Jeff Neuburger

How might the new Microsoft Web browser affect traffic to my web site?
April 24, 2007

"Phishing" is a term that is used to refer to the practice of using a fraudulent Web sites to gather personal information from users by pretending to be a legitimate electronic commerce or financial Web site. A new “anti-phishing” feature was rolled out this past January as part of the most recent version of Microsoft's Internet Explorer web browsing software (version 7.0). The browser features an “anti-phishing” toolbar that is intended to warn users that they may be visiting a fraudulent "phishing" site. Sites that have been verified as legitimate through the “Extended Validation Certificate” program will trigger the browser to display a green address bar. Sites that have not been verified will not trigger the green address bar. Sites that are known phishing sites will trigger a red address bar.

As the anti-phishing bar becomes more widely adopted, and if users come to distrust sites that do not display the green address bar, they may decline to conduct e-commerce transactions on those sites.

How can I get an Extended Validation Certificate for my Web site?

The Extended Validation Certificate program is run by the Certification Authority/Browser Forum (http://www.cabforum.org), a voluntary organization of leading certification authorities (CAs) and vendors of Internet browser software (such as Microsoft) and other applications.

To have its Web site trigger the desirable green address bar, a company must:

• Be a limited liability company or partnership, or an S or C corporation (not a sole proprietorship or a general partnership); and
• Apply through one of the certification authorities listed at http://www.cabforum.org/forum.html.

Before issuing the certificate necessary for the green bar to be displayed, the certification authority will confirm with the company's incorporating agency that:

• The company legally exists as a valid entity in the jurisdiction of incorporation;
• The company's legal name matches the name on its incorporation papers; and
• If an assumed name is used, the assumed name is properly registered with the incorporating jurisdiction.

The company will be required to provide the certification authority with its incorporation registration number, and the identity and address of its registered agent or registered office, as applicable in the company's jurisdiction. Finally, the certification authority will take steps to verify that the company has the exclusive right to use the applicable domain name, and that such company has authorized the issuance of the certificate.

Companies that fit the above criteria should consider applying to a certification authority for verification. In particular, companies whose Web sites are prone to being targeted by "phishing" schemes may find the green bar an effective means to show users that they are visiting the company's legitimate Web site, and not a fraudulent "phishing" site.

Note:  While Microsoft’s new Internet Explorer version 7.0 has adopted the use of the Extended Validation Certificate, the number two web browser, Firefox, has not yet adopted it, but intends to support its functionality in some way when Firefox is updated later this year.  

But what about sole proprietorships?

The fact that not all forms of corporate entities are eligible to obtain the certificate has been the subject of criticism, and has discouraged other web browsing software vendors from adopting the program.  However, the CA Browser Forum has stated that it is working on new rules that would bring in small legitimate e-commerce sites.   

The posts on this blog reflect the personal views of Jeffrey D. Neuburger, in his individual capacity, and do not necessarily represent the views of his law firm or his clients, and are not sponsored or endorsed by them. The information contained in this blog is provided only as general information for educational purposes, and no warranty or representation is made about the accuracy of the information provided. Blog topics may or may not be updated subsequent to their initial posting. This information is not provided in the course of an attorney-client relationship and is not intended to constitute legal advice. This blog should not be used as a substitute for competent legal advice from a licensed attorney in your state.

Posted by Jeff Neuburger on April 24, 2007 | Comments (0)