News

Internet Explorer To Flag Verified 'Safe' Sites

Beginning next month, version 7 of Microsoft Corp.'s Internet Explorer browser will start flagging certain e-commerce and banking sites as green for "safe." The browser will look for an extended-validation certificate issued by any number of vendors.

To qualify, vendors such as VeriSign Inc. and Comodo will be required to make extensive checks before approving such certificates. They also will have to undergo independent auditing through WebTrust, a service run by trade groups for certified public accountants.

Under the latest, 65-page draft guidelines, verification requirements include:

  • Legal existence and identity. The certificate vendor must make sure that the business is legally recognized and that the formal name matches government records, through databases and other means. The vendor also must verify any alternative operating names that differ from the legal name.
  • Physical existence. The vendor must check government records to make sure addresses in those records and in the certificate application match. When there is no match, a site visit is required, documenting such things as whether a permanent sign is present and whether the office is more than a mailbox. Photos are required showing the site's exterior and the interior reception area or workspace.
  • Telephone number. The vendor must verify that the phone number provided is the primary one for the business, using such techniques as calling it directly and checking phone directory listings. In some cases, the vendor must make sure the main phone number is not a mobile phone.
  • Domain name. To ensure the business owns and controls the domain name, the vendor must use techniques such as checking registration records, known as the Whois database, and asking the company to make an agreed-upon change to the Web site under that domain name.
  • Individual's authorization. The vendor must verify that the individual requesting the certificate works for the company -- for instance, by contacting its human resources department. The vendor must also verify the individual's authority to make the request, generally by obtaining written documentation.

For some verifications, exemptions are permitted with a letter from a lawyer, notary or accountant. The guidelines include procedures for verifying authenticity.

Businesses in existence for less than three years may be required to also produce evidence they have a valid bank account. Additional checks are required for banks and other companies deemed to be high-risk targets for scams.

Because many of the steps rely upon government filings, general partnerships, unincorporated associations, sole proprietorships and individuals are currently barred from getting these certificates.

For that reason, a consortium of certificate vendors and browser makers rejected the draft in November, although Microsoft and some vendors believe the standards are good enough to proceed anyhow.

Featured

  • Report: Cost, Sustainability Drive DaaS Adoption Beyond Remote Work

    Gartner's 2025 Magic Quadrant for Desktop as a Service reveals that while secure remote access remains a key driver of DaaS adoption, a growing number of deployments now focus on broader efficiency goals.

  • Windows 365 Reserve, Microsoft's Cloud PC Rental Service, Hits Preview

    Microsoft has launched a limited public preview of its new "Windows 365 Reserve" service, which lets organizations rent cloud PC instances in the event their Windows devices are stolen, lost or damaged.

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.

  • Roadblocks in Enterprise AI: Data and Skills Shortfalls Could Cost Millions

    Businesses risk losing up to $87 million a year if they fail to catch up with AI innovation, according to the Couchbase FY 2026 CIO AI Survey released this month.