Slashdot Mirror
Small Businesses Worry About MS Anti-Phishing
prostoalex writes "Ever get that warm feeling of safety, when the anti-phishing toolbar on Microsoft Internet Explorer 7 turns green, telling you it's safe to shop on the site you're visiting? Well, you probably don't, but the millions of Internet users who will soon be running IE7 probably will be paying attention to the anti-phishing warnings. WSJ.com is reporting on how Microsoft is making it tough for small businesses to assure they're treated properly by the anti-phishing algorithm." From the article: "[S]ole proprietorships, general partnerships and individuals won't be eligible for the new, stricter security certificates that Microsoft requires to display the color. There are about 20.6 million sole proprietorships and general partnerships in the U.S... though it isn't clear how many are engaged in e-commerce... 'Are people going to trust the green more than white? Yes, they will,' says Avivah Litan, an analyst at Gartner Inc. and an expert on online payments and fraud. 'All the business is going to go to the greens, it's kind of obvious.'"
'Are people going to trust the green more than white? Yes, they will,' says Avivah Litan, an analyst at Gartner Inc. and an expert on online payments and fraud.
WTF? Shouldn't that read:
'Are people going to notice the green or than white? No, they wont,' says WMF, an analyst at slashdot Inc. and an expert on stupid punditry.
On a slightly different note, I think the submitter has gotten the new expensive secure certs gold-rush/scam confused with the anti-phishing tech. Not surprising 'cause the article melds them together in a rather confusing manner.
There are shills on slashdot. Apparently, I'm one of them.
Microsoft may think they've solved a problem and maybe they have, but this could be creating a bigger problem, though as usual it'll be no skin off of Microsoft's nose.
Microsoft's stance (FTA):
It may not be formal logic (all farmers wear overalls, therefor if I wear overalls.... (hint: I am not a farmer)), but most internet users are going to make the simple logical leap and assume that not "green" implies not legitimate.
It's easy for Microsoft to skate... they don't live the existence of normal business - it's a shame they have so much input into what others' business rules look like. This probably isn't fair. There has to be a legitimate way to become legitimate.
I hope a user smart enough to notice and use the phishing feature of IE, would be smart enough to use Firefox instead
That even Microsoft itself has allowed its security certificates to lapse in the past, I don't think this is going to mean much. As soon as the address bar goes white when getting updates from microsoft.com, people will start to ignore it.
Besides, the user sophisticated enough to notice the difference probably won't care - by now, he's already got a set of favorite bargain sites, and when their address bar stays white, he'll just assume they're too cheap to buy the MS cert. After all, how *do* they undercut the competition?
And I'm guessing that most people - if they notice at all - will not be any more cautious. After all, that's what they bought anti-virus for, right? I'd be willing to bet that the average user believes AV software protects them from everything bad that could happen when using a computer.
The society for a thought-free internet welcomes you.
Countdown to the phisher finding a way to subvert the system and obtain legitimate certs to green-light their scam sites :
4... 3... 2... 1...
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This isn't even a problem of "paying up".... the small one-person companies don't even qualify to get certified for the green status... no amount of money will anoint them. This is where is starts to be unfair.
If you make certificates too easy to obtain then every phisher and his dog will just buy one and create a false impression of legitimacy. If you try too hard to restrict them to bona fide companies then you risk shutting out the mom and pop outfits. What's the answer?
Anyone what approach Firefox takes compared to IE7 here?
From TFA, this is the reasoning behind the stocking saleswoman's problems. Now, I tend to disagree that it's difficult to find criteria for validating a Proprietorship, since I've formed one myself. While getting the trade certificate and license to collect tax are easy, obtaining a valid small business bank account is not. I'm thinking that those 3 taken as a whole should be enough information to determine whether the Proprietorship in question exists and is doing legitimate business, at least here in Canada.
I don't think Microsoft screwed up here, incredibly enough. They've released a new product based on standards (of all things!). It doesn't erroneously display this woman's site in yellow or red, and it will correctly display it in green when the forum which determined the new certificate standard makes it available to Proprietorships. The article accuses Microsoft of tilting the online commerce playing field heavily toward big business again, but this isn't really Microsoft's fault. I agree that the new certificate standard should have included everyone from the get-go, but you can't fault Microsoft for building this useful feature on the latest standard.
mandelbr0t
"Please describe the scientific nature of the 'whammy'" - Agent Scully
Users will quickly learn to ignore the status bar color just like they've learned to ignore all other security warnings (thanks to expired certificates and other false negatives we throw in their face every day).
Green means good is pretty standard. Don't go berating the users for making that jump.
Don't confuse ignorance with stupidity. There is a world of difference.
The Kruger Dunning explains most post on
I agree with Microsoft, actually; it can be difficult to take what looks like a perfectly legitimate business and guarantee that they aren't actually sniffing for your personal information. But only labeling large businesses as "safe" will indeed put serious burdens on smaller companies.
Perhaps Microsoft could allow for companies who wish to "go green" to purchase a certain amount insurance from established bonding companies assuring shoppers that their information won't go awry. Bonding companies know how best to deal with this sort of risk; they would subject their client companies to audits, making sure servers were secure and weren't caching the wrong sort of data.
I'm a small businses owner, and guess what, I would have ZERO problems with this "green bar" policy.
Reason? I made damn sure that I'm incorporated as either a limited liability company (L.L.C) (www.3dprints4less.com - not up yet) or a S-corporation (www.seattleprototypes.com).
In this day and age of litigation, there is NO reason why if you're going into businses you should even consider sole proprietarship or general partnership agreement. IANAL, but go pick up any of the Nolo self-help books (recomemnded by lawyer friends) and they make it clear: The LLC and corp status is a bit more paperwork to upkeep, but offers MUCH better protection for the business owners. As a sole proprietarship, you are personally liable - down to your last nickel in your bank account, if your business incurs any liabilities. As a general partnership, you would be personally held liable for not only your business's liabilities, but the action of your partners well (if your partner racks up a debt, skips town, and the creditor have easy access to you - guess who's in the hot seat).
Not to mention, there's huge benifits you can get tax wise, from being a corporation or LLC. Corporate tax rates are a heck of a lot lower for one!
So, Aunt Joy making custom stockings, please, go pick up a self help book and get your business setup properly. This way some slimebag ambulance chaser can't sue you out of the house you're growing old in when some irresponsible parent let their kid chew off a bit of the stocking and the kid chokes on it.
-=- Terence
Actually there's two issues -- site verification and anti-phishing -- which are getting mashed together because they act on a similar concept (how much can I trust this site?) and display through the color in the address bar.
White is the default state, and says nothing about the site.
Red is when the site matches a blacklist of known phishing sites. (If you have the antiphishing turned on, it will check with MS each time you load a new page.)
Green is when the site uses one of these new SSL certificates which provides additional data and (supposedly) has a tougher approval process in which the certificate authority does an actual background check on the company instead of just making sure they have a working phone number. One hopes a blacklist hit will trump this.
A secure site that uses a standard SSL cert and is not a known phisher will have a white location bar.
But is Microsoft the right one to enforce this? Even if sole proprietorship or general partnership might be inadvisable, it isn't illegal, and Microsoft or anyone else who is not the government has absolutely no jurisdiction and no mandate to make it so.
Something seems definitely out of bounds here...
SIGBUS @ NO-07.308
> The solution for small business will be to market through a strong co-op or
> an established corporate partner like Amazon or eBay. The benefits are obvious
Yes. Control. Amazon and Ebay can suck off most of the profits and prevent the small businesses from growing into competitors.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
RTFA.
You don't get a "green" cert. You get an EV-SSL, or, Extended Verification SSL. It's not like MS invented something horrible to extort money out of people. FYI, Firefox and Opera implements anti-phishing toolbars as well.
http://www.digicert.com/ev-ssl-certification.htm
And, guess what? cost of the EV-SSL, along with payments to banks, credit card processors, etc... are just a part of the cost of doing business.
-=- Terence
Sorry, I forgot to mention that it does block access to a "red" site with an "are you sure you want to visit this?" warning. The initial design of the phishing filter is described on IEBlog. Some details have probably changed since then, but that's the basic way it works in the final version.
The only people this can significantly hurt are business which were doomed to fail in anycase, and scammers.
But doesn't TFA say that many of the people that will be doomed to fail are legitimate businesses like Aunt Joy Christmas stockings? Though Microsoft will claim they're not. She won't be green. She'll lose business. It's small businesses that will hurt.
What about a window without an address bar, but with an image which looks like an address bar.
If you can't get a certificate as a sole proprietorship, INCORPORATE! Problem solved.
Nobody is making anyone run their business as a sole proprietorship. And this day in this sue-happy age, there's plenty of other reasons incorporation is a good idea.
paintball
This depends on millions of new Intel machines being purchased after January 30. Febrary and March are the slowest period of the year for any non-essential item, as people are recovering from their holiday spending binges. Retail box sales of Vista will be all but limited to hard core gamers who want DirectX 10 a year before any games actually take advantage of it.
Ok, so IE7 is available on XP if you have SP2 installed. Still not staggering market share if you ask me.
The typical user doesn't notice anything above the top of the page, including the address bar, which is why there's an anti-phishing toolbar in the first place. They'll only notice the color change the first time it happens because a semi-helpful, condescending dialog box will pop up, which the user will check the "do not display again" box, click OK, and continue on their oblivious way without having read the actual message. After that, they'll probably never realize that it changes colors, and if they do, they'll momentarily wonder why, and continue on their merry way.
If something is routinely ignored, it's not useful because it's not being used. This is just one more thing that users will ignore while they submit their credit card info to http://amazon.com.hahawepwnyou.com/ to buy the latest American Idol greatest hits CD.
MS is widely considered to overdo it with the handholding of Windows users, making everything seem cozy and easy, and then they go and implement this toolbar which only gives the illusion of security, in the hopes that the ignorant masses they've created will pay attention to it.
Not gonna happen. Phishing will continue until people learn to use the Internet, jsut like spam will continue until SMTP is replaced.
Only one response needed: http://www.microsoft.com/technet/security/bulletin /MS01-017.mspx
This was a class-3 code-signing certificate from Verisign, giving all the correct details for Microsoft but the request was coming from a bunch of crackers. How long, then, until the phishers figure out how to get EV-SSL certificates of their own?
And we know that it's only a matter of time...
And the clincher is that the longer it takes to crack, the worse the ramifications are going to be when it happens.
File under 'M' for 'Manic ranting'
I remember a few years ago, this company licensed a Haiku to put in the email headers. If the Haiku was there, you were automatically white listed in various spam filters. If you used the Haiku without paying the licensed, you could be sued not for spam, but for copyright infringement. I wonder if they still exist. Anyway, small businesses were priced out of the system. If you weren't sending 1,000,000 emails a month, don't bother calling them because you can't afford it. It seemed like such a stupid way to do business in an internet age. I'd pay .05 to make sure an email made it to a client. Oh well.
San Francisco Photographers
Personally, no, but it is how a lot of people are likely to make decisions. That's the point.
Fortunately, our experience with RBLs shows that they never make mistakes, and small businesses never get seriously hurt by them.
Ah, a good, old-fashioned protection racket. I'm so glad they're still alive and well, even in these high-tech times.
Yes, because small businesses are never successful unless they're scammers.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
We have a Web site where we process orders for other companies. The pages are customized to our customers' look and feel and the credit cards are process against their accounts but all of the transactions take place on our server and use our certificate.
We have no problem getting the new certificates but what company name should appear in the bar? If we put our own name in, we will consfuse the end users who have never heard of us. If we want to use our customers company name, then they each have to get their own certificate and we have to assign separate IP addresses to each of our customers - at the moement we only need one IP.
What a nuisance.
As a sole proprietor, shouldn't you have enough control over your business to guard against this? And shouldn't you be moral enough to *want* to actually pay your liabilities when you do something wrong?
It's just a legal framework -- and no, you can never have "enough control" to guard against this. In a sole proprietorship, you are not legally distinct from your business, so any liabilities against the business can be taken out of your personal accounts. Assuming you are a legitimate business owner trying to make a profit (not just a shell corporation trying to avoid taxes), your biggest risk (I'm guessing) is from frivolous lawsuits. Somebody slips on the sidewalk in front of your storefront and sues your business for gajillion dollars. Assuming they win & your business can't pay up, it comes out of your personal savings account (or other assets). It's the same reason people carry umbrella liability insurance -- because we can't guard against the stupidity & greed of other people.
- SSL certs are signed by the US government for all biz with an EID
- SSL certs are signed (again) by the States the corp is in
- SSL certs (again; optionally) are signed by a 3rd party that is payed to go further than the government to ensure you are legit
- Governments make incorporation requirements on par with a typical cert authority. My state is at least as good as a CA.
Benefits:- Cert authorities(CA) can not extort money from us to avoid a little warning dialog
- CAs will have to do more since the gov does the basics
- Browsers can highlight government backed certs (little flag icons or green?)
- Consumers know governments more than they do some CA
- Government has reasonable information on the corp owners
- Consumers know the corp has to file taxes on regular basis (can't be totally fake)
- Consumers know what country or state the corp is involved with, allows them the freedom to support local business
- Costs little in taxes, much of the stuff is there on their computers already, they can offer the whole thing for free as part of the incorporation process.
- Digital certs are more secure than a paper document from the secretary of state
- Makes it easy to find the corp as well as file complaints with the secretary of state which incorporates them
- CAs are forced to improve their services, no need to regulate them
This is well within government bounds, which legally defines corporations, LLC, LLP (partnership,) regulates them, and taxes them. This would be a cheap additional business service that would ultimately protect citizens (which is a fundamental reason for government.)Perhaps the government learns and uses digital certs on legal documents like birth certificates? (nah, that would be too smart...BTW, I could fake my birth certificate with a copy machine)
Democracy Now! - uncensored, anti-establishment news
The irony of all this, is that the only companies allowed to be deemed "trustworthy" are the corporate entities whose employees are shielded from personal liability.
There are no karma whores, only moderation johns
I live in China. I was trying to think of some evidence you could actually see short of catching a plane. And while a box of loose screws would obviously be made to whatever spec the customer wanted, internal screws for consumer appliances, which is what I meant, not loose screws, would be whatever was available to the factory and cheapest -- having been involved with export, cost is everything. Why would they increase costs by using a different kind of screw that has no inherent benefits? Historically, China's heavy inudstry was based on Russain technology, which in turn was copied mostly from Europe. More recently, Japanese, based on US standards, though fortuantely mostly metricated.
I still fail to understand why anyone would imagine LH screws would be standard in China.
PS. Chinese vaginas aren't sloped sideways either.
Several CAs, including Digicert, are seeking to have the standard revised to include small businesses. I don't believe the CA/Browser Forum has finalized the standard yet, as there were some holdouts last I checked.
RichM
Data Center Knowledge
If Firefox had a warning every time you looked at for-profit websites and refuse to accept fancy overpriced certificates, people would be doing the same thing with another browser.
I have a small business, legally registered, which is a sole proprietorship. Even though my business is legal and even though I'm personally legally responsible for the business I cannot get this green bar.
I can pay the money for it (even though this starts to smell like a scam itself; pay the money for the certificate or you'll be blacklisted) and would if I could, but simply because they haven't defined rules to verify my type of business (which would be easy; My business is registered, has a clean tax-record and I can provide any identification they'd need).
So now MY business will not get on the whitelist because THEY fail to even set the rules by which I could get on the whitelist.
I seriously think MS should hold out on displaying the bars until sufficient rules are in place that allow all legal businesses equal recognition as such.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
The people looking for Auntie's Christmas stockings don't have anywhere else to go. Presumably they're they're looking for her because they don't want something made in a Chinese prison camp. If the latter was what they wanted they would have gone to Wal*Mart and been back already. No legitimate business which had a chance of succeeding will be materially harmed.
It's like you have no grasp of how people use the internet. People didn't jsut sit down and type in "www.auntiesstockings.com", they most likmely went to their search engine of choice and searched for something like 'holiday stockings crafts homemade' and got a bunch of hits for sites with those keywords. Then they see "Auntie's Christmas Stockings" and decide to give the site a try. As soon as they get there however the bar doesn't turn green, so they decide it's not a legitimate business and click Back on the browser and buy from a different site.
The point is not that previous customers are going to suddenly stop trusting a site they've already done business with (although that is a possibility). The point is that new users coming to a site for the first time, who use the IE7 green color as the sole indicator of trust, will immediately distrust the site when they don't see that green. It has nothing to do with the quality of the products or anythign else, no green bar will mean they assume it's a scam.
I agree that giving the user more info is a good thing, but the problem is MS has not provided adequate means for small legitimate businesses to display the same level of 'trust' as a major corporation. MS needs to provide a streamlined and straightforward way for ALL legitimate businesses to properly utilize this extra feature, by not doing that MS is essentially raising an artifical barrier to competition because of the lack of knowledge by the vast majority of the web using public. And the catch-22 is, if Joe Sixpack were savvy enough to properly use the anti-phishing notifications from IE7 then he probably wouldn't need to be protected from phishing/scam sites in the first place.
-- I'm not a pessimist, I'm a realist. It's not my fault that life sucks so much. --