Tim Callan's SSL Blog

If you're in the greater Washington D.C. area, make sure you drop by to see these two speaking opportunities from VeriSign representatives.

I will be speaking on using security indicators to increase online sales at eTail East in Baltimore on August 4. If you're going to eTail, make sure you come up after the speech and say hello.

Fellow VeriSign blogger Bob Angus will be presenting how to sell premium services to cost-sensitive customers at HostinCon in Washington D.C. on August 11. I'll be at HostingCon as well, so once again, if you're an SSL Blog reader, stop by the VeriSign table.

We're seeing active discussion online about the possibility of hijacking a single frame in a production site to steal logins or PII. The scenario is that a criminal gang would redirect this frame (through DNS poisoning, let's say) and populate it with its own content from servers under its control. Presumably this content would involve form fields asking for information the criminals want to receive and which you would be willing to share in this context (such as your bank account login or social security number).

Now, the recent dialog is around the scenario where this proposed attack happens on a site with an Extended Validation SSL Certificate. The certificate identifies the controller of the top-level frame and does not report on the sources of any internal frames in that page. That is in keeping with near-ubiquitous practices in consumer Web applications. Sites that offer complex and varied services in large production environments (such as a popular bank, portal, or e-commerce site) have no other practical choice if they want to offer the applications, performance, and uptime their customers demand. Often the sources of content for these frames originate outside the company operating the actual site. Many of these businesses mash up content from partners and specialized service providers in order to meet their product online needs. By way of example, any site using an ad network or content acceleration service is accepting content from another party.

So what should we do with EV SSL? The answer is we should do exactly what we are doing. It's still an incredibly valuable piece of information to know whether or not the operator of this site is who you think it is. This information is indispensible for consumers to protect themselves against the classic phishing attack. This attack is still the most widespread and damaging social engineering attack in history, and it still represents the greatest risk to consumers engaged in transactions online.

At the same time, we need to address the vulnerabilities that make these iFrame attacks possible. We need to lock down DNS security and beat malware and provide tools for laptop users to distinguish between rogue and benign wireless networks. These are the ways the security of the ecosystem is compromised. These are the weak points that this attack exploits. Think of SSL as a secure lock on the front door of your house. If the front door is secure but it turns out the back door is wide open, you might still find a stranger in your living room. So let's go put a lock on the back door, too.

You may remember the Cart Whisperer, VeriSign's viral marketing campaign promoting Extended Validation SSL. You may remember that this campaign gained widespread recognition such as Marketing Sherpa's Top 10 Viral Campaigns, a Cannes screening, and the IAC Award for Outstanding Achievement in Internet Advertising.

Well, the list keeps growing. The latest addition to Liberty Fillmore's credits is the Silver Telly Award for best Internet/online business-to-business campaign. The Telly Award is the most prestigious advertising award focused on the film and video media, and a Silver award is the highest honor. The Cart Whisperer emerged from over 13,000 entries to win this award.

Hi folks. Sorry for the lack of posts lately. I've been slammed.

Writing today because Firefox 3.5 has broken the download record for a new browser version with over 8 million downloads in a single day. One subject that has been the source online discussion is the fact that the EV certificates for a series of SSL brands (four that I know of) have stopped showing up green in Firefox 3.5.

You can be assured that this problem does not happen with the EV SSL Certificates from VeriSign, thawte, or GeoTrust.

Greece was phenomenal. I want to move there.

Hey everybody,

We're disappearing to an obscure corner of the world for a couple of weeks, and I don't think I'll be blogging. I'll let you know when I'm back in contact.

Here's a cool Advertising Age article about how businesses view online crime and brand damage and what they do about it.

Well, I didn't win the Best Corporate Security Blog at the Security Blogger Meetup. The winner in my category was Sunbelt Security's corporate blog. I want to personally thank all of you who voted for me. It is a great compliment that you, the readers, view this blog as worthy of such an award. And you're the people whose opinion matters the most.

Remember the Cart Whisperer, VeriSign's award-winning viral marketing campaign launched last year to educate businesses about the dangers of abandoned shopping carts and what they could do about them? The Cart Whisperer previously has been honored as one of Marketing Sherpa's top ten campaigns of 2008 and screened at the Cannes film festival. Now it has been honored by The Web Marketing Association with an Internet Advertising Competition Award for Outstanding Achievement in Internet Advertising.

Here's today's press release about the near-ubiquity of Extended Validation SSL among Japanese banking institutions.

A new report from Gartner states that the number of phishing incidents rose 39.8% with an average loss per incident of $351. This article summarizes Gartner's recommended response for online businesses,

Gartner recommends that enterprises continue to deploy and improve security solutions that protect accounts and customers against attacks. Enterprises that are custodians of customer accounts should also consider site authentication or assurance to confirm to a customer that he or she is on a legitimate Web site and not a spoof site.

Gartner analyst Avivah Latan goes on to suggest a layered security approach as the best response to phishing.

If you're going to Net.Finance in Las Vegas next week, I'm speaking in the main session on Tuesday morning with Jason Dufner of Flagstar Bank. The title of my presentation is Reputation Management: Consumer Trust Is More Than Just Security. I'll be tweeting on how it went.

I've been doing Tim Callan's SSL Blog for just over three years and have put up over 300 posts. For a while I've been itching to branch out into some other media. Therefore I'm pleased to introduce you to Tim Callan's SSL Vlog. The purpose for the vlog is to better match the medium to the message. Blogs are great for linking and for in-depth discussion of matters the readers already understand. Vlogs allow verbal explanations, which for many people is an easier way to digest concepts that are new to them. Therefore at least at the beginning I intend to use this vlog to lay groundwork about how our e-commerce security infrastructure works and what the big trends are in the ecosystem. Just as I figured out the ins and outs of how I could best use my blog to contribute to the public dialog, I expect to go through a similar process with vlogging.

I'm also tweeting, so follow me there. Again, I have a different vision for this medium. I often have immediate observations I want to make but don't have time to write up a full blog post or am not at a computer or both. I'm tweeting from my phone, so I can capture those immediate opportunities as they arrive. Again, I reserve the right to change my vision for this medium as time progresses.

Readers of The SSL Blog, you have spoken. Today the Security Bloggers Meetup announced the finalists for its Social Security Awards for best security blog in a variety of categories. I am a finalist in the Best Corporate Blog category, and my fellow VeriSign blogger Branden Williams is a finalist in the Most Entertaining Security Blog category for his Security Convergence blog.

I've been waiting for it to happen, and here we are. Apple officially wins the smartphone race for Extended Validation SSL support. That's because Mobile Safari now has Extended Validation SSL support. On the heels of Internet Explorer's adoption of EV support in January 2007, the desktop saw a wave of browsers adding in support. With over 60% of mobile browser usage, iPhone is the pacesetter in this market. I hope Apple has broken the ice for mobile devices to do the same thing.