News

Internet Explorer To Flag Verified 'Safe' Sites

Beginning next month, version 7 of Microsoft Corp.'s Internet Explorer browser will start flagging certain e-commerce and banking sites as green for "safe." The browser will look for an extended-validation certificate issued by any number of vendors.

To qualify, vendors such as VeriSign Inc. and Comodo will be required to make extensive checks before approving such certificates. They also will have to undergo independent auditing through WebTrust, a service run by trade groups for certified public accountants.

Under the latest, 65-page draft guidelines, verification requirements include:

  • Legal existence and identity. The certificate vendor must make sure that the business is legally recognized and that the formal name matches government records, through databases and other means. The vendor also must verify any alternative operating names that differ from the legal name.
  • Physical existence. The vendor must check government records to make sure addresses in those records and in the certificate application match. When there is no match, a site visit is required, documenting such things as whether a permanent sign is present and whether the office is more than a mailbox. Photos are required showing the site's exterior and the interior reception area or workspace.
  • Telephone number. The vendor must verify that the phone number provided is the primary one for the business, using such techniques as calling it directly and checking phone directory listings. In some cases, the vendor must make sure the main phone number is not a mobile phone.
  • Domain name. To ensure the business owns and controls the domain name, the vendor must use techniques such as checking registration records, known as the Whois database, and asking the company to make an agreed-upon change to the Web site under that domain name.
  • Individual's authorization. The vendor must verify that the individual requesting the certificate works for the company -- for instance, by contacting its human resources department. The vendor must also verify the individual's authority to make the request, generally by obtaining written documentation.

For some verifications, exemptions are permitted with a letter from a lawyer, notary or accountant. The guidelines include procedures for verifying authenticity.

Businesses in existence for less than three years may be required to also produce evidence they have a valid bank account. Additional checks are required for banks and other companies deemed to be high-risk targets for scams.

Because many of the steps rely upon government filings, general partnerships, unincorporated associations, sole proprietorships and individuals are currently barred from getting these certificates.

For that reason, a consortium of certificate vendors and browser makers rejected the draft in November, although Microsoft and some vendors believe the standards are good enough to proceed anyhow.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.