IE7's Green Anti-Phishing Bar

How does this affect/will this hurt small businesses?

[tigerflag]

Reading slashdot yesterday I came across this disturbing article from the Wall Street Journal about Microsoft's new anti-phishing tool in IE7:

[online.wsj.com...]

In a nutshell, Microsoft will be selling certificates that will verify that your site is genuine and not a phishing site. The certificate will turn your address bar green. I am not clear if this applies to the entire site or only to the secure pages that transmit encrypted data.

LLC's and Corporations can obtain certificates. Sole proprietorships can't. Sites that don't have a certificate will continue to have white address bars.

Can anybody here shed more light on this?

1. How much will these certificates cost? (I read one rumor that they might cost over $1200. While I have an LLC and would qualify, I can't afford that).

2. Do they only apply to secure pages, or to the whole site?

My site is PCI-compliant. I use a shared hosting server. My only secure pages are in the shopping cart, and that is hosted by Mals e-Commerce.

3. With a setup like mine (which I'm sure is very common), would I need a certificate for my whole site? Or are the secure pages the only ones the certificate applies to?

I'm also curious about what people here think about this? I think it will hurt small businesses, will be a boon to big business (and Micro$oft) and will only reduce phishing until the phishers find a way around it.

For some reason I never get email notifications, but I will check back to see if there is any response to this. Thanks!

[jwolthuis]

Extended Validation Certificates are not sold by Microsoft. You can get them starting in January from GoDaddy, etc. They turn your address bar green.

The phishing filter is different. In theory, phishing sites could obtain Extended Validation Certs, too. If a server ends up on Microsoft's phishing site list, it turns the address bar red, and pops up a warning box.

Whether customers really care if the address bar turns green or not remains to be seen.

[tigerflag]

Thanks. I went to Godaddy to read up on their EV-SSL certificates. They say:

"New browser versions – starting with Internet Explorer® 7 in early 2007 – change address bar color from white to green when displaying an Extended Validation SSL-secured page."

So my question remains, does this certificate only apply to SSL pages? I don't serve any SSL pages on my site. My only SSL pages are served by Mals shopping cart, on their server.

[jwolthuis]

Yes, it only applies to Extended Validation SSL-secured pages, i.e., those pages starting with https.

If the page is not SSL-secured, the address bar remains white (or red, if it's on Microsoft's list of suspected phishing sites).

[tigerflag]

Thanks. I wanted to hear this from someone without a vested interest in selling me something.

FWIW, while I was waiting for a response here, I called Comodo and asked them the same question. The man in sales told me the certificate would turn my address bar green on ALL my pages sitewide, and then he tried to sell me an EV-SSL certificate for hundreds of dollars.

Then I called GoDaddy. The woman there told me what you did, and said that under my circumstances I didn't need one.

[jwurunner]

Hi,

How many of you that are running small to medium size ecommerce sites think that the EV SSL Certificate is going to have a serious impact on sales as more and more people start using IE 7. It seems to me that the average consumer is going to be very confused as to why some sites have a green bar and other don't. The way Microsoft is advertising the seal, it basically seals the fate of any site that either doesn't qualify for the EV SSL Cert or can't afford it right away. Considering how many consumers fall for phishing emails, the nigerian emails, etc, I think something does need to be done but not like this. Instead of making a visible change to the broswer bar, the consumer should be defaulted to a page from Microsoft stating the link they clicked on was a phishing link.

Just my 2 cents...

[jwolthuis]

I think Extended Validation Certs fall into the same category as the Better Business Bureau Seal of Approval... no one will care, in my opinion. It's simply a way for Verisign and GeoTrust to pump up their bottom line.

Only the technically savvy shoppers are aware of the Browser Lock turning on (or not turning on) during checkout. Most customers (my mom for example) simply hope their credit card goes through without an error message, and the presence (or absence) of a browser lock, a BBB Seal, or a green address bar is totally irrelevant.

A well-designed site with easy navigation, professional images, fast page loading, and a well thought-out checkout system is (IMHO) much more important to a potential customer, giving them the sense that your site is trustworthy and going to be around for the long-term.

They want to be reassured that they'll receive their purchases, their personal information is protected, and that they can come back next month if there's a problem. These are things that cannot be conveyed by the color of the address bar.

[Patrick Taylor]

The article says "turns address bars yellow on suspicious sites" - my Firefox turns the address bar yellow on secure pages. That sounds confusing.

But, as many online shoppers are oblivious of the padlock on secure pages, they might also expect that any page of an online shop ought to show the green address bar - secure or not. Does anyone know if there will be a way to apply an EV SSL-type green address bar to non-secure pages?

[tigerflag]

I originally thought the certificate would turn all the address bars green throughout the site. The article makes it sound that way, and the guy from Comodo said it would.