bits & bytes - Ping! Zine Web Tech Magazine

servers – most notably the use of SSL (Secure Sockets Layer)
encryption. The use of SSL has invariably encouraged online
commerce, and as a result, the Internet economy has come to
depend on SSL to provide the trust infrastructure. Since the SSL
protocol was released by Netscape as a security technology in
1996, consumers have been educated to look for the SSL padlock
before passing any critical details over the Internet. Technically,
the SSL protocol provides an encrypted link between two parties,
however in the eyes of the consumer, seeing the SSL padlock has
become so much more, letting people know that:
• That they have a secure, encrypted link with the website
• That the website displaying the padlock is a valid and
legitimate organization, or an accountable legal entity
Unfortunately, however, whilst this was originally the true
meaning of the padlock, changes in the validation practices of a
handful of Certification Authorities created an alternative, lowercost
SSL certificate type that did not fulfil the previous stringent
validation practices used to verify the authenticity of the applicant.
Over time, these ‘Low Assurance’ certificates were incorrectly
deployed on numerous e-commerce websites, rather than being
used for the actual role they were designed to fulfil (i.e. serving
the needs of mail servers, Intranets, SSL VPNs or other similar
devices where organizational details were not a requirement). The
result was an erosion of trust in the internet experience.
To combat this new confusion in the market place, web browsers
such as Opera 8 and the forthcoming Internet Explorer 7.0 will
display new information within the padlock, to help consumers
differentiate between “high assurance” and “low assurance”
certificates. Opera has chosen to display the organizational
details next to the padlock, whilst Microsoft have released a
white paper on their enhanced security status bar, highlighting
the ease by which information can be found on the ‘entity’
through new dropdown padlock functionality. They state that
“With the explosion of small- and home- based business websites
selling goods that span the pricing spectrum, users are even more
likely to encounter unknown entities asking for their financial
information. These factors combine to create a situation ripe
for malicious abuse. Internet Explorer 7 addresses this issue by
providing users with clear and prominent visual cues to the safety
and trustworthiness of a website”
It is therefore absolutely essential that any new e-commerce
business uses a “High Assurance” SSL certificate on their secure
payment and data collection pages, to ensure the highest level of
consumer trust.
Another strategy to improve trust credentials of a site that
“levels the playing field” for many new e-merchants is to
utilize additional site seal/trust indicators, proven by numerous
consumer study groups to be a particularly effective technique
of influencing consumer buying behavior. These act to provide
a positive indicator of trust in the authenticity of the site, while
the additional brand strength from the seal itself gives consumers
additional confidence. Examples of cross industry third party
www.pingzine.com 39