Tim Callan's SSL BlogDemystifying the Web's Secure BackboneGood resource for tracking uplift from Extended Validation SSL- September 15, 2008 As you may know, lots of online businesses have measured the results of putting Extended Validation SSL on their sites and have universally found that it increases the propensity for site visitors to complete sensitive transactions. With so many measurements of EV's effect (I am aware of seventeen such tests, personally), we have decided to gather as many of them together in one place so that it's easy to take in the science all at once. The SSL case studies are here.https://blogs.verisign.com/ssl-blog/2008/09/good_resource_for_tracking_upl.php GeoTrust and thawte roots now included in Opera- September 12, 2008 Regular readers of The SSL Blog will know that Opera 9.5 supports EV and has supported the VeriSign root from the very beginning. Well, Opera 9.5 now contains native support for GeoTrust and thawte roots as well.https://blogs.verisign.com/ssl-blog/2008/09/geotrust_and_thawte_roots_now.php Amazon.com's first EV and seal deployment- September 11, 2008 After a year and a half of people asking me the question, I'm happy to state that the company Amazon.com is using both Extended Validation SSL and the VeriSign Secured Seal in production. In particular Amazon has chosen to roll out these confidence enhancers first on its Amazon Sourcing page. My conjecture is that this page is for vendors who provide goods or services to Amazon.com, the company. I wonder if the public facing stores are to follow.https://blogs.verisign.com/ssl-blog/2008/09/amazoncoms_first_ev_and_seal_d.php Firefox 3 and SSL Certificate errors- September 10, 2008 Apologies for pointing to kind of an old article, but this article goes into depth on how Firefox 3 handles errors with SSL Certificates. These errors include such things as domain name mismatches, expired certificates, and untrusted (e.g. self-signed) roots. The comments on the article also include a lively and intelligent discussion of the issues surrounding self-signed certificates.https://blogs.verisign.com/ssl-blog/2008/09/firefox_3_and_ssl_certificate.php Some Q&A from my recent Web seminar - part 1- September 9, 2008 I mentioned that I recently gave a Web seminar with some lively questions at the end. I'll present some of the questions I received, with my responses. Because I received so darn many questions, I'll break this one into multiple postings. Q: If EV is so far ahead of standard SSL (in terms of securityauthentication), do you think the PCI industry will mandate EV in near future A: I certainly hope so. EV is a definite improvement to a consumer's ability to protect herself against credit..https://blogs.verisign.com/ssl-blog/2008/09/some_qa_from_my_recent_web_sem.php More intel on Chrome and SSL- September 4, 2008 As promised I've looked a little more into the SSL behaviors in Chrome. Chrome has a nice, strong interface regarding certificate errors. The browser presents a roadblock that you have to explicitly pass to access the page (similar to recent developments in, let's say, IE and Firefox), at the bottom of which you see two buttons, "Proceed anyway" and "Back to safety". If you select "Proceed anyway," then you can access the page, but now the https in the Web address is highlighted in red and..https://blogs.verisign.com/ssl-blog/2008/09/more_intel_on_chrome_and_ssl.php How Google Chrome supports EV SSL- September 3, 2008 If you've been camping in the mountains or something you may not have heard that Google will be releasing its own browser, Chrome. As you might expect, I was instantly curious about how Chrome works with SSL. These are quick and dirty preliminary results, but here's what I have for you today. Chrome appears to work with SSL in the expected manner. When SSL is in place, the address bar still displays https, and a lock icon appears next to the address bar. Chrome also recognizes Extended..https://blogs.verisign.com/ssl-blog/2008/09/how_google_chrome_supports_ev.php |