News

Internet Explorer To Flag Verified 'Safe' Sites

E-commerce and online banking sites will be required to undergo extensive verification checks.

Beginning next month, version 7 of Microsoft Corp.'s Internet Explorer browser will start flagging certain e-commerce and banking sites as green for "safe." The browser will look for an extended-validation certificate issued by any number of vendors.

To qualify, vendors such as VeriSign Inc. and Comodo will be required to make extensive checks before approving such certificates. They also will have to undergo independent auditing through WebTrust, a service run by trade groups for certified public accountants.

Under the latest, 65-page draft guidelines, verification requirements include:

  • Legal existence and identity. The certificate vendor must make sure that the business is legally recognized and that the formal name matches government records, through databases and other means. The vendor also must verify any alternative operating names that differ from the legal name.
  • Physical existence. The vendor must check government records to make sure addresses in those records and in the certificate application match. When there is no match, a site visit is required, documenting such things as whether a permanent sign is present and whether the office is more than a mailbox. Photos are required showing the site's exterior and the interior reception area or workspace.
  • Telephone number. The vendor must verify that the phone number provided is the primary one for the business, using such techniques as calling it directly and checking phone directory listings. In some cases, the vendor must make sure the main phone number is not a mobile phone.
  • Domain name. To ensure the business owns and controls the domain name, the vendor must use techniques such as checking registration records, known as the Whois database, and asking the company to make an agreed-upon change to the Web site under that domain name.
  • Individual's authorization. The vendor must verify that the individual requesting the certificate works for the company -- for instance, by contacting its human resources department. The vendor must also verify the individual's authority to make the request, generally by obtaining written documentation.

For some verifications, exemptions are permitted with a letter from a lawyer, notary or accountant. The guidelines include procedures for verifying authenticity.

Businesses in existence for less than three years may be required to also produce evidence they have a valid bank account. Additional checks are required for banks and other companies deemed to be high-risk targets for scams.

Because many of the steps rely upon government filings, general partnerships, unincorporated associations, sole proprietorships and individuals are currently barred from getting these certificates.

For that reason, a consortium of certificate vendors and browser makers rejected the draft in November, although Microsoft and some vendors believe the standards are good enough to proceed anyhow.

Featured

  • The 2019 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generation of HoloLens, here's what's on tap from Microsoft this year.

  • Microsoft Bringing Teams to Linux in Preview

    A limited preview of the Microsoft Teams app is now available for select Linux desktop operating systems, making it "the first Microsoft 365 app" to run on Linux.

  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Classic SharePoint Blogs Approaching 'Retirement'

    A recent Microsoft Message Center post indicates that "classic" blogs used by SharePoint Online subscribers are on their way toward "retirement."

RCP Update

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.