UK company to release free tool to verify SSL authenticity on e-commerce sites
Security and Standards, a UK-based developer of internet security technology, has unveiled Growl, a free downloadable tool that enables consumers to check whether it is safe to enter personal details over an internet connection. Growl has two components: downloadable software that runs whenever a user opens an internet browser and a Security and Standards-hosted server that checks URLs against around 350,000 certificates issued by SSL Certification authorities.
In practice, this means that an e-commerce site can be run through a security check to see if they use SSL, and an identity check, guarding against so-called middle-man attacks where fraudsters set up dummy Web pages to extract credit card information.
Security boffins release Growl
by Derek Parkinson on 15 August 2001 14:20:00 GMT
The service, which checks Secure Socket Layer (SSL) encryption on e-commerce sites, can also establish whether site owners are members of trade or professional organisations
SSL is the software layer that passes encrypted data between Hypertext Transfer Protocol (HTTP) and Transport Control Protocol (TCP) layers, using a public-and-private key encryption system originally developed by encryption specialists RSA and visible as a padlock symbol on most browsers.
Users will be guided by a ‘traffic light’ system that distinguishes between e-commerce sites that offer SSL-encrypted transactions, sites that are SSL-secured, but where there are discrepancies with details held on the digital certificate, and sites which offer no SSL security.
According to Security and Standards MD John Ross, Growl will be available in the next two weeks or so. The company has yet to develop a wireless version of Growl: “We expect wireless standards to move closer to native internet standards – we use standards that are already in place,” said Ross. “When that move has happened we will consider a wireless version,” he added. According to sources close to the company, it is likely that the UK government e-envoy’s office will conduct trials of the software as part of an initiative to migrate government functions online – submitting personal data for tax purposes, for example.
The company draws on the security experience of Ross, who has worked as a consultant for the UK Ministry of Defence, EC and BT, and technical director Nick Pope, who has worked on Public Key standards such as X.509v3.
