News
Internet Explorer To Flag Verified 'Safe' Sites
Beginning next month, version 7 of Microsoft Corp.'s Internet Explorer browser
will start flagging certain e-commerce and banking sites as green for "safe."
The browser will look for an extended-validation certificate issued by any number
of vendors.
To qualify, vendors such as VeriSign Inc. and Comodo will be required to make
extensive checks before approving such certificates. They also will have to
undergo independent auditing through WebTrust, a service run by trade groups
for certified public accountants.
Under the latest, 65-page draft guidelines, verification requirements include:
- Legal existence and identity. The certificate vendor must make sure
that the business is legally recognized and that the formal name matches government
records, through databases and other means. The vendor also must verify any
alternative operating names that differ from the legal name.
- Physical existence. The vendor must check government records to make
sure addresses in those records and in the certificate application match.
When there is no match, a site visit is required, documenting such things
as whether a permanent sign is present and whether the office is more than
a mailbox. Photos are required showing the site's exterior and the interior
reception area or workspace.
- Telephone number. The vendor must verify that the phone number provided
is the primary one for the business, using such techniques as calling it directly
and checking phone directory listings. In some cases, the vendor must make
sure the main phone number is not a mobile phone.
- Domain name. To ensure the business owns and controls the domain
name, the vendor must use techniques such as checking registration records,
known as the Whois database, and asking the company to make an agreed-upon
change to the Web site under that domain name.
- Individual's authorization. The vendor must verify that the individual
requesting the certificate works for the company -- for instance, by contacting
its human resources department. The vendor must also verify the individual's
authority to make the request, generally by obtaining written documentation.
For some verifications, exemptions are permitted with a letter from a lawyer,
notary or accountant. The guidelines include procedures for verifying authenticity.
Businesses in existence for less than three years may be required to also produce
evidence they have a valid bank account. Additional checks are required for
banks and other companies deemed to be high-risk targets for scams.
Because many of the steps rely upon government filings, general partnerships,
unincorporated associations, sole proprietorships and individuals are currently
barred from getting these certificates.
For that reason, a consortium of certificate vendors and browser makers rejected
the draft in November, although Microsoft and some vendors believe the standards
are good enough to proceed anyhow.