size version)  In fact, Japan and Korea are the only major economies where a large portion of the population continues to use Internet Explorer.  Microsoft's new Edge browser does not support Active X because it is a security risk and the company has warned consumers of the dangers of Active X for years.  
At this point, "bizarre" is not too strong a word to describe South Korea's entrenched reliance on Active X.  It is damaging to the economy and a major security risk.  It may relate in part to this nation's heavy concentration on hardware manufacturing and export rather than software and services.    However, the rest of the world has long since moved away from Active-X and it is long past time that South Korea does as well, before this situation becomes even more of an embarrassment.

Korea's Microsoft Monoculture: The Problems of Active X

The introduction of Apple's iPhone has helped to highlight the problem posed by Korea's continued heavy reliance on Microsoft's Internet Explorer Web browser and corresponding heavy reliance on Active-X controls for online banking and financial transactions. (see the accompanying graphic--click the graphic to see full-size version)  As noted in a Joongang Daily article today, internet users in Korea waste an untold amount of time downloading and installing security programs that use Active-X controls.  It can take five to ten minutes to install such programs in order to access a banking page.  If a program is installed once a year on ten million PCs in Korea, that could amount to one million hours of lost work time, assuming ten minutes for installation.  Since Korea's minimum wage is 4,000 won, annual losses would total 4 billion won, in that example.
The Joongang Daily article does not even mention the fact that Active-X has been recognized as a web security risk for years and therefore is not widely used in other countries.  Now, the problem is compounded with the rapid introduction of "smart phone" devices, most of which use web browsers that are not compatible with Active-X.  Clearly, something has to give here, and it would appear that it will be use of Microsoft's web browser and its proprietary Active-X technology.  This will be good for Korean consumers and will put this country more in line with global trends.

Microsoft Active-X issue in Korea Near Resolution?

President Park Geun-hye held a deregulation forum last week at the Blue House and, not surprisingly, one of the hot topics was the continued requirement by many e-commerce sites and financial institutions that users download and install Microsoft Active-X controls to complete their online transactions.  South Korea's heavy reliance on Microsoft software is the subject of many earlier posts on this blog, so the discussions at the deregulation forum obviously caught my eye.
The Korea Joongang Daily carried an informative report today that, among other things, reported the results of a nationwide poll conducted by the Federation of Korean Industries. 78.6 percent of the respondents in the poll wanted the use of Active-X to be discontinued, while only 6.7 percent opposed the idea.  As shown in the accompanying graphic, when asked whether Korea needs another program, over 80 percent said it was "necessary" or "very necessary."

Active-X was designed by Microsoft many years ago, without any real consideration of today's security concerns.   Consequently, Microsoft itself acknowledged the problem years ago and its own web site contains quite a detailed explanation of the security problems Active-X can pose.
The FKI poll also reported some interesting data that shows Active-X interferes most of all with the consumer experience of online shopping and online banking, but is also viewed as a source of "discomfort" in other transactions.  The second graphic gives a breakdown of responses.
According to the  Korea Joongang Daily article,"Choi Moon-ki, the minister of science, ICT and future planning, said in the ministry’s workshop on Saturday that it will provide an online environment and online authentication certificate without ActiveX. The ministry is expected to work closely with the Financial Supervisory Service and Financial Services Commission to find solution for ActiveX problem."

The Wall Street Journal weighs in on the Active-X issue in Korea

Yesterday I spoke with Jonathan Cheng, a Seoul-based staff reporter for the Wall Street Journal, about the  Active-X issue discussed in my previous and numerous earlier posts.  His article, published today, provides a good overview of the current status of Active-X related regulations in Korea and their possible imminent change.  I also appreciate that he used one of the more important points we discussed when quoting me.

Is Korea's mobile payment market "on the move"?

An interesting article this morning in The Korea Joongang Ilbo, headlined "Mobile pay market is on the move."  But is it really? As noted by the article, "With more customers using mobile finance services, a battle has begun in the banking and telecommunications world. KakaoTalk, the nation’s largest messenger app, plans to begin handling mobile transactions and payments as early as next month. China’s largest online payment company, Alipay, also is working to become an electronic prepayment issuer under Korean law. Financial companies are scrambling to secure customers by partnering with KakaoTalk, while at the same time continuing to develop their own electronic purses."  The article was accompanied by a graphic, included with this post (click to see a full size version) that shows the recent increase in number of registered mobile banking users, which now surpasses 40 million.  I recommend reading of the article for a quick update on current trends.
However, there is another side to this story, which is the larger picture of how financial transactions are currently being handled on South Korean web sites.  Unfortunately, there are still many institutions that cling to old, outdated and risky Microsoft software solutions, even after the government, from the President on down, have urged them to modernize and improve security for financial transactions.

To illustrate this point, I will use my personal example.  After being a happy expatriate resident of Korea and  user of Skype and its "Skype out" service for many years, I recently stopped using "Skype out" a paid service that allows you to call regular phones anywhere in the world.  The reason? Sometime after Microsoft purchased Skype, a Korean company took over responsibility for all Skype services originating in South Korea and I was asked (yes, in the Spring of 2014 and after President Park Geun-hye's meeting with business leaders on the topic of deregulation) to download and install Microsoft's Active-X control, as shown in the screen capture accompanying this post (click to see a full-size version). This pop-up screen appeared even though I was using the Chrome browser, not Internet Explorer. That was the last straw.   Microsoft itself warned the public about the inherent security risks in Active-X years ago.  Korean companies have been urged by their president to stop using Active-X and institute modern online and mobile security measures.

Persistent, excessive regulation: mobile payment problems and Active-X

I've repeatedly noted my astonishment that financial and e-commerce institutions in Korea continue to use Microsoft's Active-X controls, years after Microsoft itself issued public warnings about the dangers of using such controls.  Today The Chosun Ilbo carried an article entitled "Apple pay shows up clunky mobile payment in Korea."  The article notes that "Apple Pay is simple to use by placing a finger on the home button after registering the owner's fingerprint and checking out at the register. There are no spending limits.But in Korea, mobile payment is as usual more complicated. With LG Uplus' Paynow service, users have to go through a five-step process to buy a product at an off-line store. They need to install and run the app on their smartphone, enter a password, choose the type of settlement and show the cashier the bar code that appears on the smart device. On the surface, Bank Wallet Kakao by Daum Kakao is as simple as Apple Pay. But the service is prepaid, which would seem to defeat the object, and users need to sign up via a personal computer in advance. The reason is that it requires a security program like ActiveX, a buggy and antiquated Microsoft program that for some reason still holds sway here, to verify users' ID."
As the article goes on to note, the inescapable conclusion is that excessive regulations are responsible for this situation. "The Financial Supervisory Service and Financial Services Commission are worried about security. One program developer said, "Even the most innovative ideas end up getting axed or modified beyond recognition after they go through the FSS's screening process. Financial authorities are virtually blocking fresh endeavors." But an FSS official rejected the blame, "We are trying to minimize security risks in order to prevent illegal use, leakage of personal financial information and identity theft." The official admitted that the FSS checks a whopping 55 criteria."
The accompanying graphic is a screen capture from Microsoft's web site. (click to see a full size version)  Note the advice given in the last sentence on the graphic. "Here's a good rule to follow: If an ActiveX control is not essential to your computer activity, avoid installing it." When will Korea remedy this situation?

The continuing problem of Korea's Microsoft Monoculture

Since I live in South Korea, direct personal experience with the so-called "Microsoft monoculture" here is more or less inevitable.  I've posted somewhat regularly on this topic.
At any rate, this week I tried to make use of a Google docs presentation in one of my classes, only to discover that the electronic podium was loaded with Windows XP and an older version (IE 6.1 I believe) of Internet Explorer that would not even allow me to log on to Google docs, let alone view the presentation!  That excruciating experience reminded me that it was about time to take another look at this nation's excessive dependence on Microsoft software that much of the rest of the world has already discarded.   The Korea Times carried a good summary a few days ago, entitled "Korea still stuck in Active-X."   The opening two paragraphs of the story pretty much tell the story about internet use in South Korea, as follows.
"Many Internet users find Web browsers Google Chrome and Firefox more convenient than Internet Explorer (IE), but users here often stay with the latter due to the prevalence of Active X technology.
Over 80 percent of the country’s Internet sites still use this technology, which is not only vulnerable to malicious code, but also damages consumers’ right to freely choose the Web browser they want." The article goes on to note that "Internet users wanting to engage in commerce have no option but to use the Microsoft browser, and as a result IE has an 80 share of the browser market here while its ratio has fallen to below 40 percent globally."  The accompanying graphic from StatCounter shows the global trend (click on the graphic to see a full-size version).
The Korea Times article contains some interesting background detail on how the current situation in Korea came about and is well worth reading.
I am one of many consumers, both Korean and expatriate, who would love to use my smartphone to check bank account balances or do other such routine tasks, but this will have to await decisions by government and industry bodies here to shed their dependence on outdated Microsoft software and enter the 21st century.  People like me will not switch from using Chrome or Firefox back to Internet "exploder" just to do their banking or credt card transactions, especially with the security risks that such a move might involve.

More on Microsoft Monoculture and the Mobile Revolution in Korea

An article in The Korea Times yesterday highlights an important aspect of the mobile broadband revolution occurring in South Korea, namely the problems caused by the so-called "Microsoft Monoculture" that has grown up here.  Readers of this blog will know from earlier posts that I've been an observer of the heavy reliance on Microsoft and its implications for Korea.
The article notes the great popularity of both the Apple iPad, running on the Apple OS, and the new Samsung Galaxy Tab, which runs on the Android operating system.   Unfortunately, despite all of their other attractive features, the fact that these devices do not work with the older Microsoft software that has been adopted for online banking and many e-government services in Korea somewhat limits their utility.   The article correctly notes how the nearly exclusive adoption of Microsoft's Active X and public key certificates is at the heart of this problem.   Ironically, Micorosft itself has been moving away from Active X for a long time now due to security problems.   Another factor diminishing the appeal of the iPad is that it will not display many "Flash-happy" Korean websites.
The article might have gone on to note that the mobile broadband revolution involves not only Korea, but is global in scope.  Most likely, the introduction of the iPad and the Galaxy Tab signal an increasingly urgent need for South Korea to jettison its reliance on Microsoft and move more aggressively into the mobile and ubiquitous network environment of the future!