Small Online Merchants Seek 'Safe' Tag

(AP)  As an online shopper, Claudia Race knows she must look out for scams.

So as an Internet entrepreneur working out of her home in New Braunfels, Texas, Race wants to use all the tools available to assure customers they can trust the vacation-rentals service she is about to launch.

But because her small business is so new, Race said she might not qualify for the online seals of approval that Overstock.com Inc. and other larger, established companies are getting to instruct Microsoft Corp.'s Internet Explorer browser to display a green address bar for "safe" when people visit her site.

"It would put me at a disadvantage," Race said. "I do not want anyone to have any questions, hesitate or have any fear factor. They have to know that I didn't just go grab a logo from somewhere and stick it on my site. I want them to know I'm a legitimate business."

What she's seeking is an extended-validation certificate, a response to the plethora of "phishing" attacks in which scam artists try to steal sensitive data by mimicking the Web site of a large bank or merchant.

Once Microsoft activates the feature in version 7 of Internet Explorer in late January, a green bar will appear when the browser sees an EV certificate, usually during a transaction or login. The tool complements a newly launched filter that displays a red warning for known phishing sites and yellow for suspicious ones.

"EV does not authenticate that your plasma TV is going to show up or that it won't have a crack through it," said Tim Callan, director of product marketing for VeriSign Inc., which issued its first EV certificate to Overstock this month.

Rather, Callan said, the EV certificate will tell consumers that the business does exist and operates at the location it says it does.

That's because VeriSign and its competitors will be required to perform extensive checks to verify that the business is legally recognized by a government agency and that the address registered for the certificate is valid, such as by matching it with a government filing or visiting the business in person.

Certificate issuers also must make sure that the company owns the domain name and that the individual requesting the certificate is authorized.

So a scammer can't register from overseas a domain name at "paypa1.com" — with a numeral "1" instead of letter "l" — and buy an EV certificate saying it is the eBay Inc. online payment service.

The certificate issuer would discover the person requesting it doesn't really work for eBay after obtaining eBay's contact information through independent means and asking directly, said Paulo Kaiser, vice president of operations for certificate vendor Comodo.

In the early days of e-commerce, merchants simply needed a standard security certificate for browsers to display a closed padlock. The makers of the Netscape browser, now owned by Time Warner Inc.'s AOL, developed the Secure Sockets Layer technology in the mid-90s, and many online shoppers over time knew to look for it.

Companies known as certification authorities used to always perform a series of checks to make sure sites were really what they said they were.

But newer authorities have tried to cut costs and corners by checking only that the site owns the domain name — not the business said to run on that domain, security experts say. Scam artists — needing only a credit card and a domain name — have exploited the loophole to obtain the certificates necessary to appear legitimate.

Enter the Certification Authority/Browser Forum, a group of certificate issuers and browser manufacturers desiring to restore trust in the certificates.

• 1
• 2
• Next Page »

[bobbbieb]

THANK YOU to Microsoft and Verisign and everyone else involved in bringing me safe on-line shopping.

I'm a busy mom, and I buy ALL our clothing, hard-to-find toys, even an original toilet tank lid for a 50 year old toilet online, often at 3am.

ITS A MIRACLE!

[alphaa10-2009]

Another reason to love Microsoft-- though claiming to be the friend of every small business person willing to shell out for MS Office, the MS resolution of the EV problem will not be done "before its time", presumably with as much energy and concern as some of the other IE flaws MS took its time to address.

The concern here is a half-baked security measure-- no matter how popular-- remains inadequate. Like a "white-list" spam filter, the EV filter will identify good guys with a green bar, but that leaves everybody else in the "unknown" white bar. That, in turn, leaves the "commit to buy" decision to be made with no more reliable information than before for any of the smaller firms which comprise an increasingly hefty share of the web metropolis. EV certification is like having a street map of Minneapolis, with only larger residences and (paying) businesses listed-- you may not find your destination safely.

[alphaa10-2009]

Make EV Work for Real People, First-- 2
Meanwhile, smacking their lips in sympathy, Verisign and other EV vendors just "cannot wait any longer"-- especially when the EVs are selling as a premium price.

The Texas web business owner does pose a puzzle, though. Why is she worried about assuring her visitors with EV certificates, when they knowingly choose her address address from a printed source or trusted site, to begin with? The only scenario in which EV assurance would be especially important is when a user responds to an email link (hyperlink)-- say, in a spam message. Our little lady from Texas is not planning to spam her way into the hearts and minds of prospects, is she? Hmmmmm?

[nothappyatall]

"starting to sell the EV certificates to the larger companies %u2014 for hundreds of dollars more than regular certificates to cover the validation costs."

Of course, and THAT is what the whole thing is about- charging merchants hundreds of dollars in annual FEES for this scheme. It also excludes the little guys, not only due to costs but the lack of incorporation and being on their database.

It's not the big companies who need this- most have 800 numbers and other published information on their web site and in Google to call and do business with, the little mom/pop operation and "Joe Blow" selling crafts on a web site can't afford $500 a year for a fee for some schlocky green bar, nor would they likely make enough income to qualify as a "business" to be incorporated, have an 800# and thus be verified.
I see the crooks getting around this too before long. The better way may be credit card verification connected to a physical billing address and used to pay for the domain and web site hosting.