Small Businesses Worry About MS Anti-Phishing 291
prostoalex writes "Ever get that warm feeling of safety, when the anti-phishing toolbar on Microsoft Internet Explorer 7 turns green, telling you it's safe to shop on the site you're visiting? Well, you probably don't, but the millions of Internet users who will soon be running IE7 probably will be paying attention to the anti-phishing warnings. WSJ.com is reporting on how Microsoft is making it tough for small businesses to assure they're treated properly by the anti-phishing algorithm." From the article: "[S]ole proprietorships, general partnerships and individuals won't be eligible for the new, stricter security certificates that Microsoft requires to display the color. There are about 20.6 million sole proprietorships and general partnerships in the U.S... though it isn't clear how many are engaged in e-commerce... 'Are people going to trust the green more than white? Yes, they will,' says Avivah Litan, an analyst at Gartner Inc. and an expert on online payments and fraud. 'All the business is going to go to the greens, it's kind of obvious.'"
WTF? Phising and certs are different issues. (Score:5, Insightful)
WTF? Shouldn't that read:
'Are people going to notice the green or than white? No, they wont,' says WMF, an analyst at slashdot Inc. and an expert on stupid punditry.
On a slightly different note, I think the submitter has gotten the new expensive secure certs gold-rush/scam confused with the anti-phishing tech. Not surprising 'cause the article melds them together in a rather confusing manner.
Re:WTF? Phising and certs are different issues. (Score:5, Funny)
Re: (Score:2)
Yuo say that as if Im capable of something else using!
Re:WTF? Phising and certs are different issues. (Score:5, Insightful)
Huge corporations that quietly invest money in polluting the internet with phishing sites that create an environment where "white = tangably untrustworthy" will see returns on their investment because this exists.
There was a business model in polluting the P2P networks so they become inefficient services. Then there were businesses that did it. Now there is a new business model. What comes next, you think?
Irony (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:WTF? Phising and certs are different issues. (Score:5, Informative)
Re:WTF? Phising and certs are different issues. (Score:5, Insightful)
All this "protection" in IE7 is there to try and limit which software you run. MS has decided that before they can beat open source they need to winnow the list of companies that deal with it and this is a good first step to do that with. If this same applet was signed by novell I am sure it would run in IE.
Re:WTF? Phising and certs are different issues. (Score:4, Interesting)
Nice try though.
Re: (Score:2, Informative)
Re:WTF? Phising and certs are different issues. (Score:5, Insightful)
Users favorite deal sites can display an error message to IE7 users that tells them their browser is defective and that in order for them to keep prices low, they will need to upgrade their web browser to Firefox to purchase anything from the site. They can also have a continue anyways button and store a cookie to not display the message again. That way when there is no green bar the users will know it is because they are not using an approved browser.
YAY for Microsoft, let them shoot themselves in the foot.
Re: (Score:3, Interesting)
...sites can display an error message to IE7 users that tells them their browser is defective and that in order for them to keep prices low, they will need to upgrade their web browser to Firefox...
Good idea, but i'd say not "defective", but "deliberately denying small businesses the status of legitimate web sites". That's the truth. :)
BTW, what if somebody got certified somehow, and then hosted a portal for businesses he trusts giving them the green light? I guess certification contract explicitly forbids that in the first 10 lines of the agreement
Re: (Score:3, Informative)
Re:WTF? Phising and certs are different issues. (Score:4, Insightful)
I think you complete misssed the point.
It's a great business model.
If you want to buy stuff from the InterWeb thingy you want to buy from the GREEN because everyone else is EVIL.
If you want to get more business sent your way, you have to purchase the certificates to go GREEN or else you lose money.
So if the businesses buy in to this green craze then it starts to feed into a cyclic frenzy of cornering the purchasing power of the consumers. And everyone pays Microsoft. And that makes it a great business model.
But we all know that Microsoft is pretty much regarded as a joke by more and more people every day. Just not enough quite yet.
going to have come up with a better way (Score:5, Interesting)
Microsoft may think they've solved a problem and maybe they have, but this could be creating a bigger problem, though as usual it'll be no skin off of Microsoft's nose.
Microsoft's stance (FTA):
It may not be formal logic (all farmers wear overalls, therefor if I wear overalls.... (hint: I am not a farmer)), but most internet users are going to make the simple logical leap and assume that not "green" implies not legitimate.
It's easy for Microsoft to skate... they don't live the existence of normal business - it's a shame they have so much input into what others' business rules look like. This probably isn't fair. There has to be a legitimate way to become legitimate.
Re:going to have come up with a better way (Score:5, Insightful)
Heh... watch the MSFT lawyers... (Score:2)
Re: (Score:2, Insightful)
Really, I'd hope people don't sue for this. If your sole source of income relies on a system you can't control, then you have a bad business model, plain and simple. Be it Google, or Microsoft, or VeriSign
Re:going to have come up with a better way (Score:4, Interesting)
Re:Really? (Score:4, Interesting)
But doesn't TFA say that many of the people that will be doomed to fail are legitimate businesses like Aunt Joy Christmas stockings? Though Microsoft will claim they're not. She won't be green. She'll lose business. It's small businesses that will hurt.
Re: (Score:2, Insightful)
[N]o one bought a Christmas stocking from her previously because they mistakenly believed she was a giant multinational conglomerate...
yet you offer no reason or evidence and completely fail to support your arguments. How about you tell us why you're right and the WSJ is wrong.
Re: (Score:3, Insightful)
It's like you have no grasp of how people use the internet. People didn't jsut sit down and type in "www.auntiesstockings.com", they most likmely
Re: (Score:3, Insightful)
Personally, no, but it is how a lot of people are likely to make decisions. That's the point.
Fortunately, our experience with RBLs shows that they never make mistakes, and small businesses never get seriously hurt by them.
Re:Really? (Score:5, Interesting)
I have a small business, legally registered, which is a sole proprietorship. Even though my business is legal and even though I'm personally legally responsible for the business I cannot get this green bar.
I can pay the money for it (even though this starts to smell like a scam itself; pay the money for the certificate or you'll be blacklisted) and would if I could, but simply because they haven't defined rules to verify my type of business (which would be easy; My business is registered, has a clean tax-record and I can provide any identification they'd need).
So now MY business will not get on the whitelist because THEY fail to even set the rules by which I could get on the whitelist.
I seriously think MS should hold out on displaying the bars until sufficient rules are in place that allow all legal businesses equal recognition as such.
Re: (Score:2)
Yeah like E-commerce sites hosted with IIS will be favored over Apache hosted sites.
Re: (Score:2)
Well, if the article get things right, these 20.6 million businesses now have one more reason to drop MS completely. I figure if that begins, things will change.
all the best,
drew
Re: (Score:2)
>> not a proponent of excessive litigation, but in this case I am in favor of it.
I agree, a legal (litigation) based denial of service attack against MS is entirely warranted. Microsoft is trying to make themselves an authority on something they have absolutely no business being involved in. Their scope is to provide an operating system, and secure that operating system.
Things beyond
Re: (Score:3, Insightful)
I'm fully over it, actually never found myself under it
Its still a low down dirty market grab putting themselevs quietly in a position of authority they have no business assuming, any way you cut it. We can debate the roots of a definition, but the fact remains that this is going to cost some mom and pops a few convers
Re: (Score:3, Insightful)
Sure, you're free to believe whatever you like. But in most jurisdictions, there are laws about things like libel and slander. I'd think that such laws might be easily used in this case.
If I were to start up my own business that published ratings of other businesses' honesty based on whether they've paid me f
Smart enough to notice that green toolbar (Score:4, Insightful)
Re: (Score:2)
Given the fact (Score:3, Insightful)
That even Microsoft itself has allowed its security certificates to lapse in the past, I don't think this is going to mean much. As soon as the address bar goes white when getting updates from microsoft.com, people will start to ignore it.
Besides, the user sophisticated enough to notice the difference probably won't care - by now, he's already got a set of favorite bargain sites, and when their address bar stays white, he'll just assume they're too cheap to buy the MS cert. After all, how *do* they undercut the competition?
And I'm guessing that most people - if they notice at all - will not be any more cautious. After all, that's what they bought anti-virus for, right? I'd be willing to bet that the average user believes AV software protects them from everything bad that could happen when using a computer.
Re: (Score:2)
Hell, Microsoft has allowed some of its major domain names to lapse.... hotmail.co.uk and passport.com
Re: (Score:3, Interesting)
Actually I think the bigger problem is that Microsoft and Verisign in the past have allowed a completely valid, high-grade signing certificate with Microsoft's own corporate identity to be issued to crackers (see http://www.pcworld.com/article/id,45284-page,1/ar t icle.html [pcworld.com] or the more authoritative http://www.microsoft.com/technet/security/bulletin /MS01-017.mspx [microsoft.com] for details). Note that a class-3 code-signing certificate was one of the more secure grades Verisign issues, it's not their standard e-mail-addr
Countdown (Score:5, Insightful)
4 [microsoft.com]... 3 [cert.org]... 2 [cert.org]... 1 [grok.org.uk]...
Re: (Score:2)
Re: (Score:3, Interesting)
So really, like the padlock "secure" icon (which tells you only that you're on a an encrypted connection
damned if they do, damned if they don't (Score:3, Insightful)
Anyone what approach Firefox takes compared to IE7 here?
Re:damned if they do, damned if they don't (Score:4, Insightful)
Don't bother implementing any kind of "anti-phishing" crap and let the buyer be responsible for his own damn self for a change!
Re: (Score:2)
Don't overload the certificate concept. If you make it clear that all an SSL cert means is that no one is listening in on the conversation between your browser and the website (assuming your machine and the server aren't compromised themselv
its the GOVERNMENTs job (Score:3, Insightful)
Re: (Score:2)
In most states, provided you don't have an actual storefront, you don't need to file anything to be a sole proprietorship. The only thing you may need to file in states that have sales tax (not all do!) is an app. for license to collect sales tax. All that takes is a valid address and possibly an SSN#, at least in NY stat
Sole Proprietorship (Score:3, Insightful)
From TFA, this is the reasoning behind the stocking saleswoman's problems. Now, I tend to disagree that it's difficult to find criteria for validating a Proprietorship, since I've formed one myself. While getting the trade certificate and license to collect tax are easy, obtaining a valid small business bank account is not. I'm thinking that those 3 taken as a whole should be enough information to determine whether the Proprietorship in question exists and is doing legitimate business, at least here in Canada.
I don't think Microsoft screwed up here, incredibly enough. They've released a new product based on standards (of all things!). It doesn't erroneously display this woman's site in yellow or red, and it will correctly display it in green when the forum which determined the new certificate standard makes it available to Proprietorships. The article accuses Microsoft of tilting the online commerce playing field heavily toward big business again, but this isn't really Microsoft's fault. I agree that the new certificate standard should have included everyone from the get-go, but you can't fault Microsoft for building this useful feature on the latest standard.
mandelbr0t
Re:Sole Proprietorship (Score:4, Insightful)
Not required in the US.
>
Not every US state has sales tax (and in those that do many goods and services are exempt).
>
There is nothing especially special about a "small business bank account" here.
Gartner are idiots, so relax (Score:5, Insightful)
Re: (Score:2)
bonding (Score:3, Interesting)
Perhaps Microsoft could allow for companies who wish to "go green" to purchase a certain amount insurance from established bonding companies assuring shoppers that their information won't go awry. Bonding companies know how best to deal with this sort of risk; they would subject their client companies to audits, making sure servers were secure and weren't caching the wrong sort of data.
Spend the extra time and setup your biz correctly! (Score:5, Informative)
Reason? I made damn sure that I'm incorporated as either a limited liability company (L.L.C) (www.3dprints4less.com - not up yet) or a S-corporation (www.seattleprototypes.com).
In this day and age of litigation, there is NO reason why if you're going into businses you should even consider sole proprietarship or general partnership agreement. IANAL, but go pick up any of the Nolo self-help books (recomemnded by lawyer friends) and they make it clear: The LLC and corp status is a bit more paperwork to upkeep, but offers MUCH better protection for the business owners. As a sole proprietarship, you are personally liable - down to your last nickel in your bank account, if your business incurs any liabilities. As a general partnership, you would be personally held liable for not only your business's liabilities, but the action of your partners well (if your partner racks up a debt, skips town, and the creditor have easy access to you - guess who's in the hot seat).
Not to mention, there's huge benifits you can get tax wise, from being a corporation or LLC. Corporate tax rates are a heck of a lot lower for one!
So, Aunt Joy making custom stockings, please, go pick up a self help book and get your business setup properly. This way some slimebag ambulance chaser can't sue you out of the house you're growing old in when some irresponsible parent let their kid chew off a bit of the stocking and the kid chokes on it.
-=- Terence
Re:Spend the extra time and setup your biz correct (Score:5, Interesting)
But is Microsoft the right one to enforce this? Even if sole proprietorship or general partnership might be inadvisable, it isn't illegal, and Microsoft or anyone else who is not the government has absolutely no jurisdiction and no mandate to make it so.
Something seems definitely out of bounds here...
Re: (Score:2)
What, like the fact that it's a free market and whoever provides the 'safest' service has a leg up? (notice safest is in quotes) Seems pretty normal to me. What exactly is out of bounds about this? And, by o
Re: (Score:2)
Re: (Score:2)
BTDT, in the US. No big deal. The only forms I needed to fill out were tax returns and a sales tax license that allowed me to collect NY State sales tax on sales.
-b.
Re:Spend the extra time and setup your biz correct (Score:2)
As a sole proprietor, shouldn't you have enough control over your business to guard against this? And shouldn't you be moral enough to *want* to actually pay your liabilities when you do something wrong?
I've never understood why society allows LLCs and S-corporations to begin with- seems like a huge opportunity for con artists to take advantage of everybody else.
Re: (Score:3, Insightful)
It's just a legal framework -- and no, you can never have "enough control" to guard against this. In a sole proprietorship, you are not legally distinct from your business, so any liabilities against the business can be taken out of your personal accounts. Assuming you are a legitimate business owner tryin
Re: (Score:2)
The reason frivolous lawsuits exist is because business owners attempt
Re: (Score:2)
Re: (Score:2)
In the case of the USA, isn't this what the 2nd amendment is supposed to be for? You know, the right to keep and bear arms...
Re: (Score:2)
While I understand the basic concept- the frivolous litigation wouldn't be anything like what it is if businesses operated morally to begin with.
Re:Spend the extra time and setup your biz correct (Score:2)
I'm sure Aunt Joy would love to, as would I, but neither of us can absorb the $500 filing fee. Stockings just ain't that profitable.
Re:Spend the extra time and setup your biz correct (Score:2)
Re:Spend the extra time and setup your biz correct (Score:2)
Registering as a corporation costs time and money. If you're just starting out, you may not have either to spare. Even $500 can be a big deal for some people, especially those who are young and in transition. Why should be impose one more artificial barrier to the success of the little guy?
That being said, I see a possible service in small bu
Re:Spend the extra time and setup your biz correct (Score:4, Insightful)
You don't get a "green" cert. You get an EV-SSL, or, Extended Verification SSL. It's not like MS invented something horrible to extort money out of people. FYI, Firefox and Opera implements anti-phishing toolbars as well.
http://www.digicert.com/ev-ssl-certification.htm [digicert.com]
And, guess what? cost of the EV-SSL, along with payments to banks, credit card processors, etc... are just a part of the cost of doing business.
-=- Terence
Re: (Score:2)
Well, they're a cost that provides no tangible service or benefit. So they're more like an artificial and arbitrary barrier to entry whereby we transfer extra money to Verisign for... well... because Verisign deserves our money more than we do. If the only "benefit" a product provides is to protect you from the negative side effects of that product's existence,
Re: (Score:2)
Of course, the Cayman Islands, Jersey and Switzerland help a lot...
Green hack (Score:2)
Doh!
Re: (Score:2, Interesting)
Well... (Score:2)
On the other side is Fx or Opera using third party blacklists (since they do browsers not other stuff like lists).
So the difference between MSIE+MS filters is that both come from the same monopoly. Fx or Opera use third party data (assuming that is not the same benefit for them) for filter
The moral of the story.... (Score:2)
You could always add a bit of blurb on how dodgy IE is if you want to rub salt in.
Re: (Score:2)
Real smart! (Score:2)
Re: (Score:2)
target non-IE users (Score:2)
Look at the demographics. Who are these non-IE users. Well, many of them are mac users with enough expendable income to buy a mac. Many are *nix users who like do it yourself projects. The independent minded window user cannot be ignored either.
It seems to me that many firms go under because they are all chasin
Summary makes a flawed assumption, MS another (Score:3, Insightful)
This depends on millions of new Intel machines being purchased after January 30. Febrary and March are the slowest period of the year for any non-essential item, as people are recovering from their holiday spending binges. Retail box sales of Vista will be all but limited to hard core gamers who want DirectX 10 a year before any games actually take advantage of it.
Ok, so IE7 is available on XP if you have SP2 installed. Still not staggering market share if you ask me.
The typical user doesn't notice anything above the top of the page, including the address bar, which is why there's an anti-phishing toolbar in the first place. They'll only notice the color change the first time it happens because a semi-helpful, condescending dialog box will pop up, which the user will check the "do not display again" box, click OK, and continue on their oblivious way without having read the actual message. After that, they'll probably never realize that it changes colors, and if they do, they'll momentarily wonder why, and continue on their merry way.
If something is routinely ignored, it's not useful because it's not being used. This is just one more thing that users will ignore while they submit their credit card info to http://amazon.com.hahawepwnyou.com/ [hahawepwnyou.com] to buy the latest American Idol greatest hits CD.
MS is widely considered to overdo it with the handholding of Windows users, making everything seem cozy and easy, and then they go and implement this toolbar which only gives the illusion of security, in the hopes that the ignorant masses they've created will pay attention to it.
Not gonna happen. Phishing will continue until people learn to use the Internet, jsut like spam will continue until SMTP is replaced.
Re: (Score:2)
I don't think this is a flawed assumption (that millions will soon be using IE7). It seems like an obvious assumption, to me.
One thing to say to Microsoft (Score:3, Interesting)
Only one response needed: http://www.microsoft.com/technet/security/bulletin /MS01-017.mspx [microsoft.com]
This was a class-3 code-signing certificate from Verisign, giving all the correct details for Microsoft but the request was coming from a bunch of crackers. How long, then, until the phishers figure out how to get EV-SSL certificates of their own?
What happens when this is cracked? (Score:3, Insightful)
And we know that it's only a matter of time...
And the clincher is that the longer it takes to crack, the worse the ramifications are going to be when it happens.
The Haiku people did this (Score:3, Interesting)
Small Business (Score:2)
I feel a great disturbance in the force... (Score:2)
As if millions of small businesses owners suddenly cried out for their lawyers.
There's another problem here (Score:5, Interesting)
We have no problem getting the new certificates but what company name should appear in the bar? If we put our own name in, we will consfuse the end users who have never heard of us. If we want to use our customers company name, then they each have to get their own certificate and we have to assign separate IP addresses to each of our customers - at the moement we only need one IP.
What a nuisance.
Re: (Score:2)
As small business owner faced with having to go through all sorts of shit setting up a corp to merely appear nice and trustworthy like a big company such as Enron, I'd quite happily forefeit my fancy logo in favor of your generic "Acme Online Stores message bar.
As for Microsoft, I wish they'd just go away.
Let me get this straight (Score:2)
1) MS do nothing about phishing, and are lambasted about a lack of security, not addressing the problem, etc
2) MS do something about phishing, and are lambasted about making it harder for unknown/sole traders to set up "trusted" websites
Do I have that right? MS do nothing, get slated, do something, get slate
I can't wait (Score:2)
Or worse, turns a legit site red, and then suggest a bogus site to visit instead.
Considering the MS security history, this is very plausible.
What's the big problem with phishing? (Score:2)
Small Business Can't Afford These Anyway (Score:3, Interesting)
Several CAs, including Digicert [websitehostdirectory.com], are seeking to have the standard revised to include small businesses. I don't believe the CA/Browser Forum has finalized the standard yet, as there were some holdouts last I checked.
Re:extortion (Score:5, Insightful)
This isn't even a problem of "paying up".... the small one-person companies don't even qualify to get certified for the green status... no amount of money will anoint them. This is where is starts to be unfair.
Why is this unfair? (Score:3, Interesting)
Nobody is making anyone run their business as a sole proprietorship. And this day in this sue-happy age, there's plenty of other reasons incorporation is a good idea.
Re:Why is this unfair? (Score:5, Interesting)
Re: (Score:3, Informative)
Why should I be forced to pay someone to create a website and rent a server when a brick-and-mortar storefront is JUST AS LEGITIMATE as a web storefront?
Fact is, you're not. Nobody is forcing you to spend money to incorporate. But just like if you want to sell on the internet, you need to pay for a website, if you want a certifying authority to certify your identity, then you need to meet
Re:Why is this unfair? (Score:5, Informative)
If you can't get a certificate as a sole proprietorship, INCORPORATE! Problem solved. [...] And this day in this sue-happy age, there's plenty of other reasons incorporation is a good idea.
Sole proprietor here. As someone who has spent a lot of time and energy looking at sole proprietorship vs llc vs s-corp incorporation, let me just mention that (contrary to popular belief) incorporation isn't some magic bullet that completely shields business owners/officers from liability - just ask Ken Lay. Incorporation does help shield business owners from the incompetence/misconduct of other employees. Of course this doesn't matter in one-person companies where (by definition) all the business decisions are made by the business owners.
Incorporation does, in theory, separate business assets from personal assets. However, in our "sue-happy" environment, there is a very easy way to get around this separation: simply sue the business *and* the owner.
There are scenarios when it makes sense to incorporate: lower tax rates (only worth it for six-figure revenues by my calcs), if you have employees, if you have multiple locations, if you're trying to establish a Chinese wall for separate-but-related business, etc.
Incorporating in my case (1-person business) would mean hiring a lawyer and accountant to file the annual state forms, draw up the stock agreement, and file the taxes in return for a few hundred dollars in tax savings and pretty much no liability protection. I found it was much cheaper to buy gen liability and E&O insurance (needed anyway for certain gov't contracts I have), and remain a sole proprietor. I imagine that this is true for hundreds (if not thousands) of other businesses across the US.
Re: (Score:2)
So if I insist that someone give my friend money, or I'll threaten their ability to do business, it's not extortion because I'm not the one getting paid?
I'll have to remember that one!
Re:Yeah, they will. (Score:4, Insightful)
Don't confuse ignorance with stupidity. There is a world of difference.
Re: (Score:2)
Yes, you are completely wrong.
I do know that all their screws are left threaded though.
No. Have a look at your hardware stoer. Where are 90% of the products made?
Are you a troll, or just an idiot?
Re: (Score:2)
Since many consumer appliances are effectively non-repairable, they use whatever parts are convenient. Have a look at any cheap appaince and you'll find all the screws are RH. And by the way, I LIVE IN CHINA. I've never seen LH threaded anything, except perhaps the usual exceptions like gas pipes and some bicycle parts. Why on earth do you (or the original poster, if that's not you) think LH threads are used here?
Re:Yeah, they will. (Score:4, Informative)
I live in China. I was trying to think of some evidence you could actually see short of catching a plane. And while a box of loose screws would obviously be made to whatever spec the customer wanted, internal screws for consumer appliances, which is what I meant, not loose screws, would be whatever was available to the factory and cheapest -- having been involved with export, cost is everything. Why would they increase costs by using a different kind of screw that has no inherent benefits? Historically, China's heavy inudstry was based on Russain technology, which in turn was copied mostly from Europe. More recently, Japanese, based on US standards, though fortuantely mostly metricated.
I still fail to understand why anyone would imagine LH screws would be standard in China.
PS. Chinese vaginas aren't sloped sideways either.
Re: (Score:2)
"Green means good" when you are running McAfee SiteAdvisor for Firefox.
The solution for small business will be to market through a strong co-op or an established corporate partner like Amazon or eBay. The benefits are obvious and a phishing filter can't do much more than push things along a little faster.
Re:Yeah, they will. (Score:5, Insightful)
> an established corporate partner like Amazon or eBay. The benefits are obvious
Yes. Control. Amazon and Ebay can suck off most of the profits and prevent the small businesses from growing into competitors.
Re:How does the Phishing thing work? (Score:5, Informative)
White is the default state, and says nothing about the site.
Red is when the site matches a blacklist of known phishing sites. (If you have the antiphishing turned on, it will check with MS each time you load a new page.)
Green is when the site uses one of these new SSL certificates which provides additional data and (supposedly) has a tougher approval process in which the certificate authority does an actual background check on the company instead of just making sure they have a working phone number. One hopes a blacklist hit will trump this.
A secure site that uses a standard SSL cert and is not a known phisher will have a white location bar.
Re: (Score:3, Informative)
Re: (Score:2)
That's OK, since about 4% don't distinguish between good and bad [cenaps.com] either.